devbox
盐析白兔
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

ubuntu22.04安装kubernetes1.28

作者：盐析白兔 | 2024-05-21 06:33:48

赞

踩

ubuntu22.04安装kubernetes

一、环境介绍

注意：一般3个节点就行，搭建好后，根据需要节点可以再扩充

二、所有节点都要执行

1、虚拟机基础环境配置

  1. # 1 修改为静态ip地址
  2. ssh ziu@192.168.48.x
  3. sudo su
  4. cp /etc/netplan/00-installer-config.yaml /etc/netplan/00-installer-config.yaml.bbk
  5.  
  6.  
  7. vim /etc/netplan/00-installer-config.yaml  # ubuntu22.04的设置方法
  8. network:
  9.   ethernets:
  10.     ens33:
  11.       dhcp4: false
  12.       addresses: [192.168.48.210/24]
  13.       optional: true
  14.       routes:
  15.         - to: default
  16.           via: 192.168.48.2
  17.       nameservers: 
  18.         addresses: [192.168.48.2]
  19.   version: 2
  20.  
  21.   
  22.   netplan apply
  23.  
  24.  
  25. # 2 修改为root登录
  26. sudo su
  27. passwd root
  28.  
  29. vim /etc/ssh/sshd_config
  30. ...
  31. PermitRootLogin yes
  32.  
  33. sudo service ssh restart
  34.  
  35.  
  36. # 3 修改主机名和hosts
  37.  
  38. hostnamectl set-hostname xxx
  39.  
  40. vim /etc/hosts
  41. ...
  42. 192.168.48.210 kmaster
  43. 192.168.48.211 knode1
  44. 192.168.48.212 knode2
  45. 192.168.48.213 knode3  ##新增的然后同步到其他主机
  46. 192.168.48.214 knode4  ##新增的然后同步到其他主机

2、linux内核参数修改

  1. # 设置转发 IPv4 并让 iptables 看到桥接流量
  2.  
  3.  
  4. cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
  5. overlay
  6. br_netfilter
  7. EOF
  8.  
  9. sudo modprobe overlay
  10. sudo modprobe br_netfilter
  11.  
  12. # 设置所需的 sysctl 参数，参数在重新启动后保持不变
  13. cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
  14. net.bridge.bridge-nf-call-iptables  = 1
  15. net.bridge.bridge-nf-call-ip6tables = 1
  16. net.ipv4.ip_forward                 = 1
  17. EOF
  18.  
  19. # 应用 sysctl 参数而不重新启动
  20. sudo sysctl --system
  21. # 通过运行以下指令确认 br_netfilter 和 overlay 模块被加载：
  22.  
  23. lsmod | grep br_netfilter
  24. lsmod | grep overlay
  25.  
  26. #通过运行以下指令确认 net.bridge.bridge-nf-call-iptables、net.bridge.bridge-nf-call-ip6tables 和 net.ipv4.ip_forward 系统变量在你的 sysctl 配置中被设置为 1：
  27.  
  28. sysctl net.bridge.bridge-nf-call-iptables net.bridge.bridge-nf-call-ip6tables net.ipv4.ip_forward

3、设置cgroups驱动（此步骤不操作，后面设置）

        有2种设置方式：cgroupfs和systemd，k8s官网建议使用systemd
        要将 systemd 设置为 cgroup 驱动，需编辑 KubeletConfiguration 的 cgroupDriver 选项，并将其设置为 systemd。例如：

  1. apiVersion: kubelet.config.k8s.io/v1beta1
  2. kind: KubeletConfiguration
  3. ...
  4. cgroupDriver: systemd

        说明：从 v1.22 开始，在使用 kubeadm 创建集群时，如果用户没有在 KubeletConfiguration 下设置 cgroupDriver 字段，kubeadm 默认使用 systemd。

4、CRI版本支持

        目的：安装 CNI plugins

        参考下载地址： https://github.com/containernetworking/plugins/releases

  1. #下载出现问题就请到参考地址重新找资源下载
  2. wget -c https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni-plugins-linux-amd64-v1.3.0.tgz
  3.  
  4. #根据官网的安装步骤来，创建一个目录用于存放cni插件
  5. mkdir -p /opt/cni/bin
  6. tar -xzvf cni-plugins-linux-amd64-v1.3.0.tgz -C /opt/cni/bin/

5、安装容器运行时

  1. # 卸载docker相关的配置
  2. for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove $pkg; done
  3.  
  4. sudo apt-get purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras
  5.  
  6. sudo rm -rf /var/lib/docker
  7. sudo rm -rf /var/lib/containerd
  8.  
  9.  
  10.  
  11. # Add Docker's official GPG key:
  12. # https://docs.docker.com/engine/install/ubuntu/
  13. sudo apt-get update
  14. sudo apt-get install ca-certificates curl gnupg
  15. curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  16. sudo chmod a+r /etc/apt/keyrings/docker.gpg
  17.  
  18. # Add the repository to Apt sources:
  19. echo \
  20.   "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  21.   "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
  22.   sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
  23. sudo apt-get update
  24.  
  25. apt-cache madison containerd.io
  26. apt install containerd.io=1.6.24-1
  27. containerd --version
  28. containerd containerd.io 1.6.24 61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
  29.  
  30. systemctl daemon-reload
  31. systemctl enable --now containerd
  32.  
  33.  
  34. containerd config default >/etc/containerd/config.toml
  35.  
  36. vim /etc/containerd/config.toml
  37. ...
  38. sandbox_image = "registry.k8s.io/pause:3.6"  # 值修改为registry.aliyuncs.com/google_containers/pause:3.9
  39. ...
  40. SystemdCgroup = true   #设置cgroup为systemd，对应前面第2步没执行的，这里设置cgroups驱动
  41.  
  42. systemctl daemon-reload
  43. systemctl restart containerd.service
  44.  
  45.  
  46. #安装runc
  47. #runc是容器运行时，runc实现了容器的init，run，create，ps...我们在运行容器所需要的cmd：
  48. #https://github.com/opencontainers/runc/releases/
  49. curl -LO https://github.com/opencontainers/runc/releases/download/v1.1.10/runc.amd64
  50. install -m 755 runc.amd64 /usr/local/sbin/runc

6、其他配置项

  1. # 确保没个节点上的mac地址和product_uuid的唯一性
  2. cat /sys/class/dmi/id/product_uuid
  3. ip link | grep brd
  4.  
  5.  
  6. # 关闭swap
  7. swapoff -a
  8.  
  9. vim /etc/fstab
  10. ...
  11. #/swap.img
  12.  
  13. free -h
  14.  
  15. # 更正时区,时间同步
  16. #查看时区，时间
  17. tzselect
  18. cp /usr/share/zoneinfo/Asia/Shanghai  /etc/localtime
  19. date
  20.  
  21. #安装chrony，联网同步时间(非必须，一般没问题，我这里没执行)
  22. apt install chrony -y && systemctl enable --now chrony
  23.  
  24.  
  25.  
  26.  
  27.  
  28. # lvm磁盘扩容(系统安装时没有启用lvm可以忽略，目的是将存储资源最大化利用)
  29.  
  30. lvextend -r -l +100%FREE /dev/mapper/ubuntu--vg-ubuntu--lv
  31.  
  32. # 关闭ufw和firewalled
  33. systemctl stop ufw
  34. systemctl disable ufw
  35.  
  36.  
  37. # 禁用selinux（ubuntu没有启用，centos才默认启用，需要注意一下）
  38. #默认ubunt默认是不安装selinux的，如果没有selinux命令和配置文件则说明没有安装selinux，则下面步骤就不用做了
  39. sed -ri 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config 
  40. setenforce 0

7、安装kubeadm，kubectl，kubelet（1.28.0）

  1. #安装k8s的3个工具
  2. apt-get update
  3. apt-get install -y apt-transport-https
  4.  
  5. curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add - 
  6.  
  7. cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
  8. deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main
  9. EOF
  10. apt-get update
  11. apt install apt-file -y
  12. apt-file update
  13.  
  14. # 查看所有包，会列出可以安装的所有版本
  15. apt list kubeadm -a
  16.  
  17.  
  18. apt install kubeadm=1.28.0-00 kubectl=1.28.0-00 kubelet=1.28.0-00 -y
  19.  
  20. systemctl enable kubelet

三、master主节点配置

1、准备k8s集群配置文件

  1. # 导出配置
  2. kubeadm config print init-defaults > Kubernetes-cluster.yaml
  1. #文档可以直接复制这个
  2. vim Kubernetes-cluster.yaml
  3. apiVersion: kubeadm.k8s.io/v1beta3
  4. bootstrapTokens:
  5. - groups:
  6.   - system:bootstrappers:kubeadm:default-node-token
  7.   token: abcdef.0123456789abcdef
  8.   ttl: 24h0m0s
  9.   usages:
  10.   - signing
  11.   - authentication
  12. kind: InitConfiguration
  13. localAPIEndpoint:
  14.   advertiseAddress: 192.168.48.210  ##改为自己的
  15.   bindPort: 6443
  16. nodeRegistration:
  17.   criSocket: unix:///run/containerd/containerd.sock  #改成这样
  18.   imagePullPolicy: IfNotPresent
  19.   name: kmaster    ##改为自己的主机名
  20.   taints: null
  21. ---
  22. apiServer:
  23.   timeoutForControlPlane: 4m0s
  24. apiVersion: kubeadm.k8s.io/v1beta3
  25. certificatesDir: /etc/kubernetes/pki
  26. clusterName: kubernetes
  27. controllerManager: {}
  28. dns: {}
  29. etcd:
  30.   local:
  31.     dataDir: /var/lib/etcd
  32. imageRepository: registry.aliyuncs.com/google_containers  #改成阿里的仓库，加快镜像下载速度
  33. kind: ClusterConfiguration
  34. kubernetesVersion: 1.28.0
  35. networking:
  36.   dnsDomain: cluster.local
  37.   podSubnet: 10.244.0.0/16
  38.   serviceSubnet: 10.96.0.0/12
  39. scheduler: {}

2、初始化集群

        注意设置pause的版本，根据提示来，修改为提示建议的版本即可，读取的/etc/containerd/config.toml的设置。

  1. #执行命令
  2. kubeadm init --config Kubernetes-cluster.yaml
  3.  
  4. #成功后请将以下输出保存
  5.  
  6. Your Kubernetes control-plane has initialized successfully!
  7.  
  8. To start using your cluster, you need to run the following as a regular user:
  9.  
  10.   mkdir -p $HOME/.kube
  11.   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  12.   sudo chown $(id -u):$(id -g) $HOME/.kube/config
  13.  
  14. Alternatively, if you are the root user, you can run:
  15.  
  16.   export KUBECONFIG=/etc/kubernetes/admin.conf
  17.  
  18. You should now deploy a pod network to the cluster.
  19. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  20.   https://kubernetes.io/docs/concepts/cluster-administration/addons/
  21.  
  22. Then you can join any number of worker nodes by running the following on each as root:
  23.  
  24. kubeadm join 192.168.48.210:6443 --token abcdef.0123456789abcdef \
  25. 	--discovery-token-ca-cert-hash sha256:121e29b7f40844aca55b1b57d3115910d62c48906fa9e56c98e9f204027f60b5 
  26.  
  27.  
  28.  
  29. #run the following as a regular user
  30. mkdir -p $HOME/.kube
  31. sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  32. sudo chown $(id -u):$(id -g) $HOME/.kube/config
  33.  
  34.  
  35. #这里集群状态还是noready，需要设置网络，这里用的flannel，请继续执行

3、设置flannel集群网络

  1. #如果某个节点notready，请检查kubelet的状态，然后启动它以及是否安装网络插件比如flannel
  2. #设置网络flannel
  3. #下载flannel配置文件
  4. wget https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
  5.  
  6. cat kube-flannel.yml   ##网络地址和配置kubeadm初始化的pod一致 
  7. apiVersion: v1
  8. kind: Namespace
  9. metadata:
  10.   labels:
  11.     k8s-app: flannel
  12.     pod-security.kubernetes.io/enforce: privileged
  13.   name: kube-flannel
  14. ---
  15. apiVersion: v1
  16. kind: ServiceAccount
  17. metadata:
  18.   labels:
  19.     k8s-app: flannel
  20.   name: flannel
  21.   namespace: kube-flannel
  22. ---
  23. apiVersion: rbac.authorization.k8s.io/v1
  24. kind: ClusterRole
  25. metadata:
  26.   labels:
  27.     k8s-app: flannel
  28.   name: flannel
  29. rules:
  30. - apiGroups:
  31.   - ""
  32.   resources:
  33.   - pods
  34.   verbs:
  35.   - get
  36. - apiGroups:
  37.   - ""
  38.   resources:
  39.   - nodes
  40.   verbs:
  41.   - get
  42.   - list
  43.   - watch
  44. - apiGroups:
  45.   - ""
  46.   resources:
  47.   - nodes/status
  48.   verbs:
  49.   - patch
  50. - apiGroups:
  51.   - networking.k8s.io
  52.   resources:
  53.   - clustercidrs
  54.   verbs:
  55.   - list
  56.   - watch
  57. ---
  58. apiVersion: rbac.authorization.k8s.io/v1
  59. kind: ClusterRoleBinding
  60. metadata:
  61.   labels:
  62.     k8s-app: flannel
  63.   name: flannel
  64. roleRef:
  65.   apiGroup: rbac.authorization.k8s.io
  66.   kind: ClusterRole
  67.   name: flannel
  68. subjects:
  69. - kind: ServiceAccount
  70.   name: flannel
  71.   namespace: kube-flannel
  72. ---
  73. apiVersion: v1
  74. data:
  75.   cni-conf.json: |
  76.     {
  77.       "name": "cbr0",
  78.       "cniVersion": "0.3.1",
  79.       "plugins": [
  80.         {
  81.           "type": "flannel",
  82.           "delegate": {
  83.             "hairpinMode": true,
  84.             "isDefaultGateway": true
  85.           }
  86.         },
  87.         {
  88.           "type": "portmap",
  89.           "capabilities": {
  90.             "portMappings": true
  91.           }
  92.         }
  93.       ]
  94.     }
  95.   net-conf.json: |
  96.     {
  97.       "Network": "10.244.0.0/16",
  98.       "Backend": {
  99.         "Type": "vxlan"
  100.       }
  101.     }
  102. kind: ConfigMap
  103. metadata:
  104.   labels:
  105.     app: flannel
  106.     k8s-app: flannel
  107.     tier: node
  108.   name: kube-flannel-cfg
  109.   namespace: kube-flannel
  110. ---
  111. apiVersion: apps/v1
  112. kind: DaemonSet
  113. metadata:
  114.   labels:
  115.     app: flannel
  116.     k8s-app: flannel
  117.     tier: node
  118.   name: kube-flannel-ds
  119.   namespace: kube-flannel
  120. spec:
  121.   selector:
  122.     matchLabels:
  123.       app: flannel
  124.       k8s-app: flannel
  125.   template:
  126.     metadata:
  127.       labels:
  128.         app: flannel
  129.         k8s-app: flannel
  130.         tier: node
  131.     spec:
  132.       affinity:
  133.         nodeAffinity:
  134.           requiredDuringSchedulingIgnoredDuringExecution:
  135.             nodeSelectorTerms:
  136.             - matchExpressions:
  137.               - key: kubernetes.io/os
  138.                 operator: In
  139.                 values:
  140.                 - linux
  141.       containers:
  142.       - args:
  143.         - --ip-masq
  144.         - --kube-subnet-mgr
  145.         command:
  146.         - /opt/bin/flanneld
  147.         env:
  148.         - name: POD_NAME
  149.           valueFrom:
  150.             fieldRef:
  151.               fieldPath: metadata.name
  152.         - name: POD_NAMESPACE
  153.           valueFrom:
  154.             fieldRef:
  155.               fieldPath: metadata.namespace
  156.         - name: EVENT_QUEUE_DEPTH
  157.           value: "5000"
  158.         image: docker.io/flannel/flannel:v0.23.0
  159.         name: kube-flannel
  160.         resources:
  161.           requests:
  162.             cpu: 100m
  163.             memory: 50Mi
  164.         securityContext:
  165.           capabilities:
  166.             add:
  167.             - NET_ADMIN
  168.             - NET_RAW
  169.           privileged: false
  170.         volumeMounts:
  171.         - mountPath: /run/flannel
  172.           name: run
  173.         - mountPath: /etc/kube-flannel/
  174.           name: flannel-cfg
  175.         - mountPath: /run/xtables.lock
  176.           name: xtables-lock
  177.       hostNetwork: true
  178.       initContainers:
  179.       - args:
  180.         - -f
  181.         - /flannel
  182.         - /opt/cni/bin/flannel
  183.         command:
  184.         - cp
  185.         image: docker.io/flannel/flannel-cni-plugin:v1.2.0
  186.         name: install-cni-plugin
  187.         volumeMounts:
  188.         - mountPath: /opt/cni/bin
  189.           name: cni-plugin
  190.       - args:
  191.         - -f
  192.         - /etc/kube-flannel/cni-conf.json
  193.         - /etc/cni/net.d/10-flannel.conflist
  194.         command:
  195.         - cp
  196.         image: docker.io/flannel/flannel:v0.23.0
  197.         name: install-cni
  198.         volumeMounts:
  199.         - mountPath: /etc/cni/net.d
  200.           name: cni
  201.         - mountPath: /etc/kube-flannel/
  202.           name: flannel-cfg
  203.       priorityClassName: system-node-critical
  204.       serviceAccountName: flannel
  205.       tolerations:
  206.       - effect: NoSchedule
  207.         operator: Exists
  208.       volumes:
  209.       - hostPath:
  210.           path: /run/flannel
  211.         name: run
  212.       - hostPath:
  213.           path: /opt/cni/bin
  214.         name: cni-plugin
  215.       - hostPath:
  216.           path: /etc/cni/net.d
  217.         name: cni
  218.       - configMap:
  219.           name: kube-flannel-cfg
  220.         name: flannel-cfg
  221.       - hostPath:
  222.           path: /run/xtables.lock
  223.           type: FileOrCreate
  224.         name: xtables-lock
  225.  
  226.  
  227. #应用flannel网络配置
  228. kubectl apply -f kube-flannel.yml

四、从节点加入集群

1、第一次加入的

  1. #打开其他节点虚拟机
  2. kubeadm join 192.168.48.210:6443 --token abcdef.0123456789abcdef \
  3.     --discovery-token-ca-cert-hash sha256:121e29b7f40844aca55b1b57d3115910d62c48906fa9e56c98e9f204027f60b5
  4. ​
  5. ​
  6. #参考文档
  7. https://blog.csdn.net/qq_45654671/article/details/128238921
 

2、后面加入的（加入token失效时操作步骤）
 

  1. #在master上重新生成token（对于过了1小时再加入集群的新节点都要执行以下步骤生成新的token）
  2. kubeadm token generate   #生成toke
  3.  
  4. #会打印出新生成的token
  5. cn4y74.ngzahx3ul01og1et  
  6. kubeadm token create cn4y74.ngzahx3ul01og1et --print-join-command --ttl=0   
  7. #利用上面的token输出添加命令
  8.  
  9. #会打印出新的join命令
  10. kubeadm join 192.168.48.210:6443 --token cn4y74.ngzahx3ul01og1et --discovery-token-ca-cert-hash sha256:121e29b7f40844aca55b1b57d3115910d62c48906fa9e56c98e9f204027f60b5
 

​五、检查集群状态
 

  1. root@kmaster:~# kubectl get nodes
  2. NAME      STATUS   ROLES           AGE     VERSION
  3. kmaster   Ready    control-plane   5d17h   v1.28.0
  4. knode1    Ready    <none>          5d17h   v1.28.0
  5. knode2    Ready    <none>          5d17h   v1.28.0
  6. knode3    Ready    <none>          2m40s   v1.28.0
  7. knode4    Ready    <none>          2m30s   v1.28.0
  8.  
 


 ​六、设置命令补全
 

        一般主节点设置即可。
 

  1. # 设置补充命令
  2. apt install bash-completion -y
  3. echo "source <(kubectl completion bash)" >> ~/.bashrc
  4.  
  5.  
  6. source .bashrc
 

​七、设置dashboard
 

1、选择dashboard版本
 

注意：这里大家可以参考github的发布版本，本次实验用的是dashboard2.7.0
 

GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters
 

2、master主节点安装
 

  1. mkdir -p /root/app/dashboard
  2. cd /root/app/dashboard
  3.  
  4. #github可以正常访问的情况可以直接执行下面步骤(如果网略异常请跳过此步骤)
  5. kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
  6.  
  7.  
  8. #github访问异常可以直接本地创建recommended.yaml文件，文件内容如下
  9. vim recommended.yaml
  10. # Copyright 2017 The Kubernetes Authors.
  11. #
  12. # Licensed under the Apache License, Version 2.0 (the "License");
  13. # you may not use this file except in compliance with the License.
  14. # You may obtain a copy of the License at
  15. #
  16. #     http://www.apache.org/licenses/LICENSE-2.0
  17. #
  18. # Unless required by applicable law or agreed to in writing, software
  19. # distributed under the License is distributed on an "AS IS" BASIS,
  20. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  21. # See the License for the specific language governing permissions and
  22. # limitations under the License.
  23.  
  24. apiVersion: v1
  25. kind: Namespace
  26. metadata:
  27.   name: kubernetes-dashboard
  28.  
  29. ---
  30.  
  31. apiVersion: v1
  32. kind: ServiceAccount
  33. metadata:
  34.   labels:
  35.     k8s-app: kubernetes-dashboard
  36.   name: kubernetes-dashboard
  37.   namespace: kubernetes-dashboard
  38.  
  39. ---
  40.  
  41. kind: Service
  42. apiVersion: v1
  43. metadata:
  44.   labels:
  45.     k8s-app: kubernetes-dashboard
  46.   name: kubernetes-dashboard
  47.   namespace: kubernetes-dashboard
  48. spec:
  49.   ports:
  50.     - port: 443
  51.       targetPort: 8443
  52.   selector:
  53.     k8s-app: kubernetes-dashboard
  54.  
  55. ---
  56.  
  57. apiVersion: v1
  58. kind: Secret
  59. metadata:
  60.   labels:
  61.     k8s-app: kubernetes-dashboard
  62.   name: kubernetes-dashboard-certs
  63.   namespace: kubernetes-dashboard
  64. type: Opaque
  65.  
  66. ---
  67.  
  68. apiVersion: v1
  69. kind: Secret
  70. metadata:
  71.   labels:
  72.     k8s-app: kubernetes-dashboard
  73.   name: kubernetes-dashboard-csrf
  74.   namespace: kubernetes-dashboard
  75. type: Opaque
  76. data:
  77.   csrf: ""
  78.  
  79. ---
  80.  
  81. apiVersion: v1
  82. kind: Secret
  83. metadata:
  84.   labels:
  85.     k8s-app: kubernetes-dashboard
  86.   name: kubernetes-dashboard-key-holder
  87.   namespace: kubernetes-dashboard
  88. type: Opaque
  89.  
  90. ---
  91.  
  92. kind: ConfigMap
  93. apiVersion: v1
  94. metadata:
  95.   labels:
  96.     k8s-app: kubernetes-dashboard
  97.   name: kubernetes-dashboard-settings
  98.   namespace: kubernetes-dashboard
  99.  
  100. ---
  101.  
  102. kind: Role
  103. apiVersion: rbac.authorization.k8s.io/v1
  104. metadata:
  105.   labels:
  106.     k8s-app: kubernetes-dashboard
  107.   name: kubernetes-dashboard
  108.   namespace: kubernetes-dashboard
  109. rules:
  110.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  111.   - apiGroups: [""]
  112.     resources: ["secrets"]
  113.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
  114.     verbs: ["get", "update", "delete"]
  115.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  116.   - apiGroups: [""]
  117.     resources: ["configmaps"]
  118.     resourceNames: ["kubernetes-dashboard-settings"]
  119.     verbs: ["get", "update"]
  120.     # Allow Dashboard to get metrics.
  121.   - apiGroups: [""]
  122.     resources: ["services"]
  123.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
  124.     verbs: ["proxy"]
  125.   - apiGroups: [""]
  126.     resources: ["services/proxy"]
  127.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
  128.     verbs: ["get"]
  129.  
  130. ---
  131.  
  132. kind: ClusterRole
  133. apiVersion: rbac.authorization.k8s.io/v1
  134. metadata:
  135.   labels:
  136.     k8s-app: kubernetes-dashboard
  137.   name: kubernetes-dashboard
  138. rules:
  139.   # Allow Metrics Scraper to get metrics from the Metrics server
  140.   - apiGroups: ["metrics.k8s.io"]
  141.     resources: ["pods", "nodes"]
  142.     verbs: ["get", "list", "watch"]
  143.  
  144. ---
  145.  
  146. apiVersion: rbac.authorization.k8s.io/v1
  147. kind: RoleBinding
  148. metadata:
  149.   labels:
  150.     k8s-app: kubernetes-dashboard
  151.   name: kubernetes-dashboard
  152.   namespace: kubernetes-dashboard
  153. roleRef:
  154.   apiGroup: rbac.authorization.k8s.io
  155.   kind: Role
  156.   name: kubernetes-dashboard
  157. subjects:
  158.   - kind: ServiceAccount
  159.     name: kubernetes-dashboard
  160.     namespace: kubernetes-dashboard
  161.  
  162. ---
  163.  
  164. apiVersion: rbac.authorization.k8s.io/v1
  165. kind: ClusterRoleBinding
  166. metadata:
  167.   name: kubernetes-dashboard
  168. roleRef:
  169.   apiGroup: rbac.authorization.k8s.io
  170.   kind: ClusterRole
  171.   name: kubernetes-dashboard
  172. subjects:
  173.   - kind: ServiceAccount
  174.     name: kubernetes-dashboard
  175.     namespace: kubernetes-dashboard
  176.  
  177. ---
  178.  
  179. kind: Deployment
  180. apiVersion: apps/v1
  181. metadata:
  182.   labels:
  183.     k8s-app: kubernetes-dashboard
  184.   name: kubernetes-dashboard
  185.   namespace: kubernetes-dashboard
  186. spec:
  187.   replicas: 1
  188.   revisionHistoryLimit: 10
  189.   selector:
  190.     matchLabels:
  191.       k8s-app: kubernetes-dashboard
  192.   template:
  193.     metadata:
  194.       labels:
  195.         k8s-app: kubernetes-dashboard
  196.     spec:
  197.       securityContext:
  198.         seccompProfile:
  199.           type: RuntimeDefault
  200.       containers:
  201.         - name: kubernetes-dashboard
  202.           image: kubernetesui/dashboard:v2.7.0
  203.           imagePullPolicy: Always
  204.           ports:
  205.             - containerPort: 8443
  206.               protocol: TCP
  207.           args:
  208.             - --auto-generate-certificates
  209.             - --namespace=kubernetes-dashboard
  210.             # Uncomment the following line to manually specify Kubernetes API server Host
  211.             # If not specified, Dashboard will attempt to auto discover the API server and connect
  212.             # to it. Uncomment only if the default does not work.
  213.             # - --apiserver-host=http://my-address:port
  214.           volumeMounts:
  215.             - name: kubernetes-dashboard-certs
  216.               mountPath: /certs
  217.               # Create on-disk volume to store exec logs
  218.             - mountPath: /tmp
  219.               name: tmp-volume
  220.           livenessProbe:
  221.             httpGet:
  222.               scheme: HTTPS
  223.               path: /
  224.               port: 8443
  225.             initialDelaySeconds: 30
  226.             timeoutSeconds: 30
  227.           securityContext:
  228.             allowPrivilegeEscalation: false
  229.             readOnlyRootFilesystem: true
  230.             runAsUser: 1001
  231.             runAsGroup: 2001
  232.       volumes:
  233.         - name: kubernetes-dashboard-certs
  234.           secret:
  235.             secretName: kubernetes-dashboard-certs
  236.         - name: tmp-volume
  237.           emptyDir: {}
  238.       serviceAccountName: kubernetes-dashboard
  239.       nodeSelector:
  240.         "kubernetes.io/os": linux
  241.       # Comment the following tolerations if Dashboard must not be deployed on master
  242.       tolerations:
  243.         - key: node-role.kubernetes.io/master
  244.           effect: NoSchedule
  245.  
  246. ---
  247.  
  248. kind: Service
  249. apiVersion: v1
  250. metadata:
  251.   labels:
  252.     k8s-app: dashboard-metrics-scraper
  253.   name: dashboard-metrics-scraper
  254.   namespace: kubernetes-dashboard
  255. spec:
  256.   ports:
  257.     - port: 8000
  258.       targetPort: 8000
  259.   selector:
  260.     k8s-app: dashboard-metrics-scraper
  261.  
  262. ---
  263.  
  264. kind: Deployment
  265. apiVersion: apps/v1
  266. metadata:
  267.   labels:
  268.     k8s-app: dashboard-metrics-scraper
  269.   name: dashboard-metrics-scraper
  270.   namespace: kubernetes-dashboard
  271. spec:
  272.   replicas: 1
  273.   revisionHistoryLimit: 10
  274.   selector:
  275.     matchLabels:
  276.       k8s-app: dashboard-metrics-scraper
  277.   template:
  278.     metadata:
  279.       labels:
  280.         k8s-app: dashboard-metrics-scraper
  281.     spec:
  282.       securityContext:
  283.         seccompProfile:
  284.           type: RuntimeDefault
  285.       containers:
  286.         - name: dashboard-metrics-scraper
  287.           image: kubernetesui/metrics-scraper:v1.0.8
  288.           ports:
  289.             - containerPort: 8000
  290.               protocol: TCP
  291.           livenessProbe:
  292.             httpGet:
  293.               scheme: HTTP
  294.               path: /
  295.               port: 8000
  296.             initialDelaySeconds: 30
  297.             timeoutSeconds: 30
  298.           volumeMounts:
  299.           - mountPath: /tmp
  300.             name: tmp-volume
  301.           securityContext:
  302.             allowPrivilegeEscalation: false
  303.             readOnlyRootFilesystem: true
  304.             runAsUser: 1001
  305.             runAsGroup: 2001
  306.       serviceAccountName: kubernetes-dashboard
  307.       nodeSelector:
  308.         "kubernetes.io/os": linux
  309.       # Comment the following tolerations if Dashboard must not be deployed on master
  310.       tolerations:
  311.         - key: node-role.kubernetes.io/master
  312.           effect: NoSchedule
  313.       volumes:
  314.         - name: tmp-volume
  315.           emptyDir: {}
  316.  
  317.  
  318. #应用recommended.yaml文件
  319. kubectl apply -f recommended.yaml
 

  1. #应用结果输出如下
  2. root@kmaster:~/app/dashboard# kubectl apply -f recommended.yaml 
  3. namespace/kubernetes-dashboard created
  4. serviceaccount/kubernetes-dashboard created
  5. service/kubernetes-dashboard created
  6. secret/kubernetes-dashboard-certs created
  7. secret/kubernetes-dashboard-csrf created
  8. secret/kubernetes-dashboard-key-holder created
  9. configmap/kubernetes-dashboard-settings created
  10. role.rbac.authorization.k8s.io/kubernetes-dashboard created
  11. clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
  12. rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
  13. clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
  14. deployment.apps/kubernetes-dashboard created
  15. service/dashboard-metrics-scraper created
  16. deployment.apps/dashboard-metrics-scraper created
  17.  
  18.  
  19. #查看安装情况
  20. root@kmaster:~/app/dashboard# kubectl get pods --all-namespaces -owide | grep dashboard
  21. kubernetes-dashboard   dashboard-metrics-scraper-5657497c4c-cqp7b   1/1     Running   0               6m45s   10.244.3.2       knode3    <none>           <none>
  22. kubernetes-dashboard   kubernetes-dashboard-78f87ddfc-l8k9g         1/1     Running   0               6m45s   10.244.1.6       knode1    <none>           <none>
  23.  
  24.  
  25. #查看svc情况
  26. root@kmaster:~/app/dashboard# kubectl get svc --all-namespaces -owide
  27. NAMESPACE              NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE     SELECTOR
  28. default                kubernetes                  ClusterIP   10.96.0.1       <none>        443/TCP                  8d      <none>
  29. kube-system            kube-dns                    ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP,9153/TCP   8d      k8s-app=kube-dns
  30. kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.103.119.96   <none>        8000/TCP                 8m33s   k8s-app=dashboard-metrics-scraper
  31. kubernetes-dashboard   kubernetes-dashboard        ClusterIP   10.96.109.150   <none>        443/TCP                  8m33s   k8s-app=kubernetes-dashboard
 

3、设置集群外主机可访问
 

注意：这里需要删除默认的service，将clusterip设置nodeport
 

  1. #删除默认创建的service
  2. kubectl delete service kubernetes-dashboard --namespace=kubernetes-dashboard
  3.  
  4.  
  5. #创建自定义的service文件
  6. vim dashboard-svc.yaml
  7. kind: Service
  8. apiVersion: v1
  9. metadata:
  10.   labels:
  11.     k8s-app: kubernetes-dashboard
  12.   name: kubernetes-dashboard
  13.   namespace: kubernetes-dashboard
  14. spec:
  15.   type: NodePort
  16.   ports:
  17.     - port: 443
  18.       targetPort: 8443
  19.   selector:
  20.     k8s-app: kubernetes-dashboard
  21.  
  22. #具体过程如下
  23. root@kmaster:~/app/dashboard# kubectl get svc --all-namespaces -owide
  24. NAMESPACE              NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE     SELECTOR
  25. default                kubernetes                  ClusterIP   10.96.0.1       <none>        443/TCP                  8d      <none>
  26. kube-system            kube-dns                    ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP,9153/TCP   8d      k8s-app=kube-dns
  27. kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.103.119.96   <none>        8000/TCP                 8m33s   k8s-app=dashboard-metrics-scraper
  28. kubernetes-dashboard   kubernetes-dashboard        ClusterIP   10.96.109.150   <none>        443/TCP                  8m33s   k8s-app=kubernetes-dashboard
  29. root@kmaster:~/app/dashboard# kubectl delete service kubernetes-dashboard --namespace=kubernetes-dashboard
  30. service "kubernetes-dashboard" deleted
  31. root@kmaster:~/app/dashboard# vim dashboard_svc.yaml
  32. root@kmaster:~/app/dashboard# kubectl get svc --all-namespaces -owide
  33. NAMESPACE              NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE   SELECTOR
  34. default                kubernetes                  ClusterIP   10.96.0.1       <none>        443/TCP                  8d    <none>
  35. kube-system            kube-dns                    ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP,9153/TCP   8d    k8s-app=kube-dns
  36. kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.103.119.96   <none>        8000/TCP                 28m   k8s-app=dashboard-metrics-scraper
  37. root@kmaster:~/app/dashboard# kubectl apply -f dashboard_svc.yaml 
  38. service/kubernetes-dashboard created
  39. root@kmaster:~/app/dashboard# kubectl get svc --all-namespaces -owide
  40. NAMESPACE              NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE   SELECTOR
  41. default                kubernetes                  ClusterIP   10.96.0.1       <none>        443/TCP                  8d    <none>
  42. kube-system            kube-dns                    ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP,9153/TCP   8d    k8s-app=kube-dns
  43. kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.103.119.96   <none>        8000/TCP                 29m   k8s-app=dashboard-metrics-scraper
  44. kubernetes-dashboard   kubernetes-dashboard        NodePort    10.103.5.118    <none>        443:31184/TCP            25s   k8s-app=kubernetes-dashboard
 

4、创建dashboard管理员角色
 

  1. #设置管理员用户文件
  2. vim admin-user.yaml 
  3. apiVersion: v1
  4. kind: ServiceAccount
  5. metadata:
  6.   name: admin-user
  7.   namespace: kubernetes-dashboard
  8.   
  9. #应用此文件
  10. kubectl apply -f admin-user.yaml
  11.  
  12.  
  13. #设置管理员角色连接  
  14. vim admin-user-role-binding.yaml
  15. apiVersion: rbac.authorization.k8s.io/v1
  16. kind: ClusterRoleBinding
  17. metadata:
  18.   name: admin-user
  19. roleRef:
  20.   apiGroup: rbac.authorization.k8s.io
  21.   kind: ClusterRole
  22.   name: cluster-admin
  23. subjects:
  24. - kind: ServiceAccount
  25.   name: admin-user
  26.   namespace: kubernetes-dashboard
  27.  
  28. #应用此文件
  29. kubectl apply -f admin-user-role-binding.yaml
  30.  
  31.  
  32. #查看节点以及端口（NodePort）
  33. kubectl get svc --all-namespaces -owide
  34. NAMESPACE              NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE   SELECTOR
  35. default                kubernetes                  ClusterIP   10.96.0.1       <none>        443/TCP                  21d   <none>
  36. kube-system            kube-dns                    ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP,9153/TCP   21d   k8s-app=kube-dns
  37. kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.111.53.171   <none>        8000/TCP                 22m   k8s-app=dashboard-metrics-scraper
  38. kubernetes-dashboard   kubernetes-dashboard        NodePort    10.106.152.11   <none>        443:32078/TCP            10m   k8s-app=kubernetes-dashboard
  39.  
  40.  
  41. ##关键步骤-创建登录token的步骤，token就是输出内容
  42. kubectl -n kubernetes-dashboard create token admin-user
  43.  
  44.  
  45. ##访问 https://节点ip:port
 

 

5、移除admin-user（安全的前提，下次要用界面再创建）
 

  1. kubectl -n kubernetes-dashboard delete serviceaccount admin-user
  2. kubectl -n kubernetes-dashboard delete clusterrolebinding admin-user
 


                

        
声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/盐析白兔/article/detail/601250
推荐阅读
相关标签
Copyright ©  2003-2013 www.wpsshop.cn  版权所有，并保留所有权利。

  
闽ICP备14008679号