# 创建docker目录 $ mkdir -p /opt/kubernetes/docker && cd /opt/kubernetes/docker $ wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.09.9-3.el7.x86_64.rpm $ wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-cli-18.09.9-3.el7.x86_64.rpm $ wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/containerd.io-1.2.6-3.3.el7.x86_64.rpm # 清理老版本docker $ yum remove -y docker* container-selinux # 安装rpm包 $ yum localinstall -y *.rpm # 启动docker $ systemctl start docker # 开机启动 $ systemctl enable docker # 查看分区存储空间【可选】 $ df -h 文件系统容量已用可用 已用% 挂载点 devtmpfs2.0G02.0G0% /dev tmpfs2.0G02.0G0% /dev/shm tmpfs2.0G12M2.0G1% /run tmpfs2.0G02.0G0% /sys/fs/cgroup /dev/mapper/centos-root71G1.7G66G3% / /dev/sda1976M136M773M15% /boot /dev/mapper/centos-home20G45M19G1% /home tmpfs394M0394M0% /run/user/0 # 设置graph 修改docker的数据存储目录（默认是/var/lib/docker）【可选】 # 设置cgroup driver（默认是cgroupfs，目的是与kubelet配置统一，这里也可以不设置后面在kubelet中指定使用cgroupfs） $ mkdir /docker-data $ cat < /etc/docker/daemon.json { "graph":"/docker-data", "exec-opts": ["native.cgroupdriver=systemd"] } E0F # 重启docker $ systemctl restart docker

• kubeadm：部署集群用的命令（所有节点）
• kubelet：在集群中每台机器上都要运行的组件，负责管理pod、容器的生命周期，负责主节点和工作节点之间通信的过程（所有节点）
• kubectl：集群管理工具（可选，只要在控制集群的节点上安装即可）

# 安装网络工具，最小化安装系统后网络工具需要手动安装 $ yum -y install net-tools # 配置yum源（科学上网的同学可以把"mirrors.aliyun.com"替换为"packages.cloud.google.com"） $ cat < /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64 enabled=1 gpgcheck=0 repo_gpgcheck=0 gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg E0F# 安装工具 # 找到要安装的版本号 $ yum list kubeadm --showduplicates | sort -r# 安装指定版本（这里用的是1.17.0-0） $ yum install -y kubeadm-1.17.0-0 kubelet-1.17.0-0 kubectl-1.17.0-0 --disableexcludes=kubernetes# 设置kubelet的cgroupdriver（kubelet的cgroupdriver默认为systemd，如果上面没有设置docker的exec-opts为systemd，这里就需要将kubelet的设置为cgroupfs）【此处不需要执行，上面docker已经将cgroupdriver=systemd】 $ sed -i "s/cgroup-driver=systemd/cgroup-driver=cgroupfs/g" /etc/systemd/system/kubelet.service.d/10-kubeadm.conf# 开启自启动kubelet $ systemctl enable kubelet && systemctl start kubelet

# 安装依赖 $ yum install -y ipvsadm wget curl gcc openssl-devel libnl3-devel net-snmp-devel libnfnetlink-devel # 安装keepalived，centos7通过yum下载的版本有问题，会报一个叫【TCP socket bind failed. Rescheduling】的错误 $ wget http://www.keepalived.org/software/keepalived-1.4.5.tar.gz && tar -zxvf keepalived-1.4.5.tar.gz && cd keepalived-1.4.5 && ./configure && make && make install && cd .. && rm -f keepalived-1.4.5.tar.gz && rm -rf keepalived-1.4.5 ################ keepalived负载均衡配置 ################ # 生成keepalived配置 $ cd /etc/keepalived && cat < /etc/keepalived/keepalived.conf ! Configuration File for keepalivedglobal_defs { router_id keepalived-master }vrrp_instance vip_1 { state MASTER ! 注意这是网卡名称，使用ip a命令查看自己的局域网网卡名称 interface ens33 ! keepalived主备router_id必须一致 virtual_router_id 88 ! 优先级，keepalived主节点优先级要比备节点高 priority 100 advert_int 3 ! 配置虚拟ip地址 virtual_ipaddress { 192.168.1.200 } }virtual_server 192.168.1.200 6443 { delay_loop 6 lb_algo rr lb_kind DR persistence_timeout 0 protocol TCPreal_server 192.168.1.201 6443 { weight 1 TCP_CHECK { connect_timeout 10 nb_get_retry 3 delay_before_retry 3 connect_port 6443 } } real_server 192.168.1.202 6443 { weight 1 TCP_CHECK { connect_timeout 10 nb_get_retry 3 delay_before_retry 3 connect_port 6443 } } real_server 192.168.1.203 6443 { weight 1 TCP_CHECK { connect_timeout 10 nb_get_retry 3 delay_before_retry 3 connect_port 6443 } } } E0F# 启动keepalived $ systemctl enable keepalived && service keepalived start# 检查keepalived状态 $ service keepalived status# 查看日志 $ journalctl -f -u keepalived# 查看虚拟ip $ ip a################ real_server配置，也就是每个Master节点机器 ################ # 创建rs脚本 $ mkdir -p /opt/rs/ && cd /opt/rs && cat < /opt/rs/rs.sh #!/bin/bash # 虚拟ip vip=192.168.1.200 # 停止以前的lo:0 ifconfig lo:0 down echo "1" > /proc/sys/net/ipv4/ip_forward echo "0" > /proc/sys/net/ipv4/conf/all/arp_announce # 启动一个回环地址并绑定给vip ifconfig lo:0 \$vip broadcast \$vip netmask 255.255.255.255 up route add -host \$vip dev lo:0 echo "1" >/proc/sys/net/ipv4/conf/lo/arp_ignore echo "2" >/proc/sys/net/ipv4/conf/lo/arp_announce echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce # ens33是主网卡名 echo "1" >/proc/sys/net/ipv4/conf/ens33/arp_ignore echo "2" >/proc/sys/net/ipv4/conf/ens33/arp_announce E0F# 添加执行权限 $ chmod +x /opt/rs/rs.sh# 执行rs脚本（如果出现错误，重新执行一遍即可） $ ./rs.sh# 添加到开机启动 $ echo '/opt/rs/rs.sh'>> /etc/rc.d/rc.local # 在centos7中，/etc/rc.d/rc.local的权限被降低了，所以需要执行如下命令赋予其可执行权限 $ chmod +x /etc/rc.d/rc.local

# 安装依赖 $ yum install -y ipvsadm wget curl gcc openssl-devel libnl3-devel net-snmp-devel libnfnetlink-devel # 安装keepalived，centos7通过yum下载的版本有问题，会报一个叫【TCP socket bind failed. Rescheduling】的错误 $ wget http://www.keepalived.org/software/keepalived-1.4.5.tar.gz && tar -zxvf keepalived-1.4.5.tar.gz && cd keepalived-1.4.5 && ./configure && make && make install && cd .. && rm -f keepalived-1.4.5.tar.gz && rm -rf keepalived-1.4.5 ################ keepalived负载均衡配置 ################ # 生成keepalived配置 $ cd /etc/keepalived && cat < /etc/keepalived/keepalived.conf ! Configuration File for keepalivedglobal_defs { router_id keepalived-backup }vrrp_instance vip_1 { state BACKUP ! 注意这是网卡名称，使用ip a命令查看自己的局域网网卡名称 interface ens33 ! keepalived主备router_id必须一致 virtual_router_id 88 ! 优先级，keepalived主节点优先级要比备节点高 priority 99 advert_int 3 ! 配置虚拟ip地址 virtual_ipaddress { 192.168.1.200 } }virtual_server 192.168.1.200 6443 { delay_loop 6 lb_algo rr lb_kind DR persistence_timeout 0 protocol TCPreal_server 192.168.1.201 6443 { weight 1 TCP_CHECK { connect_timeout 10 nb_get_retry 3 delay_before_retry 3 connect_port 6443 } } real_server 192.168.1.202 6443 { weight 1 TCP_CHECK { connect_timeout 10 nb_get_retry 3 delay_before_retry 3 connect_port 6443 } } real_server 192.168.1.203 6443 { weight 1 TCP_CHECK { connect_timeout 10 nb_get_retry 3 delay_before_retry 3 connect_port 6443 } } } E0F# 启动keepalived $ systemctl enable keepalived && service keepalived start# 检查keepalived状态 $ service keepalived status# 查看日志 $ journalctl -f -u keepalived# 查看虚拟ip $ ip a

首个Master节点的安装步骤会长一些，后面的节点相对简单。

################## kubeadm配置 ################## # 生成kubeadm配置文件（kubeadm将使用配置文件来创建k8s） $ cd /opt/kubernetes/ && cat < /opt/kubernetes/kubeadm-config.yaml apiVersion: kubeadm.k8s.io/v1beta2 kind: ClusterConfiguration # k8s的版本号，必须跟安装的Kubeadm版本等保持一致，否则启动报错 kubernetesVersion: v1.17.0 # docker镜像仓库地址，k8s.gcr.io需要翻墙才可以下载镜像，这里使用镜像服务器下载http://mirror.azure.cn/help/gcr-proxy-cache.html imageRepository: gcr.azk8s.cn/google_containers # 集群名称 clusterName: kubernetes # apiServer的集群访问地址，填写vip地址即可 # controlPlaneEndpoint: "192.168.1.200:6443" networking: # pod的网段 podSubnet: 10.10.0.0/16 serviceSubnet: 10.96.0.0/12 dnsDomain: cluster.local --- apiVersion: kubeproxy.config.k8s.io/v1alpha1 kind: KubeProxyConfiguration # kube-proxy模式指定为ipvs，需要提前在节点上安装ipvs的依赖并开启相关模块 mode: ipvs E0F################## kubeadm创建节点 ################### 初始化节点 # --upload-certs将自动上传证书到其他的Master节点，省去了手动复制证书的步骤 $ kubeadm init --config=kubeadm-config.yaml--upload-certs# 上述命令执行完毕后可以看到如下输出，重点是kubeadm join命令，上面一条是master节点加入当前集群的命令，下面一条是node节点加入当前集群的命令，注意token的有效期是24h ps.如果没有记住命令也没关系，使用 kubeadm token list 命令可以看到生成的token列表；如果token失效，可以使用 kubeadm token create 命令生成新的token： Your Kubernetes control-plane has initialized successfully!To start using your cluster, you need to run the following as a regular user:mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/configYou should now deploy a pod network to the cluster. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at: https://kubernetes.io/docs/concepts/cluster-administration/addons/You can now join any number of the control-plane node running the following command on each as root:kubeadm join 192.168.1.200:6443 --token ibpbcn.lr1bfb6ctmq87nxd \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b \ --control-plane --certificate-key 1531224cc400b3cbe29fdff9f411b45452f25f229d31bf5e9d15771a0feae0c6Please note that the certificate-key gives access to cluster sensitive data, keep it secret! As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use "kubeadm init phase upload-certs --upload-certs" to reload certs afterward.Then you can join any number of worker nodes by running the following on each as root:kubeadm join 192.168.1.200:6443 --token ibpbcn.lr1bfb6ctmq87nxd \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b################## kubectl ################### 修改配置让kubectl可用 $ mkdir -p $HOME/.kube && sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config# 此时可以查看一下k8s的pods运行状态 $ kubectl get pods --all-namespaces NAMESPACENAMEREADYSTATUSRESTARTSAGE kube-systemcoredns-6955765f44-6wfmw0/1Pending064m kube-systemcoredns-6955765f44-wxdz50/1Pending064m kube-systemetcd-k8s-011/1Running064m kube-systemkube-apiserver-k8s-011/1Running064m kube-systemkube-controller-manager-k8s-011/1Running064m kube-systemkube-proxy-4t6qd1/1Running064m kube-systemkube-scheduler-k8s-011/1Running064m # 可以看到coredns的pod状态仍然是pending，这是由于没有安装网络插件的原因################## 网络插件配置 ################### 可选的网络插件：https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/#pod-network # 安装calico网络插件 $ wget -P /opt/kubernetes https://docs.projectcalico.org/v3.8/manifests/calico.yaml && cd /opt/kubernetes # 编辑calico.yaml文件，修改其中的网段改为前面指定的集群网段10.10.0.0/16，默认calico的网段是192.168.0.0/16，在vi编辑器中键入 \192.168.0.0 快速定位修改处 $ vi calico.yaml > - name: CALICO_IPV4POOL_CIDR >value: "10.10.0.0/16" # 安装网络插件 $ kubectl apply -f calico.yaml # 再次检查pods的状态【coredns与calico的初始化时间较长，需要等待一会状态才会变为Running】 $ kubectl get pods --all-namespaces kube-systemcalico-kube-controllers-5c45f5bd9f-fx2xc1/1Running0110s kube-systemcalico-node-k7t8m1/1Running0110s kube-systemcoredns-6955765f44-6wfmw1/1Running083m kube-systemcoredns-6955765f44-wxdz51/1Running083m kube-systemetcd-k8s-011/1Running084m kube-systemkube-apiserver-k8s-011/1Running084m kube-systemkube-controller-manager-k8s-011/1Running084m kube-systemkube-proxy-4t6qd1/1Running083m kube-systemkube-scheduler-k8s-011/1Running084m

################## kubeadm加入集群 ################### 在第一个Master节点创建完毕后，打印了Master节点加入集群的命令，这里只需要直接使用命令即可创建节点并加入集群 $ kubeadm join 192.168.1.200:6443 --token ibpbcn.lr1bfb6ctmq87nxd \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b \ --control-plane --certificate-key 1531224cc400b3cbe29fdff9f411b45452f25f229d31bf5e9d15771a0feae0c6# 上述命令执行完毕后可以看到如下输出 This node has joined the cluster and a new control plane instance was created:* Certificate signing request was sent to apiserver and approval was received. * The Kubelet was informed of the new secure connection details. * Control plane (master) label and taint were applied to the new node. * The Kubernetes control plane instances scaled up. * A new etcd member was added to the local/stacked etcd cluster.To start administering your cluster from this node, you need to run the following as a regular user:mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/configRun 'kubectl get nodes' to see this node join the cluster.################## kubectl ################### 修改配置让kubectl可用 $ mkdir -p $HOME/.kube && sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config# 此时可以查看一下k8s的pods运行状态 $ kubectl get pods --all-namespaces

################## kubeadm加入集群 ################### 在第一个Master节点创建完毕后，打印了Master节点加入集群的命令，这里只需要直接使用命令即可创建节点并加入集群 $ kubeadm join 192.168.1.200:6443 --token ibpbcn.lr1bfb6ctmq87nxd \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b \ --control-plane --certificate-key 1531224cc400b3cbe29fdff9f411b45452f25f229d31bf5e9d15771a0feae0c6# 上述命令执行完毕后可以看到如下输出 This node has joined the cluster and a new control plane instance was created:* Certificate signing request was sent to apiserver and approval was received. * The Kubelet was informed of the new secure connection details. * Control plane (master) label and taint were applied to the new node. * The Kubernetes control plane instances scaled up. * A new etcd member was added to the local/stacked etcd cluster.To start administering your cluster from this node, you need to run the following as a regular user:mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/configRun 'kubectl get nodes' to see this node join the cluster.################## kubectl ################### 修改配置让kubectl可用 $ mkdir -p $HOME/.kube && sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config# 此时可以查看一下k8s的pods运行状态 $ kubectl get pods --all-namespaces

################## kubeadm加入集群 ################## # 在第一个Master节点创建完毕后，打印了node节点加入集群的命令，这里只需要直接使用命令即可创建节点并加入集群 $ kubeadm join 192.168.1.200:6443 --token ibpbcn.lr1bfb6ctmq87nxd \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b################## kubectl ################## # 修改配置让kubectl可用 $ mkdir -p $HOME/.kube && sudo cp -i /etc/kubernetes/kubelet.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config# 此时可以查看一下k8s的pods运行状态 $ kubectl get pods --all-namespaces

################## kubeadm加入集群 ################## # 在第一个Master节点创建完毕后，打印了node节点加入集群的命令，这里只需要直接使用命令即可创建节点并加入集群 $ kubeadm join 192.168.1.200:6443 --token ibpbcn.lr1bfb6ctmq87nxd \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b################## kubectl ################## # 修改配置让kubectl可用 $ mkdir -p $HOME/.kube && sudo cp -i /etc/kubernetes/kubelet.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config# 此时可以查看一下k8s的pods运行状态 $ kubectl get pods --all-namespaces

# 验证service名称能否被coreDNS正确解析(10.96.0.10是默认cluster ip网段下的coredns的地址，可以通过kubectl get svc -n kube-system查看dns的地址) $ dig kubernetes.default.svc.cluster.local @10.96.0.10 # 查看已安装的组件状态 $ kubectl get pods --all-namespaces NAMESPACENAMEREADYSTATUSRESTARTSAGE kube-systemcalico-kube-controllers-5c45f5bd9f-6szxb1/1Running04m17s kube-systemcalico-node-5c9hh1/1Running03m15s kube-systemcalico-node-8ffhc1/1Running058s kube-systemcalico-node-cxndf1/1Running053s kube-systemcalico-node-glqpl1/1Running02m22s kube-systemcalico-node-q5blx1/1Running04m17s kube-systemcoredns-6955765f44-8bcz51/1Running05m14s kube-systemcoredns-6955765f44-w4p4l1/1Running05m14s kube-systemetcd-k8s-011/1Running05m26s kube-systemetcd-k8s-021/1Running03m7s kube-systemetcd-k8s-031/1Running02m21s kube-systemkube-apiserver-k8s-011/1Running05m26s kube-systemkube-apiserver-k8s-021/1Running03m15s kube-systemkube-apiserver-k8s-031/1Running186s kube-systemkube-controller-manager-k8s-011/1Running15m26s kube-systemkube-controller-manager-k8s-021/1Running03m15s kube-systemkube-controller-manager-k8s-031/1Running097s kube-systemkube-proxy-7sh6f1/1Running053s kube-systemkube-proxy-dvf9j1/1Running058s kube-systemkube-proxy-hbc5v1/1Running02m22s kube-systemkube-proxy-pqhn61/1Running05m14s kube-systemkube-proxy-rltqg1/1Running03m15s kube-systemkube-scheduler-k8s-011/1Running15m26s kube-systemkube-scheduler-k8s-021/1Running03m14s kube-systemkube-scheduler-k8s-031/1Running097s

# 下载编排文件 $ wget -P /etc/kubernetes/addons https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc1/aio/deploy/recommended.yaml && cd /etc/kubernetes/addons# 删除编排文件中不使用的服务Metric Server，删除dashboard-metrics-scraper Service与Deployment。 $ vi recommended.yaml# 部署服务，打印如下日志 $ kubectl apply -f recommended.yaml namespace/kubernetes-dashboard created serviceaccount/kubernetes-dashboard created service/kubernetes-dashboard created secret/kubernetes-dashboard-certs created secret/kubernetes-dashboard-csrf created secret/kubernetes-dashboard-key-holder created configmap/kubernetes-dashboard-settings created role.rbac.authorization.k8s.io/kubernetes-dashboard created clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created deployment.apps/kubernetes-dashboard created service/dashboard-metrics-scraper created deployment.apps/dashboard-metrics-scraper created# 查看服务运行状态 $ kubectl get namespaces $ kubectl get deployments -n kubernetes-dashboard $ kubectl get pods --namespace kubernetes-dashboard -o wide $ kubectl get services -n kubernetes-dashboard# 创建ServiceAccount，具有集群管理员权限 $ cat < dashboard-adminuser.yaml apiVersion: v1 kind: ServiceAccount metadata: name: admin-user namespace: kubernetes-dashboard---apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: admin-user roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: admin-user namespace: kubernetes-dashboard E0F# 部署服务 $ kubectl apply -f dashboard-adminuser.yaml# 获取认证Bearer Token $ kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}') | grep -E '^token' | awk '{print $2}'

# 检查集群证书状态，该命令显示了 所有证书的到期/剩余时间，包括在etc/kubernetes/pki目录下的客户端证书及由kubeadm嵌入到KUBECONFIG文件中的客户端证书（admin.conf，controller-manager.conf和scheduler.conf）。 # 注意：kubelet.conf未包含在上面的列表中，因为kubeadm将已将其配置为自动更新。kubeadm无法管理由外部CA签名的证书。 $ kubeadm alpha certs check-expiration CERTIFICATEEXPIRESRESIDUAL TIMECERTIFICATE AUTHORITYEXTERNALLY MANAGED admin.confJan 09, 2021 06:55 UTC360dno apiserverJan 09, 2021 06:55 UTC360dcano apiserver-etcd-clientJan 09, 2021 06:55 UTC360detcd-cano apiserver-kubelet-clientJan 09, 2021 06:55 UTC360dcano controller-manager.confJan 09, 2021 06:55 UTC360dno etcd-healthcheck-clientJan 09, 2021 06:55 UTC360detcd-cano etcd-peerJan 09, 2021 06:55 UTC360detcd-cano etcd-serverJan 09, 2021 06:55 UTC360detcd-cano front-proxy-clientJan 09, 2021 06:55 UTC360dfront-proxy-cano scheduler.confJan 09, 2021 06:55 UTC360dnoCERTIFICATE AUTHORITYEXPIRESRESIDUAL TIMEEXTERNALLY MANAGED caJan 07, 2030 06:55 UTC9yno etcd-caJan 07, 2030 06:55 UTC9yno front-proxy-caJan 07, 2030 06:55 UTC9yno# 重新生成证书 $ kubeadm alpha certs renew all# 重新控制平面，重启kubelet会自动重新创建核心组件 $ systemctl restart kubelet# 查看证书状态 $ kubeadm alpha certs check-expiration

# 创建token $ kubeadm token create ll3wpn.pct6tlq66lis3uhk# 查看token $ kubeadm token list TOKENTTLEXPIRESUSAGESDESCRIPTIONEXTRA GROUPS ll3wpn.pct6tlq66lis3uhk23h2020-01-17T14:42:50+08:00authentication,signingsystem:bootstrappers:kubeadm:default-node-token# 获取 CA 证书 sha256 编码 hash 值 $ openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //' b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b# 新node节点加入集群 $ kubeadm join 192.168.1.200:6443 --token ll3wpn.pct6tlq66lis3uhk \ --discovery-token-ca-cert-hash sha256:b5e5c1a000284781677336b00e7345838195ca78af21bddd9defad799243752b

# 执行以下命令即可打印加入集群的命令 $ kubeadm token create --print-join-command

# 修改ConfigMap的kube-system/kube-proxy中的config.conf中mode: "ipvs" $ kubectl edit cm kube-proxy -n kube-system ... apiVersion: v1 data: config.conf: |- apiVersion: kubeproxy.config.k8s.io/v1alpha1 bindAddress: 0.0.0.0 clientConnection: acceptContentTypes: "" burst: 0 contentType: "" kubeconfig: /var/lib/kube-proxy/kubeconfig.conf qps: 0 clusterCIDR: 10.10.0.0/16 configSyncPeriod: 0s conntrack: maxPerCore: null min: null tcpCloseWaitTimeout: null tcpEstablishedTimeout: null enableProfiling: false healthzBindAddress: "" hostnameOverride: "" iptables: masqueradeAll: false masqueradeBit: null minSyncPeriod: 0s syncPeriod: 0s ipvs: excludeCIDRs: null minSyncPeriod: 0s scheduler: "" strictARP: false syncPeriod: 0s kind: KubeProxyConfiguration metricsBindAddress: "" # 修改此处即可 mode: "ipvs" nodePortAddresses: null oomScoreAdj: null portRange: "" udpIdleTimeout: 0s winkernel: enableDSR: false networkName: "" sourceVip: "" ...# 查看已运行的kube-proxy的Pod $ kubectl get pods -n kube-system | grep kube-proxy# 删除原有的kube-proxy的Pod，控制器会自动重建 $ kubectl get pod -n kube-system | grep kube-proxy | awk '{system("kubectl delete pod "$1" -n kube-system")}'# 通过ConfigMap修改了kube-proxy的配置，后期增加的Node节点，会直接使用ipvs模式。# 查看已运行的kube-proxy的Pod $ kubectl get pods -n kube-system | grep kube-proxy# 查看kube-proxy的Pod日志，确保运行为ipvs模式。日志中打印出了'Using ipvs Proxier，说明ipvs模式已经开启。 $ kubectl logs kube-proxy-xxxxx -n kube-system# 使用ipvsadm测试，可以查看之前创建的Service已经使用LVS创建了集群。 $ ipvsadm -Ln

推荐阅读

• 

  姜薯和山药的区别 姜薯和山药有什么区别
• 

  部编版语文二年级下册教案16.雷雨！ 雷雨教案
• 

  天猫精灵怎么连接手机
• 

  糖尿病并发症|糖尿病多久就有并发症了？为啥有人用不了几年，有人好多年才有？
• 

  吉兰-巴雷综合征|女博士遭遇“鬼缠身”住进ICU，究竟是怎么回事？
• 

  二手车过户都需要什么手续和证件 二手车过户都需要什么手续
• 

  阿尔茨海默病|两种血液因子帮助阿尔兹海默症的个体化预后治疗
• 

  长帝电烤箱怎么样?长帝烤箱使用注意事项
• 

  特斯拉|库克透露10年内将离开苹果新品将改变使用者习惯
• 

  银环蛇和五步蛇谁更毒，和眼镜蛇相比呢？
• 

  创造与魔法如何制作捕捉器 创造与魔法怎样捕捉
• 

  减肥晚上喝绿豆汤会胖吗
• 

  2023徐州医保报销比例政策 2023徐州医保报销比例
• 

  祝愿前程似锦的诗句有哪些 祝福人前程似锦的诗句分享
• 

  佳能定焦拍人像哪个好 佳能定焦拍人物
• 

  支付宝一个手机号两个账号怎么办
• 

  元宇宙是什么 100秒看懂什么是“元宇宙”
• 

  价位|iPhone 11降至4K价位，同级别国产手机有一战之力？
• 

  心肺功能的正确意义是什么 1、心肺功能的作用是什么?
• 

  二甲戊灵的使用禁忌，使用方式和次数要注意

• JS中的各种宽高度定义及其应用
• 眼光要放高远
• 考研英语阅读终极解决方案——阅读理解如何巧拿高分
• 《魔法科高中的劣等生》第26卷（Invasion篇）发售
• 高天天工作室｜溧清的剧本4
• 托福听力高分备考方案
• 周老师《金鸡图》
• 《高老头》听后感
• 高大上还是路边摊
• 唐嫣可真会穿，西装搭牛仔裤都能穿出高级感，一双大长腿太抢镜