K8S 的搭建步骤

#启动etcd sudo docker run -d --net=host --name=etcd1 -v /etc/kubernetes/ssl:/etc/kubernetes/ssl -v /var/etcd/data/:/var/etcd/data/ gcr.io/google_containers/etcd:3.0.17 /usr/local/bin/etcd --data-dir=/var/etcd/data \ --name=etcd2 \ --listen-client-urls=http://0.0.0.0:2379 \ --advertise-client-urls=http://192.168.56.103:2379 \ --initial-advertise-peer-urls=http://192.168.56.103:2380 \ --listen-peer-urls=http://192.168.56.103:2380 \ --initial-cluster=etcd0=http://192.168.56.101:2380,etcd1=http://192.168.56.102:2380,etcd2=http://192.168.56.103:2380 \ --initial-cluster-state=new \ --cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ --peer-cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --peer-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ --trusted-ca-file=/etc/kubernetes/ssl/ca.pem \ --peer-trusted-ca-file=/etc/kubernetes/ssl/ca.pem \ --initial-cluster-token etcd-cluster-0 sudo docker run -d --net=host --name=etcd0 -v /etc/kubernetes/ssl:/etc/kubernetes/ssl -v /var/etcd/data/:/var/etcd/data/ gcr.io/google_containers/etcd:3.0.17 /usr/local/bin/etcd --data-dir=/var/etcd/data --name=etcd0 \ --listen-client-urls=http://0.0.0.0:2379 --advertise-client-urls=http://0.0.0.0:2379 \ --initial-cluster-state=new \ --cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ --peer-cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --peer-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ --trusted-ca-file=/etc/kubernetes/ssl/ca.pem \ --peer-trusted-ca-file=/etc/kubernetes/ssl/ca.pem #验证 http://10.101.85.159:2379/v2/members etcdctl --ca-file=/etc/kubernetes/ssl/ca.pem \ --cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ cluster-health #启动api sudo docker run -d --net=host --name=kube-apiserver -v /etc/kubernetes:/etc/kubernetes gcr.io/google_containers/hyperkube:v1.6.1 /hyperkube apiserver \ --service-cluster-ip-range=10.254.0.0/16 \ --advertise-address=192.168.56.101 --bind-address=192.168.56.101 --insecure-bind-address=192.168.56.101 \ --kubelet-port=10250 \ --port=8080 \ --allow-privileged=true \ --admission-control=ServiceAccount,NamespaceLifecycle,NamespaceExists,LimitRanger,ResourceQuota \ --authorization-mode=RBAC \ --runtime-config=rbac.authorization.k8s.io/v1beta1 \ --kubelet-https=true \ --experimental-bootstrap-token-auth \ --token-auth-file=/etc/kubernetes/token.csv \ --service-node-port-range=30000-32767 \ --tls-cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --tls-private-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ --client-ca-file=/etc/kubernetes/ssl/ca.pem \ --service-account-key-file=/etc/kubernetes/ssl/ca-key.pem \ --v=0 \ --logtostderr=true \ --allow-privileged=true \ --etcd-cafile=/etc/kubernetes/ssl/ca.pem \ --etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem \ --etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem \ --etcd-servers=http://192.168.56.101:2379,http://192.168.56.102:2379,http://192.168.56.103:2379 \ --audit-log-maxage=30 --audit-log-maxbackup=3 --audit-log-maxsize=100 --event-ttl=1h #kube-controller-manager sudo docker run -d --net=host --name=kube-controller-manager -v /etc/kubernetes:/etc/kubernetes gcr.io/google_containers/hyperkube:v1.6.1 /hyperkube controller-manager \ --master=http://192.168.56.101:8080 \ --service-cluster-ip-range=10.254.0.0/16 \ --cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem \ --cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem \ --service-account-private-key-file=/etc/kubernetes/ssl/ca-key.pem \ --root-ca-file=/etc/kubernetes/ssl/ca.pem \ --v=2 --leader-elect=true #scheduler sudo docker run -d --net=host --name=kube-scheduler -v /etc/kubernetes:/etc/kubernetes gcr.io/google_containers/hyperkube:v1.6.1 /hyperkube scheduler \ --master=http://192.168.56.101:8080 \ --v=2 --leader-elect=true FLANNEL_NETWORK=192.168.0.0/16 FLANNEL_SUBNET=192.168.40.1/24 FLANNEL_MTU=1450 FLANNEL_IPMASQ=false etcdctl --ca-file=/etc/kubernetes/ssl/ca.pem \ --cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ set /coreos.com/network/config "{\"Network\":\"10.254.0.0/16\",\"Backend\":{\"Type\":\"vxlan\"}}" etcdctl --ca-file=/etc/kubernetes/ssl/ca.pem \ --cert-file=/etc/kubernetes/ssl/kubernetes.pem \ --key-file=/etc/kubernetes/ssl/kubernetes-key.pem \ get /coreos.com/network/config #网络配置 ./flanneld --etcd-endpoints=http://192.168.56.101:2379,http://192.168.56.102:2379,http://192.168.56.103:2379 -etcd-cafile=/etc/kubernetes/ssl/ca.pem -etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem -etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem > /var/log/flanneld 2>&1 & ./mk-docker-opts.sh -i cat /run/flannel/subnet.env source /run/flannel/subnet.env ifconfig docker0 ${FLANNEL_SUBNET} SUBNET=10.254.0.0/16 defaultgw=`route -n | grep '^0.0.0.0' | awk '{print $2}'` ip route del $SUBNET via $defaultgw dev eth0 ip route add $SUBNET via 0.0.0.0 dev flannel.1 10.254.51.0/24 /etc/systemd/system/multi-user.target.wants/docker.service --disable-legacy-registry --bip=192.168.35.1/24 --ip-masq=false --mtu=1450 sudo systemctl daemon-reload sudo systemctl restart docker # kubectl create clusterrolebinding kubelet-bootstrap \ --server=http://192.168.56.101:8080 \ --clusterrole=system:node-bootstrapper \ --user=kubelet-bootstrap #启动 hyperkube kubelet --api-servers=http://192.168.56.101:8080 \ --cluster-dns=10.254.0.2 \ --cluster-domain=cluster.local. \ --experimental-bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig \ --kubeconfig=/etc/kubernetes/kubelet.kubeconfig \ --require-kubeconfig --cert-dir=/etc/kubernetes/ssl > /var/log/kubelet 2>&1 & # apiserver让其认证通过 kubectl get csr kubectl certificate approve csr-2b308 kubectl get nodes # hyperkube proxy --master=http://192.168.56.101:8080 \ --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig --cluster-cidr=10.254.0.0/16 > /var/log/proxy 2>&1 &