通过 Kubeadm 安装 K8S 与高可用

1vim /etc/hosts

1192.168.2.10    master.k8s.io      k8s-vip
2192.168.2.11    master01.k8s.io    k8s-master-01
3192.168.2.12    master02.k8s.io    k8s-master-02
4192.168.2.13    master03.k8s.io    k8s-master-03
5192.168.2.21    node01.k8s.io      k8s-node-01
6192.168.2.22    node02.k8s.io      k8s-node-02

 1# 修改 192.168.2.11 服务器
 2hostnamectl  set-hostname  k8s-master-01
 3# 修改 192.168.2.12 服务器
 4hostnamectl  set-hostname  k8s-master-02
 5# 修改 192.168.2.13 服务器
 6hostnamectl  set-hostname  k8s-master-03
 7
 8# 修改 192.168.2.21 服务器
 9hostnamectl  set-hostname  k8s-node-01
10# 修改 192.168.2.22 服务器
11hostnamectl  set-hostname  k8s-node-02

1systemctl start chronyd.service
2systemctl enable chronyd.service

1systemctl stop firewalld
2systemctl disable firewalld

1# 关闭selinux
2setenforce 0
3
4# 编辑／etc/sysconfig selinux 文件，以彻底禁用 SELinux
5sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config
6
7# 查看selinux状态
8getenforce 

1# 关闭当前已启用的所有 Swap 设备
2swapoff -a && sysctl -w vm.swappiness=0

1# 编辑 fstab 配置文件，注释掉标识为 Swap 设备的所有行
2vi /etc/fstab

1vim /etc/sysctl.d/k8s.conf

1net.ipv4.ip_forward = 1
2net.bridge.bridge-nf-call-ip6tables = 1
3net.bridge.bridge-nf-call-iptables = 1

1modprobe br_netfilter

1sysctl -p /etc/sysctl.d/k8s.conf

1ls /proc/sys/net/bridge

1echo "* soft nofile 65536" >> /etc/security/limits.conf
2echo "* hard nofile 65536" >> /etc/security/limits.conf
3echo "* soft nproc 65536"  >> /etc/security/limits.conf
4echo "* hard nproc 65536"  >> /etc/security/limits.conf
5echo "* soft  memlock  unlimited"  >> /etc/security/limits.conf
6echo "* hard memlock  unlimited"  >> /etc/security/limits.conf

1yum install -y epel-release

1yum install -y yum-utils device-mapper-persistent-data lvm2 net-tools conntrack-tools wget vim  ntpdate libseccomp libtool-ltdl

1# 安装keepalived
2yum install -y keepalived

 1cat <<EOF > /etc/keepalived/keepalived.conf
 2! Configuration File for keepalived
 3
 4# 主要是配置故障发生时的通知对象以及机器标识。
 5global_defs {
 6   # 标识本节点的字条串，通常为 hostname，但不一定非得是 hostname。故障发生时，邮件通知会用到。
 7   router_id LVS_k8s
 8}
 9
10# 用来做健康检查的，当时检查失败时会将 vrrp_instance 的 priority 减少相应的值。
11vrrp_script check_haproxy {
12    script "killall -0 haproxy"   #根据进程名称检测进程是否存活
13    interval 3
14    weight -2
15    fall 10
16    rise 2
17}
18
19# rp_instance用来定义对外提供服务的 VIP 区域及其相关属性。
20vrrp_instance VI_1 {
21    state MASTER   #当前节点为MASTER，其他两个节点设置为BACKUP
22    interface ens33 #改为自己的网卡
23    virtual_router_id 51
24    priority 250
25    advert_int 1
26    authentication {
27        auth_type PASS
28        auth_pass 35f18af7190d51c9f7f78f37300a0cbd
29    }
30    virtual_ipaddress {
31        192.168.2.10   #虚拟ip，即VIP
32    }
33    track_script {
34        check_haproxy
35    }
36
37}
38EOF

1# 设置开机启动
2systemctl enable keepalived
3# 启动keepalived
4systemctl start keepalived
5# 查看启动状态
6systemctl status keepalived

1ip address show ens33

1yum install -y haproxy

 1cat > /etc/haproxy/haproxy.cfg << EOF
 2#---------------------------------------------------------------------
 3# Global settings
 4#---------------------------------------------------------------------
 5global
 6    # to have these messages end up in /var/log/haproxy.log you will
 7    # need to:
 8    # 1) configure syslog to accept network log events.  This is done
 9    #    by adding the '-r' option to the SYSLOGD_OPTIONS in
10    #    /etc/sysconfig/syslog
11    # 2) configure local2 events to go to the /var/log/haproxy.log
12    #   file. A line like the following can be added to
13    #   /etc/sysconfig/syslog
14    #
15    #    local2.*                       /var/log/haproxy.log
16    #
17    log         127.0.0.1 local2
18    
19    chroot      /var/lib/haproxy
20    pidfile     /var/run/haproxy.pid
21    maxconn     4000
22    user        haproxy
23    group       haproxy
24    daemon 
25       
26    # turn on stats unix socket
27    stats socket /var/lib/haproxy/stats
28#---------------------------------------------------------------------
29# common defaults that all the 'listen' and 'backend' sections will
30# use if not designated in their block
31#---------------------------------------------------------------------  
32defaults
33    mode                    http
34    log                     global
35    option                  httplog
36    option                  dontlognull
37    option http-server-close
38    option forwardfor       except 127.0.0.0/8
39    option                  redispatch
40    retries                 3
41    timeout http-request    10s
42    timeout queue           1m
43    timeout connect         10s
44    timeout client          1m
45    timeout server          1m
46    timeout http-keep-alive 10s
47    timeout check           10s
48    maxconn                 3000
49#---------------------------------------------------------------------
50# kubernetes apiserver frontend which proxys to the backends
51#--------------------------------------------------------------------- 
52frontend kubernetes-apiserver
53    mode                 tcp
54    bind                 *:16443
55    option               tcplog
56    default_backend      kubernetes-apiserver    
57#---------------------------------------------------------------------
58# round robin balancing between the various backends
59#---------------------------------------------------------------------
60backend kubernetes-apiserver
61    mode        tcp
62    balance     roundrobin
63    server      master01.k8s.io   192.168.2.11:6443 check
64    server      master02.k8s.io   192.168.2.12:6443 check
65    server      master03.k8s.io   192.168.2.13:6443 check
66#---------------------------------------------------------------------
67# collection haproxy statistics message
68#---------------------------------------------------------------------
69listen stats
70    bind                 *:1080
71    stats auth           admin:awesomePassword
72    stats refresh        5s
73    stats realm          HAProxy\ Statistics
74    stats uri            /admin?stats
75EOF

1# 设置开机启动
2systemctl enable haproxy
3# 开启haproxy
4systemctl start haproxy
5# 查看启动状态
6systemctl status haproxy

1ss -lnt | grep -E "16443|1080"

 1sudo yum remove docker \
 2                  docker-client \
 3                  docker-client-latest \
 4                  docker-common \
 5                  docker-latest \
 6                  docker-latest-logrotate \
 7                  docker-logrotate \
 8                  docker-selinux \
 9                  docker-engine-selinux \
10                  docker-ce-cli \
11                  docker-engine

1rpm -qa|grep docker

1yum remove docker-ce-cli

1sudo yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

1yum list docker-ce --showduplicates | sort -r

1sudo yum install docker-ce-18.06.1.ce-3.el7 -y

1# 修改docker配置
2vi /lib/systemd/system/docker.service
3
4#找到 ExecStart 这行，王后面加上存储目录，例如这里是 --graph /apps/docker
5ExecStart=/usr/bin/docker --graph /apps/docker

1systemctl enable docker
2systemctl start docker

1iptables -nvL

1Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
2 pkts bytes target     prot opt in     out     source               destination         
3    0     0 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
4    0     0 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
5    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
6    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
7    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
8    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0            

1cat <<EOF > /etc/yum.repos.d/kubernetes.repo
2[kubernetes]
3name=Kubernetes
4baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
5enabled=1
6gpgcheck=0
7repo_gpgcheck=0
8gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
9EOF

1yum list kubectl --showduplicates | sort -r 

1yum install -y kubectl-1.13.4-0

1yum list kubelet --showduplicates | sort -r 

1yum install -y kubelet-1.13.4-0

1systemctl enable kubelet 
2systemctl start kubelet

1systemctl status kubelet

1yum list kubeadm --showduplicates | sort -r 

1yum install -y kubeadm-1.13.4-0

1reboot

1ip address show ens33

1 ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
2    link/ether 00:0c:29:7e:65:b3 brd ff:ff:ff:ff:ff:ff
3    inet 192.168.2.11/24 brd 192.168.2.255 scope global noprefixroute ens33
4       valid_lft forever preferred_lft forever
5    inet 192.168.2.10/32 scope global ens33
6       valid_lft forever preferred_lft forever

 1cat > kubeadm-config.yaml << EOF
 2apiServer:
 3  certSANs:
 4    - k8s-master-01
 5    - k8s-master-02
 6    - k8s-master-03
 7    - master.k8s.io
 8    - 192.168.2.10
 9    - 192.168.2.11
10    - 192.168.2.12
11    - 192.168.2.13
12    - 127.0.0.1
13  extraArgs:
14    authorization-mode: Node,RBAC
15  timeoutForControlPlane: 4m0s
16apiVersion: kubeadm.k8s.io/v1beta1
17certificatesDir: /etc/kubernetes/pki
18clusterName: kubernetes
19controlPlaneEndpoint: "master.k8s.io:16443"
20controllerManager: {}
21dns: 
22  type: CoreDNS
23etcd:
24  local:    
25    dataDir: /var/lib/etcd
26imageRepository: registry.aliyuncs.com/google_containers
27kind: ClusterConfiguration
28kubernetesVersion: v1.13.4
29networking: 
30  dnsDomain: cluster.local  
31  podSubnet: 10.20.0.0/16
32  serviceSubnet: 10.10.0.0/16
33scheduler: {}
34EOF

1kubeadm init --config kubeadm-config.yaml 

 1Your Kubernetes master has initialized successfully!
 2
 3To start using your cluster, you need to run the following as a regular user:
 4
 5  mkdir -p $HOME/.kube
 6  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
 7  sudo chown $(id -u):$(id -g) $HOME/.kube/config
 8
 9You should now deploy a pod network to the cluster.
10Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
11  https://kubernetes.io/docs/concepts/cluster-administration/addons/
12
13You can now join any number of machines by running the following on each node
14as root:
15
16  kubeadm join master.k8s.io:16443 --token dm3cw1.kw4hq84ie1376hji --discovery-token-ca-cert-hash sha256:f079b624773145ba714b56e177f52143f90f75a1dcebabda6538a49e224d4009

1kubeadm join master.k8s.io:16443 --token dm3cw1.kw4hq84ie1376hji --discovery-token-ca-cert-hash sha256:f079b624773145ba714b56e177f52143f90f75a1dcebabda6538a49e224d4009

1mkdir -p $HOME/.kube
2sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
3sudo chown $(id -u):$(id -g) $HOME/.kube/config

1kubectl get cs

1NAME                 STATUS    MESSAGE              ERROR
2controller-manager   Healthy   ok                   
3scheduler            Healthy   ok                   
4etcd-0               Healthy   {"health": "true"}   

1kubectl get pods --namespace=kube-system

  1cat > kube-flannel.yaml << EOF
  2---
  3kind: ClusterRole
  4apiVersion: rbac.authorization.k8s.io/v1beta1
  5metadata:
  6  name: flannel
  7rules:
  8  - apiGroups:
  9      - ""
 10    resources:
 11      - pods
 12    verbs:
 13      - get
 14  - apiGroups:
 15      - ""
 16    resources:
 17      - nodes
 18    verbs:
 19      - list
 20      - watch
 21  - apiGroups:
 22      - ""
 23    resources:
 24      - nodes/status
 25    verbs:
 26      - patch
 27---
 28kind: ClusterRoleBinding
 29apiVersion: rbac.authorization.k8s.io/v1beta1
 30metadata:
 31  name: flannel
 32roleRef:
 33  apiGroup: rbac.authorization.k8s.io
 34  kind: ClusterRole
 35  name: flannel
 36subjects:
 37- kind: ServiceAccount
 38  name: flannel
 39  namespace: kube-system
 40---
 41apiVersion: v1
 42kind: ServiceAccount
 43metadata:
 44  name: flannel
 45  namespace: kube-system
 46---
 47kind: ConfigMap
 48apiVersion: v1
 49metadata:
 50  name: kube-flannel-cfg
 51  namespace: kube-system
 52  labels:
 53    tier: node
 54    app: flannel
 55data:
 56  cni-conf.json: |
 57    {
 58      "name": "cbr0",
 59      "plugins": [
 60        {
 61          "type": "flannel",
 62          "delegate": {
 63            "hairpinMode": true,
 64            "isDefaultGateway": true
 65          }
 66        },
 67        {
 68          "type": "portmap",
 69          "capabilities": {
 70            "portMappings": true
 71          }
 72        }
 73      ]
 74    }    
 75  net-conf.json: |
 76    {
 77      "Network": "10.20.0.0/16",
 78      "Backend": {
 79        "Type": "vxlan"
 80      }
 81    }    
 82---
 83apiVersion: extensions/v1beta1
 84kind: DaemonSet
 85metadata:
 86  name: kube-flannel-ds-amd64
 87  namespace: kube-system
 88  labels:
 89    tier: node
 90    app: flannel
 91spec:
 92  template:
 93    metadata:
 94      labels:
 95        tier: node
 96        app: flannel
 97    spec:
 98      hostNetwork: true
 99      nodeSelector:
100        beta.kubernetes.io/arch: amd64
101      tolerations:
102      - operator: Exists
103        effect: NoSchedule
104      serviceAccountName: flannel
105      initContainers:
106      - name: install-cni
107        image: registry.cn-shenzhen.aliyuncs.com/cp_m/flannel:v0.10.0-amd64
108        command:
109        - cp
110        args:
111        - -f
112        - /etc/kube-flannel/cni-conf.json
113        - /etc/cni/net.d/10-flannel.conflist
114        volumeMounts:
115        - name: cni
116          mountPath: /etc/cni/net.d
117        - name: flannel-cfg
118          mountPath: /etc/kube-flannel/
119      containers:
120      - name: kube-flannel
121        image: registry.cn-shenzhen.aliyuncs.com/cp_m/flannel:v0.10.0-amd64
122        command:
123        - /opt/bin/flanneld
124        args:
125        - --ip-masq
126        - --kube-subnet-mgr
127        resources:
128          requests:
129            cpu: "100m"
130            memory: "50Mi"
131          limits:
132            cpu: "100m"
133            memory: "50Mi"
134        securityContext:
135          privileged: true
136        env:
137        - name: POD_NAME
138          valueFrom:
139            fieldRef:
140              fieldPath: metadata.name
141        - name: POD_NAMESPACE
142          valueFrom:
143            fieldRef:
144              fieldPath: metadata.namespace
145        volumeMounts:
146        - name: run
147          mountPath: /run
148        - name: flannel-cfg
149          mountPath: /etc/kube-flannel/
150      volumes:
151        - name: run
152          hostPath:
153            path: /run
154        - name: cni
155          hostPath:
156            path: /etc/cni/net.d
157        - name: flannel-cfg
158          configMap:
159            name: kube-flannel-cfg
160EOF

1kubectl apply -f kube-flannel.yaml

1kubectl get pods --namespace=kube-system

1ssh root@master02.k8s.io mkdir -p /etc/kubernetes/pki/etcd
2scp /etc/kubernetes/admin.conf root@master02.k8s.io:/etc/kubernetes
3scp /etc/kubernetes/pki/{ca.*,sa.*,front-proxy-ca.*} root@master02.k8s.io:/etc/kubernetes/pki
4scp /etc/kubernetes/pki/etcd/ca.* root@master02.k8s.io:/etc/kubernetes/pki/etcd

1ssh root@master03.k8s.io mkdir -p /etc/kubernetes/pki/etcd
2scp /etc/kubernetes/admin.conf root@master03.k8s.io:/etc/kubernetes
3scp /etc/kubernetes/pki/{ca.*,sa.*,front-proxy-ca.*} root@master03.k8s.io:/etc/kubernetes/pki
4scp /etc/kubernetes/pki/etcd/ca.* root@master03.k8s.io:/etc/kubernetes/pki/etcd

1kubeadm join master.k8s.io:16443 --token dm3cw1.kw4hq84ie1376hji --discovery-token-ca-cert-hash sha256:f079b624773145ba714b56e177f52143f90f75a1dcebabda6538a49e224d4009 --experimental-control-plane

 1......
 2This node has joined the cluster and a new control plane instance was created:
 3
 4* Certificate signing request was sent to apiserver and approval was received.
 5* The Kubelet was informed of the new secure connection details.
 6* Master label and taint were applied to the new node.
 7* The Kubernetes control plane instances scaled up.
 8* A new etcd member was added to the local/stacked etcd cluster.
 9
10To start administering your cluster from this node, you need to run the following as a regular user:
11
12	mkdir -p $HOME/.kube
13	sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
14	sudo chown $(id -u):$(id -g) $HOME/.kube/config
15
16Run 'kubectl get nodes' to see this node join the cluster.

1mkdir -p $HOME/.kube
2sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
3sudo chown $(id -u):$(id -g) $HOME/.kube/config

1kubeadm join master.k8s.io:16443 --token dm3cw1.kw4hq84ie1376hji --discovery-token-ca-cert-hash sha256:f079b624773145ba714b56e177f52143f90f75a1dcebabda6538a49e224d4009

1kubeadm token list

1kubeadm token create

1openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'

1kubeadm join master.k8s.io:16443 --token 882ik4.9ib2kb0eftvuhb58 --discovery-token-ca-cert-hash sha256:0b1a836894d930c8558b350feeac8210c85c9d35b6d91fde202b870f3244016a 

1kubectl get nodes -o wide

1NAME            STATUS   ROLES    AGE   VERSION   INTERNAL-IP    EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION              CONTAINER-RUNTIME
2k8s-master-01   Ready    master   12m   v1.13.4   192.168.2.11   <none>        CentOS Linux 7 (Core)   3.10.0-957.1.3.el7.x86_64   docker://18.6.1
3k8s-master-02   Ready    master   10m   v1.13.4   192.168.2.12   <none>        CentOS Linux 7 (Core)   3.10.0-957.1.3.el7.x86_64   docker://18.6.1
4k8s-master-03   Ready    master   38m   v1.13.4   192.168.2.13   <none>        CentOS Linux 7 (Core)   3.10.0-957.1.3.el7.x86_64   docker://18.6.1
5k8s-node-01     Ready    <none>   68s   v1.13.4   192.168.2.21   <none>        CentOS Linux 7 (Core)   3.10.0-957.1.3.el7.x86_64   docker://18.6.1
6k8s-node-02     Ready    <none>   61s   v1.13.4   192.168.2.22   <none>        CentOS Linux 7 (Core)   3.10.0-957.1.3.el7.x86_64   docker://18.6.1

1kubectl drain <node name> --delete-local-data --force --ignore-daemonsets
2kubectl delete node <node name>

1kubeadm reset

  1# ------------------- Dashboard Secret ------------------- #
  2apiVersion: v1
  3kind: Secret
  4metadata:
  5  labels:
  6    k8s-app: kubernetes-dashboard
  7  name: kubernetes-dashboard-certs
  8  namespace: kube-system
  9type: Opaque
 10
 11---
 12# ------------------- Dashboard Service Account ------------------- #
 13
 14apiVersion: v1
 15kind: ServiceAccount
 16metadata:
 17  labels:
 18    k8s-app: kubernetes-dashboard
 19  name: kubernetes-dashboard
 20  namespace: kube-system
 21
 22---
 23# ------------------- Dashboard Role & Role Binding ------------------- #
 24
 25kind: Role
 26apiVersion: rbac.authorization.k8s.io/v1
 27metadata:
 28  name: kubernetes-dashboard-minimal
 29  namespace: kube-system
 30rules:
 31  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
 32- apiGroups: [""]
 33  resources: ["secrets"]
 34  verbs: ["create"]
 35  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
 36- apiGroups: [""]
 37  resources: ["configmaps"]
 38  verbs: ["create"]
 39  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
 40- apiGroups: [""]
 41  resources: ["secrets"]
 42  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
 43  verbs: ["get", "update", "delete"]
 44  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
 45- apiGroups: [""]
 46  resources: ["configmaps"]
 47  resourceNames: ["kubernetes-dashboard-settings"]
 48  verbs: ["get", "update"]
 49  # Allow Dashboard to get metrics from heapster.
 50- apiGroups: [""]
 51  resources: ["services"]
 52  resourceNames: ["heapster"]
 53  verbs: ["proxy"]
 54- apiGroups: [""]
 55  resources: ["services/proxy"]
 56  resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
 57  verbs: ["get"]
 58
 59---
 60
 61apiVersion: rbac.authorization.k8s.io/v1
 62kind: RoleBinding
 63metadata:
 64  name: kubernetes-dashboard-minimal
 65  namespace: kube-system
 66roleRef:
 67  apiGroup: rbac.authorization.k8s.io
 68  kind: Role
 69  name: kubernetes-dashboard-minimal
 70subjects:
 71- kind: ServiceAccount
 72  name: kubernetes-dashboard
 73  namespace: kube-system
 74
 75---
 76
 77# ------------------- Dashboard Deployment ------------------- #
 78# 1.修改了镜像仓库位置，编辑成自己的镜像仓库
 79# 2.变更了镜像拉去策略imagePullPolicy: IfNotPresent
 80kind: Deployment
 81apiVersion: apps/v1
 82metadata:
 83  labels:
 84    k8s-app: kubernetes-dashboard
 85  name: kubernetes-dashboard
 86  namespace: kube-system
 87spec:
 88  replicas: 1
 89  revisionHistoryLimit: 10
 90  selector:
 91    matchLabels:
 92      k8s-app: kubernetes-dashboard
 93  template:
 94    metadata:
 95      labels:
 96        k8s-app: kubernetes-dashboard
 97    spec:
 98      containers:
 99      - name: kubernetes-dashboard
100        image: registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
101        imagePullPolicy: IfNotPresent
102        ports:
103        - containerPort: 8443
104          protocol: TCP
105        args:
106          - --auto-generate-certificates
107          # Uncomment the following line to manually specify Kubernetes API server Host
108          # If not specified, Dashboard will attempt to auto discover the API server and connect
109          # to it. Uncomment only if the default does not work.
110          # - --apiserver-host=http://my-address:port
111        volumeMounts:
112        - name: kubernetes-dashboard-certs
113          mountPath: /certs
114          # Create on-disk volume to store exec logs
115        - mountPath: /tmp
116          name: tmp-volume
117        livenessProbe:
118          httpGet:
119            scheme: HTTPS
120            path: /
121            port: 8443
122          initialDelaySeconds: 30
123          timeoutSeconds: 30
124      volumes:
125      - name: kubernetes-dashboard-certs
126        secret:
127          secretName: kubernetes-dashboard-certs
128      - name: tmp-volume
129        emptyDir: {}
130      serviceAccountName: kubernetes-dashboard
131      # Comment the following tolerations if Dashboard must not be deployed on master
132      tolerations:
133      - key: node-role.kubernetes.io/master
134        effect: NoSchedule
135---
136# ------------------- Dashboard Service ------------------- #
137# 增加了nodePort，使得能够访问,改变默认的type类型ClusterIP，变为NodePort
138# 如果不配置的话默认只能集群内访问
139kind: Service
140apiVersion: v1
141metadata:
142  labels:
143    k8s-app: kubernetes-dashboard
144  name: kubernetes-dashboard
145  namespace: kube-system
146spec:
147  type: NodePort
148  ports:
149    - port: 443
150      targetPort: 8443
151      nodePort: 30001
152  selector:
153    k8s-app: kubernetes-dashboard

1kubectl create -f kubernetes-dashboard.yaml

 1kind: ClusterRoleBinding
 2apiVersion: rbac.authorization.k8s.io/v1beta1
 3metadata:
 4  name: admin
 5  annotations:
 6    rbac.authorization.kubernetes.io/autoupdate: "true"
 7roleRef:
 8  kind: ClusterRole
 9  name: cluster-admin
10  apiGroup: rbac.authorization.k8s.io
11subjects:
12- kind: ServiceAccount
13  name: admin
14  namespace: kube-system
15---
16apiVersion: v1
17kind: ServiceAccount
18metadata:
19  name: admin
20  namespace: kube-system
21  labels:
22    kubernetes.io/cluster-service: "true"
23    addonmanager.kubernetes.io/mode: Reconcile

1kubectl create -f dashboard-user-role.yaml

1kubectl describe secret/$(kubectl get secret -n kube-system |grep admin|awk '{print $1}') -n kube-system

 1[root@k8s-master-01 local]# kubectl describe secret/$(kubectl get secret -nkube-system |grep admin|awk '{print $1}') -nkube-system
 2Name:         admin-token-2mfdz
 3Namespace:    kube-system
 4Labels:       <none>
 5Annotations:  kubernetes.io/service-account.name: admin
 6              kubernetes.io/service-account.uid: 74efd994-38d8-11e9-8740-000c299624e4
 7
 8Type:  kubernetes.io/service-account-token
 9
10Data
11====
12ca.crt:     1025 bytes
13namespace:  11 bytes

1# 查看全部节点是否能被安排工作
2kubectl describe nodes | grep -E '(Roles|Taints)'

1# 所有node都可以调度
2kubectl taint nodes --all node-role.kubernetes.io/master-
3# 指定node可以调度
4kubectl taint nodes k8s-master-01 node-role.kubernetes.io/master-

1network is not ready: [runtime network not ready: NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized]
2Back-off restarting failed container 

 1#重置kubernetes服务，重置网络。删除网络配置，link
 2kubeadm reset
 3
 4#停止docker
 5systemctl stop docker
 6
 7#重置cni
 8rm -rf /var/lib/cni/
 9rm -rf /var/lib/kubelet/*
10rm -rf /etc/cni/
11ifconfig cni0 down
12ifconfig flannel.1 down
13ifconfig docker0 down
14ip link delete cni0
15ip link delete flannel.1
16
17#重启docker
18systemctl start docker

1kubeadm join cluster.kube.com:16443 --token gaeyou.k2650x660c8eb98c --discovery-token-ca-cert-hash sha256:daf4c2e0264422baa7076a2587f9224a5bd9c5667307927b0238743799dfb362