[ec2-user@k8s ~]$ sudo su -
[root@k8s ~]# kubeadm init
[init] Using Kubernetes version: v1.23.5
[preflight] Running pre-flight checks
[WARNING FileExisting-tc]: tc not found in system path
[WARNING Hostname]: hostname "k8s" could not be reached
[WARNING Hostname]: hostname "k8s": lookup k8s on 192.168.191.2:53: no such host
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [k8s kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.191.131]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [k8s localhost] and IPs [192.168.191.131 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [k8s localhost] and IPs [192.168.191.131 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[kubelet-check] Initial timeout of 40s passed.
[apiclient] All control plane components are healthy after 87.001525 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config-1.23" in namespace kube-system with the configuration for the kubelets in the cluster
NOTE: The "kubelet-config-1.23" naming of the kubelet ConfigMap is deprecated. Once the UnversionedKubeletConfigMap feature gate graduates to Beta the default name will become just "kubelet-config". Kubeadm upgrade will handle this transition transparently.
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node k8s as control-plane by adding the labels: [node-role.kubernetes.io/master(deprecated) node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node k8s as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: sj6fff.bpak7gkd3hnyzcm5
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.191.131:6443 --token sj6fff.bpak7gkd3hnyzcm5 \
--discovery-token-ca-cert-hash sha256:8e15649afc0771e80cce7f1dfdbb0933f4fdbd45ea1f9e03be1f3b78449a6d3c
[root@k8s ~]#
普通用户配置kubectl：
12345678910111213141516171819202122232425262728
[ec2-user@k8s ~]$ mkdir -p $HOME/.kube
[ec2-user@k8s ~]$ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[ec2-user@k8s ~]$ sudo chown $(id -u):$(id -g) $HOME/.kube/config
[ec2-user@k8s ~]$ which kubectl
/usr/bin/kubectl
[ec2-user@k8s ~]$
[ec2-user@k8s ~]$ kubectl cluster-info
Kubernetes control plane is running at https://192.168.191.131:6443
CoreDNS is running at https://192.168.191.131:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
[ec2-user@k8s ~]$ kubectl get nodes -o wide
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
k8s NotReady control-plane,master 14m v1.23.5 192.168.191.131 <none> Amazon Linux 2 4.14.268-205.500.amzn2.x86_64 docker://20.10.7
[ec2-user@k8s ~]$ kubectl get pods --all-namespaces -o wide
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
kube-system coredns-64897985d-pcxpd 0/1 Pending 0 14m <none> <none> <none> <none>
kube-system coredns-64897985d-pfsj6 0/1 Pending 0 14m <none> <none> <none> <none>
kube-system etcd-k8s 1/1 Running 0 14m 192.168.191.131 k8s <none> <none>
kube-system kube-apiserver-k8s 1/1 Running 0 14m 192.168.191.131 k8s <none> <none>
kube-system kube-controller-manager-k8s 1/1 Running 0 14m 192.168.191.131 k8s <none> <none>
kube-system kube-proxy-qj6lw 1/1 Running 0 14m 192.168.191.131 k8s <none> <none>
kube-system kube-scheduler-k8s 1/1 Running 0 14m 192.168.191.131 k8s <none> <none>
[ec2-user@k8s ~]$
## 加入节点
[ec2-user@amazonlinux ~]$ sudo su -
[root@amazonlinux ~]# kubeadm join 192.168.191.131:6443 --token sj6fff.bpak7gkd3hnyzcm5 \
--discovery-token-ca-cert-hash sha256:8e15649afc0771e80cce7f1dfdbb0933f4fdbd45ea1f9e03be1f3b78449a6d3c
[preflight] Running pre-flight checks
[WARNING FileExisting-tc]: tc not found in system path
[WARNING Hostname]: hostname "amazonlinux.onprem" could not be reached
[WARNING Hostname]: hostname "amazonlinux.onprem": lookup amazonlinux.onprem on 192.168.191.2:53: no such host
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
[root@amazonlinux ~]#
## 改下主机名称：
[root@amazonlinux ~]# hostnamectl --static set-hostname worker1
[root@amazonlinux ~]# hostname worker1
[root@amazonlinux ~]# exit
## 改了一下名，重启后不行了，重新加入
[ec2-user@worker1 ~]$ sudo su -
Last login: Thu Mar 17 15:24:32 CST 2022 on pts/0
[root@worker1 ~]# kubeadm join 192.168.191.131:6443 --token sj6fff.bpak7gkd3hnyzcm5 \
--discovery-token-ca-cert-hash sha256:8e15649afc0771e80cce7f1dfdbb0933f4fdbd45ea1f9e03be1f3b78449a6d3c
[preflight] Running pre-flight checks
[WARNING FileExisting-tc]: tc not found in system path
[WARNING Hostname]: hostname "worker1" could not be reached
[WARNING Hostname]: hostname "worker1": lookup worker1 on 192.168.191.2:53: no such host
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
[ERROR Port-10250]: Port 10250 is in use
[ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher
## 直接重新加入不行，需要先重置再加入
[root@worker1 ~]# kubeadm reset
[reset] WARNING: Changes made to this host by 'kubeadm init' or 'kubeadm join' will be reverted.
[reset] Are you sure you want to proceed? [y/N]: y
[preflight] Running pre-flight checks
W0317 17:42:03.050519 6887 removeetcdmember.go:80] [reset] No kubeadm config, using etcd pod spec to get data directory
[reset] No etcd config found. Assuming external etcd
[reset] Please, manually reset etcd to prevent further issues
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of config directories: [/etc/kubernetes/manifests /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]
[reset] Deleting contents of stateful directories: [/var/lib/kubelet /var/lib/dockershim /var/run/kubernetes /var/lib/cni]
The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d
The reset process does not reset or clean up iptables rules or IPVS tables.
If you wish to reset iptables, you must do so manually by using the "iptables" command.
If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)
to reset your system's IPVS tables.
The reset process does not clean your kubeconfig files and you must remove them manually.
Please, check the contents of the $HOME/.kube/config file.
[root@worker1 ~]# kubeadm join 192.168.191.131:6443 --token sj6fff.bpak7gkd3hnyzcm5 \
--discovery-token-ca-cert-hash sha256:8e15649afc0771e80cce7f1dfdbb0933f4fdbd45ea1f9e03be1f3b78449a6d3c
[preflight] Running pre-flight checks
[WARNING FileExisting-tc]: tc not found in system path
[WARNING Hostname]: hostname "worker1" could not be reached
[WARNING Hostname]: hostname "worker1": lookup worker1 on 192.168.191.2:53: no such host
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
加入节点后，查看状态：
1234
[ec2-user@k8s ~]$ kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s Ready control-plane,master 166m v1.23.5
worker1 NotReady <none> 30s v1.23.5
[ec2-user@k8s ~]$ kubectl -n kubernetes-dashboard get service kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes-dashboard ClusterIP 10.101.193.109 <none> 443/TCP 6h38m
## 通过服务ip访问（Locally Port Forwarding - socks5方式代理）：
https://10.101.193.109/#/login
https://10.101.193.109/#/pod?namespace=kube-system
$ kubectl create serviceaccount cluster-admin-dashboard-sa -n kube-system
$ kubectl create clusterrolebinding cluster-admin-dashboard-sa \
--clusterrole=cluster-admin \
--serviceaccount=kube-system:cluster-admin-dashboard-sa -n kube-system
And then, you can use the token of just created cluster admin service account.
$ kubectl get secret | grep cluster-admin-dashboard-sa
cluster-admin-dashboard-sa-token-6xm8l kubernetes.io/service-account-token 3 18m
$ kubectl describe secret cluster-admin-dashboard-sa-token-6xm8l
# Parse the token
$ TOKEN=$(kubectl describe secret -n kube-system $(kubectl get secret -n kube-system | awk '/^cluster-admin-dashboard-sa-token-/{print $1}') | awk '$1=="token:"{print $2}')
$ echo $TOKEN
## -OR-
[ec2-user@k8s ~]$ kubectl describe secret cluster-admin-dashboard-sa
## -OR-
[ec2-user@k8s ~]$ kubectl describe secret -n kube-system | grep deployment -A 12
如果使用token登录，一段事件没有操作就会有超时的困扰，可以修改token-ttl配置。
1234567891011
##--> Unauthorized (401): You have been logged out because your token has expired.
## https://blog.csdn.net/otoyix/article/details/118758736
# 增加一行参数 token-ttl=68400
containers:
- name: kubernetes-dashboard
image: 'kubernetesui/dashboard:v2.0.0-rc5'
args:
- '--auto-generate-certificates'
- '--namespace=kubernetes-dashboard'
- '--token-ttl=68400' -- 增加了此行
[root@localhost ~]# yum search docker
Docker CE Stable - x86_64 240 B/s | 394 B 00:01
Errors during downloading metadata for repository 'docker-ce-stable':
- Status code: 404 for https://download.docker.com/linux/centos/20.03LTS_SP3/x86_64/stable/repodata/repomd.xml (IP: 13.224.160.26)
Error: Failed to download metadata for repo 'docker-ce-stable': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried
- cannot install the best candidate for the job
- nothing provides fuse-overlayfs >= 0.7 needed by docker-ce-rootless-extras-20.10.0-3.el8.x86_64
- nothing provides slirp4netns >= 0.4 needed by docker-ce-rootless-extras-20.10.0-3.el8.x86_64
解决：
添加centos-base库，同样替换成centos-8的版本。
123
wget -O /etc/yum.repos.d/CentOS-Base.repo https://repo.huaweicloud.com/repository/conf/CentOS-8-reg.repo
[root@localhost ~]# vi /etc/yum.repos.d/CentOS-Base.repo
:%s/$releasever/8/g
# https://docker.mirrors.ustc.edu.cn/
# https://hub-mirror.c.163.com
# https://reg-mirror.qiniu.com
[root@localhost ~]# cat /etc/docker/daemon.json
{
"registry-mirrors":["https://reg-mirror.qiniu.com/"]
}
[root@localhost ~]# service docker restart
Redirecting to /bin/systemctl restart docker.service
[root@localhost ~]# docker info
Registry Mirrors:
https://reg-mirror.qiniu.com/
运行一个hello-world看看速度：
123456789101112131415161718192021222324252627
[root@localhost ~]# docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete
Digest: sha256:975f4b14f326b05db86e16de00144f9c12257553bba9484fed41f9b6f2257800
Status: Downloaded newer image for hello-world:latest
Hello from Docker!
This message shows that your installation appears to be working correctly.
To generate this message, Docker took the following steps:
1. The Docker client contacted the Docker daemon.
2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
(amd64)
3. The Docker daemon created a new container from that image which runs the
executable that produces the output you are currently reading.
4. The Docker daemon streamed that output to the Docker client, which sent it
to your terminal.
To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash
Share images, automate workflows, and more with a free Docker ID:
https://hub.docker.com/
For more examples and ideas, visit:
https://docs.docker.com/get-started/
{% if index %}
{% comment %}
No table of contents on the index page.
{% endcomment %}
{% elsif page.toc == true %}
<script type="text/javascript">
jQuery(document).ready(function() {
// Put a TOC right before the entry content.
generateTOC('.entry-content', '目录');
});
</script>
{% endif %}