一、集群机器

linux-node1：192.168.56.11     ---master部署的服务：etcdkube-apiserverkube-controller-managerkube-schedulerdockerlinux-node2：192.168.56.12      ---node部署的服务：etcdkubeletkube-proxydockerlinux-node3：192.168.56.13      ---node部署的服务：etcdkubeletkube-proxydocker

二、环境准备

1、设置主机名hostnamectl set-hostname linux-node1hostnamectl set-hostname linux-node2hostnamectl set-hostname linux-node3----------2、设置部署节点到其它所有节点的SSH免密码登(包括本机)[root@linux-node1 ~]# ssh-keygen -t rsa[root@linux-node1 ~]# ssh-copy-id linux-node1[root@linux-node1 ~]# ssh-copy-id linux-node2[root@linux-node1 ~]# ssh-copy-id linux-node3----------3、绑定主机hostcat > /etc/hosts <
    
     /dev/null 2>&1#vim  /etc/profile   高亮显示export PS1="\[\e]0;\a\]\n\[\e[1;32m\]\[\e[1;33m\]\H\[\e[1;35m\]<\$(date +\"%Y-%m-%d %T\")> \[\e[32m\]\w\[\e[0m\]\n\u>\\$ "#设置时区cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime#SSH登录慢sed -i "s/#UseDNS yes/UseDNS no/"  /etc/ssh/sshd_configsed -i "s/GSSAPIAuthentication yes/GSSAPIAuthentication no/"  /etc/ssh/sshd_configsystemctl restart sshd.service
    

三、正式安装

1.安装Docker(三台机器都要操作)

第一步：使用国内Docker源cd /etc/yum.repos.d/wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo第二步：Docker安装yum install -y docker-ce第三步：启动后台进程[root@linux-node2 ~]# systemctl start docker[root@linux-node2 ~]# systemctl enable dockerCreated symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.

2.安装k8s

1.准备部署目录   [root@linux-node1 ~]# mkdir -p /opt/kubernetes/{cfg,bin,ssl,log}#添加环境变量[root@linux-node1 ~]# echo "PATH=$PATH:/opt/kubernetes/bin" >> /etc/profile[root@linux-node1 ~]# source /etc/profile或者[root@linux-node1 ~]# vim .bash_profilePATH=$PATH:$HOME/bin:/opt/kubernetes/bin[root@linux-node1 ~]# source .bash_profile2.准备软件包#github下载链接https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#server-binarieswget https://storage.googleapis.com/kubernetes-release/release/v1.10.8/kubernetes-server-linux-amd64.tar.gzwget https://storage.googleapis.com/kubernetes-release/release/v1.10.8/kubernetes-client-linux-amd64.tar.gzwget https://storage.googleapis.com/kubernetes-release/release/v1.10.8/kubernetes-node-linux-amd64.tar.gzwget https://storage.googleapis.com/kubernetes-release/release/v1.10.8/kubernetes.tar.gz3.解压软件包tar -zxvf kubernetes.tar.gz -C /usr/local/src/tar -zxvf kubernetes-server-linux-amd64.tar.gz -C /usr/local/src/tar -zxvf kubernetes-client-linux-amd64.tar.gz -C /usr/local/src/tar -zxvf kubernetes-node-linux-amd64.tar.gz -C /usr/local/src/

3.手动制作CA证书（只在master上进行即可）

1.安装 CFSSL[root@linux-node1 ~]# cd /usr/local/src[root@linux-node1 src]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64[root@linux-node1 src]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64[root@linux-node1 src]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64[root@linux-node1 src]# chmod +x cfssl*[root@linux-node1 src]# mv cfssl-certinfo_linux-amd64 /opt/kubernetes/bin/cfssl-certinfo[root@linux-node1 src]# mv cfssljson_linux-amd64  /opt/kubernetes/bin/cfssljson[root@linux-node1 src]# mv cfssl_linux-amd64  /opt/kubernetes/bin/cfssl#复制cfssl命令文件到k8s-node1和k8s-node2节点。如果实际中多个节点，就都需要同步复制。[root@linux-node1 ~]# scp /opt/kubernetes/bin/cfssl* 192.168.56.12:/opt/kubernetes/bin[root@linux-node1 ~]# scp /opt/kubernetes/bin/cfssl* 192.168.56.13:/opt/kubernetes/bin2.初始化cfssl[root@linux-node1 src]# mkdir ssl && cd ssl[root@linux-node1 ssl]# cfssl print-defaults config > config.json   --生成ca-config.json的样例(可省略)[root@linux-node1 ssl]# cfssl print-defaults csr > csr.json  --生成ca-csr.json的样例(可省略)3.创建用来生成 CA 文件的 JSON 配置文件[root@linux-node1 ssl]#cat > ca-config.json <
    
      ca-csr.json <
    

4.手动部署ETCD集群

0.准备etcd软件包wget https://github.com/coreos/etcd/releases/download/v3.2.18/etcd-v3.2.18-linux-amd64.tar.gz[root@linux-node1 src]# tar zxf etcd-v3.2.18-linux-amd64.tar.gz[root@linux-node1 src]# cd etcd-v3.2.18-linux-amd64[root@linux-node1 etcd-v3.2.18-linux-amd64]# cp etcd etcdctl /opt/kubernetes/bin/ [root@linux-node1 etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 192.168.56.12:/opt/kubernetes/bin/[root@linux-node1 etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 192.168.56.13:/opt/kubernetes/bin/1.创建 etcd 证书签名请求：[root@linux-node1]# cd /usr/local/src/sslcat > etcd-csr.json <

5.Master节点部署

部署Kubernetes API服务部署

0.准备软件包[root@linux-node1 ~]# cd /usr/local/src/kubernetes[root@linux-node1 kubernetes]# cp server/bin/kube-apiserver /opt/kubernetes/bin/[root@linux-node1 kubernetes]# cp server/bin/kube-controller-manager /opt/kubernetes/bin/[root@linux-node1 kubernetes]# cp server/bin/kube-scheduler /opt/kubernetes/bin/1.创建生成CSR的 JSON 配置文件[root@linux-node1 ~]# cd /usr/local/src/ssl[root@linux-node1 src]# vim kubernetes-csr.jsoncat > kubernetes-csr.json <

部署Controller Manager服务

[root@linux-node1 ~]# vim /usr/lib/systemd/system/kube-controller-manager.service[Unit]Description=Kubernetes Controller ManagerDocumentation=https://github.com/GoogleCloudPlatform/kubernetes[Service]ExecStart=/opt/kubernetes/bin/kube-controller-manager \  --address=127.0.0.1 \  --master=http://127.0.0.1:8080 \  --allocate-node-cidrs=true \  --service-cluster-ip-range=10.1.0.0/16 \  --cluster-cidr=10.2.0.0/16 \  --cluster-name=kubernetes \  --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \  --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \  --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \  --root-ca-file=/opt/kubernetes/ssl/ca.pem \  --leader-elect=true \  --v=2 \  --logtostderr=false \  --log-dir=/opt/kubernetes/logRestart=on-failureRestartSec=5[Install]WantedBy=multi-user.target3.启动Controller Manager[root@linux-node1 ~]# systemctl daemon-reload[root@linux-node1 scripts]# systemctl enable kube-controller-manager[root@linux-node1 scripts]# systemctl start kube-controller-manager4.查看服务状态[root@linux-node1 scripts]# systemctl status kube-controller-manager

部署Kubernetes Scheduler

[root@linux-node1 ~]# vim /usr/lib/systemd/system/kube-scheduler.service[Unit]Description=Kubernetes SchedulerDocumentation=https://github.com/GoogleCloudPlatform/kubernetes[Service]ExecStart=/opt/kubernetes/bin/kube-scheduler \  --address=127.0.0.1 \  --master=http://127.0.0.1:8080 \  --leader-elect=true \  --v=2 \  --logtostderr=false \  --log-dir=/opt/kubernetes/logRestart=on-failureRestartSec=5[Install]WantedBy=multi-user.target2.部署服务[root@linux-node1 ~]# systemctl daemon-reload[root@linux-node1 scripts]# systemctl enable kube-scheduler[root@linux-node1 scripts]# systemctl start kube-scheduler[root@linux-node1 scripts]# systemctl status kube-scheduler

部署kubectl 命令行工具

1.准备二进制命令包[root@linux-node1 ~]# cd /usr/local/src/kubernetes/client/bin[root@linux-node1 bin]# cp kubectl /opt/kubernetes/bin/#需要将kubectl复制到node节点[root@linux-node1 bin]# scp /opt/kubernetes/bin/kubectl linux-node2:/opt/kubernetes/bin/[root@linux-node1 bin]# scp /opt/kubernetes/bin/kubectl linux-node3:/opt/kubernetes/bin/2.创建 admin 证书签名请求[root@linux-node1 ~]# cd /usr/local/src/ssl/[root@linux-node1 ssl]# cat > admin-csr.json <

6.Node节点部署

部署kubelet

1.二进制包准备 将软件包从linux-node1复制到linux-node2中去。[root@linux-node1 ~]# cd /usr/local/src/kubernetes/server/bin/[root@linux-node1 bin]# cp kubelet kube-proxy /opt/kubernetes/bin/[root@linux-node1 bin]# scp kubelet kube-proxy 192.168.56.12:/opt/kubernetes/bin/[root@linux-node1 bin]# scp kubelet kube-proxy 192.168.56.13:/opt/kubernetes/bin/2.创建角色绑定[root@linux-node1 ~]# kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrapclusterrolebinding "kubelet-bootstrap" created3.创建 kubelet bootstrapping kubeconfig 文件 设置集群参数[root@linux-node1 ~]# kubectl config set-cluster kubernetes \   --certificate-authority=/opt/kubernetes/ssl/ca.pem \   --embed-certs=true \   --server=https://192.168.56.11:6443 \   --kubeconfig=bootstrap.kubeconfigCluster "kubernetes" set.设置客户端认证参数[root@linux-node1 ~]# kubectl config set-credentials kubelet-bootstrap \   --token=ad6d5bb607a186796d8861557df0d17f \   --kubeconfig=bootstrap.kubeconfig   User "kubelet-bootstrap" set.设置上下文参数[root@linux-node1 ~]# kubectl config set-context default \   --cluster=kubernetes \   --user=kubelet-bootstrap \   --kubeconfig=bootstrap.kubeconfigContext "default" created.选择默认上下文[root@linux-node1 ~]# kubectl config use-context default --kubeconfig=bootstrap.kubeconfigSwitched to context "default".[root@linux-node1 kubernetes]# cp bootstrap.kubeconfig /opt/kubernetes/cfg[root@linux-node1 kubernetes]# scp bootstrap.kubeconfig 192.168.56.12:/opt/kubernetes/cfg[root@linux-node1 kubernetes]# scp bootstrap.kubeconfig 192.168.56.13:/opt/kubernetes/cfg在node节点上操作,部署kubelet 1.设置CNI支持[root@linux-node2 ~]# mkdir -p /etc/cni/net.d[root@linux-node2 ~]# vim /etc/cni/net.d/10-default.confcat > /etc/cni/net.d/10-default.conf <
    
     0{print $1}'| xargs kubectl certificate approve成功后是Approved的状态[root@linux-node1 bin]# kubectl get csrNAME                                                   AGE       REQUESTOR           CONDITIONnode-csr-IPMSFbKvwgq2icOeIo2v_WA-qb8QCyA7MT5h4eDmjxg   2m        kubelet-bootstrap   Approved,Issued执行完毕后，查看节点状态已经是Ready的状态了 [root@linux-node1 ~]# kubectl get nodeNAME            STATUS    ROLES     AGE       VERSION192.168.56.12   Ready     
     
          2m        v1.10.8
     
    

部署Kubernetes Proxy

1.配置kube-proxy使用LVS[root@linux-node2 ~]# yum install -y ipvsadm ipset conntrack2.创建 kube-proxy 证书请求[root@linux-node1 ~]# cd /usr/local/src/ssl/[root@linux-node1 ~]# vim kube-proxy-csr.jsoncat > kube-proxy-csr.json <
    
      RemoteAddress:Port           Forward Weight ActiveConn InActConnTCP  10.1.0.1:443 rr persistent 10800  -> 192.168.56.11:6443           Masq    1      0          0         如果你在两台实验机器都安装了kubelet和proxy服务，使用下面的命令可以检查状态：[root@linux-node1 ssl]#  kubectl get nodeNAME            STATUS    ROLES     AGE       VERSION192.168.56.12   Ready     
     
          22m       v1.10.1192.168.56.13   Ready     
      
           3m        v1.10.1linux-node3节点请自行部署。
      
     
    

7.Flannel部署

1.为Flannel生成证书[root@linux-node1 ~]# vim flanneld-csr.jsoncat > flanneld-csr.json <

8.应用创建

1.创建一个测试用的deployment[root@linux-node1 ~]# kubectl run net-test --image=alpine --replicas=2 sleep 3600002.查看获取IP情况[root@linux-node1 ~]# kubectl get pod -o wideNAME                        READY     STATUS    RESTARTS   AGE       IP          NODEnet-test-74f45db489-gmgv8   1/1       Running   0          1m        10.2.83.2   192.168.56.13net-test-74f45db489-pr5jc   1/1       Running   0          1m        10.2.59.2   192.168.56.123.测试联通性(在对应的node节点去测试)ping 10.2.83.2