参考： https://blog.csdn.net/yu33575/article/details/135387548

二进制安装k8s： https://blog.csdn.net/qq_73990369/article/details/143217084

K8S二进制安装与部署 ：https://blog.csdn.net/fantuan_sss/article/details/139073366

k8s-(六）在kubernertes上部署运行项目： https://blog.csdn.net/qq_21187515/article/details/112320972

解决logs不能查看的问题： https://blog.51cto.com/shunzi115/2432164

ssh免密登录

#在每台服务器上生成RSA密钥对
ssh-keygen -P '' -f ~/.ssh/id_rsa#将公钥传输给要远程的服务器（在每台服务器上，将生成的公钥复制到其他两台服务器上）
ssh-copy-id -i ~/.ssh/id_rsa.pub root@k8s-node1
ssh-copy-id -i ~/.ssh/id_rsa.pub root@devdb
ssh-copy-id -i ~/.ssh/id_rsa.pub root@node

Kubernetes 部署
安装 kubeadm、kubelet 和 kubectl

kubeadm：用来初始化集群的指令。

kubelet：在集群中的每个节点上用来启动 Pod 和容器等。

kubectl：用来与集群通信的命令行工具。

kubeadm 安装

1 安装 CNI 插件（大多数 Pod 网络都需要）：

CNI_PLUGINS_VERSION="v1.3.0"
ARCH="amd64"
DEST="/opt/cni/bin"
sudo mkdir -p "$DEST"
curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/cni-plugins-linux-${ARCH}-${CNI_PLUGINS_VERSION}.tgz" | sudo tar -C "$DEST" -xzcurl -L "https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni-plugins-linux-amd64-v1.3.0.tgz" | sudo tar -C "/opt/cni/bin" -xztar -C "/opt/cni/bin" -xz -f cni-plugins-linux-amd64-v1.3.0.tgz

2 安装 crictl（kubeadm/kubelet 容器运行时接口（CRI）所需）：

DOWNLOAD_DIR="/usr/local/bin"
sudo mkdir -p "$DOWNLOAD_DIR"CRICTL_VERSION="v1.28.0"
ARCH="amd64"
curl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | sudo tar -C $DOWNLOAD_DIR -xzcurl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.28.0/crictl-v1.28.0-linux-amd64.tar.gz" | sudo tar -C /usr/local/bin -xztar -C /usr/local/bin -xz -f crictl-v1.28.0-linux-amd64.tar.gz

3 安装 kubeadm、kubelet、kubectl 并添加 kubelet 系统服务：

RELEASE="$(curl -sSL https://dl.k8s.io/release/stable.txt)"
RELEASE="v1.32.0"
ARCH="amd64"
cd $DOWNLOAD_DIR
cd /usr/local/binsudo curl -L --remote-name-all https://dl.k8s.io/release/${RELEASE}/bin/linux/${ARCH}/{kubeadm,kubelet}
sudo curl -L --remote-name-all https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/{kubeadm,kubelet}
sudo chmod +x {kubeadm,kubelet}RELEASE_VERSION="v0.16.2"
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/krel/templates/latest/kubelet/kubelet.service" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/v0.16.2/cmd/krel/templates/latest/kubelet/kubelet.service" | sed "s:/usr/bin:/usr/local/bin:g" | sudo tee /etc/systemd/system/kubelet.servicesed "s:/usr/bin:/usr/local/bin:g" kubelet.service | tee /etc/systemd/system/kubelet.servicesudo mkdir -p /etc/systemd/system/kubelet.service.d
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/krel/templates/latest/kubeadm/10-kubeadm.conf" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/v0.16.2/cmd/krel/templates/latest/kubeadm/10-kubeadm.conf" | sed "s:/usr/bin:/usr/local/bin:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.confsed "s:/usr/bin:/usr/local/bin:g" 10-kubeadm.conf | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

–
kubelet 安装

install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
install -o root -g root -m 0755 kubeadm /usr/local/bin/kubeadm
install -o root -g root -m 0755 kubelet /usr/local/bin/kubelet

–
kubectl 安装

https://kubernetes.io/zh-cn/docs/tasks/tools/install-kubectl-linux/

安装命令

sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

测试：

kubectl version --client

–

kubeadm init 用于搭建控制平面节点
kubeadm join 用于搭建工作节点并将其加入到集群中
kubeadm upgrade 用于升级 Kubernetes 集群到新版本
kubeadm config 如果你使用了 v1.7.x 或更低版本的 kubeadm 版本初始化你的集群，则使用 kubeadm upgrade 来配置你的集群
kubeadm token 用于管理 kubeadm join 使用的令牌
kubeadm reset 用于恢复通过 kubeadm init 或者 kubeadm join 命令对节点进行的任何变更
kubeadm certs 用于管理 Kubernetes 证书
kubeadm kubeconfig 用于管理 kubeconfig 文件
kubeadm version 用于打印 kubeadm 的版本信息
kubeadm alpha 用于预览一组可用于收集社区反馈的特性

二进制安装K8S:

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -O /usr/local/bin/cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -O /usr/local/bin/cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -O /usr/local/bin/cfssl-certinfochmod +x /usr/local/bin/cfssl*

master节点操作–给api-server创建的证书。 别的服务访问api-server的时候需要通过证书认证

[root@k8s-master1 ~]# mkdir -p /opt/crt/
[root@k8s-master1 ~]# cd /opt/crt/
# vim ca-config.json
{"signing": {"default": {"expiry": "87600h"},"profiles": {"kubernetes": {"expiry": "87600h","usages": ["signing","key encipherment","server auth","client auth"]}}}
}# vim ca-csr.json  定义生产签名所需要的信息参数
{"CN": "kubernetes","key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "Beijing","ST": "Beijing","O": "k8s","OU": "System"}]
}生产ca证书和私钥
[root@k8s-master1 crt]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -生成apiserver证书：
[root@k8s-master1 crt]# vim server-csr.json
# cat server-csr.json
{"CN": "kubernetes","hosts": ["10.0.0.1", //这是后⾯dns要使用的虚拟网络的网关，不用改，就用这个切忌"127.0.0.1","10.xxx.xxx.xx1", // master的IP地址。"10.xxx.100.xx2","10.xxx.100.xx3","kubernetes","kubernetes.default","kubernetes.default.svc","kubernetes.default.svc.cluster","kubernetes.default.svc.cluster.local"],"key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "BeiJing","ST": "BeiJing","O": "k8s","OU": "System"}]
}[root@k8s-master1 crt]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server[root@139devdb crt]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
invalid character '/' looking for beginning of value
Failed to parse input: unexpected end of JSON input生成kube-proxy证书：
[root@k8s-master1 crt]# vim kube-proxy-csr.json
# cat kube-proxy-csr.json
{"CN": "system:kube-proxy","hosts": [],"key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "BeiJing","ST": "BeiJing","O": "k8s","OU": "System"}]
}
[root@k8s-master1 crt]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

配置好前面生成的证书，确保能连接etcd

systemd管理apiserver[root@k8s-master1 cfg]# cd /usr/lib/systemd/system
# vim kube-apiserver.service
# cat /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes[Service]
EnvironmentFile=-/opt/k8s/cfg/kube-apiserver
ExecStart=/opt/k8s/bin/kube-apiserver $KUBE_APISERVER_OPTS
Restart=on-failure[Install]
WantedBy=multi-user.target 启动：
systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver

设置集群参数

# 设置集群参数
[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=${KUBE_APISERVER}  --kubeconfig=bootstrap.kubeconfig# 设置客户端认证参数
[root@k8s-master crt]# /opt/k8s/bin/kubectl config set-credentials kubelet-bootstrap --token=${BOOTSTRAP_TOKEN} --kubeconfig=bootstrap.kubeconfig# 设置上下文参数
[root@k8s-master crt]# /opt/k8s/bin/kubectl config set-context default  --cluster=kubernetes  --user=kubelet-bootstrap --kubeconfig=bootstrap.kubeconfig# 设置默认上下文
[root@k8s-master crt]# /opt/k8s/bin/kubectl config use-context default --kubeconfig=bootstrap.kubeconfig# 创建kube-proxy kubeconfig文件[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-cluster kubernetes  --certificate-authority=ca.pem  --embed-certs=true  --server=${KUBE_APISERVER}  --kubeconfig=kube-proxy.kubeconfig[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-credentials kube-proxy  --client-certificate=kube-proxy.pem  --client-key=kube-proxy-key.pem  --embed-certs=true  --kubeconfig=kube-proxy.kubeconfig[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-context default --cluster=kubernetes --user=kube-proxy --kubeconfig=kube-proxy.kubeconfig[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig// 1 添加kubernetes集群 
kubectl config set-cluster my-cluster \--server=https://10.xxx.100.xxx:6443 \--certificate-authority=/opt/crt/ca.pem// 2 添加用户
kubectl config set-credentials my-user \--client-certificate=kube-proxy.pem \--client-key=kube-proxy-key.pem// 3 添加上下文
kubectl config set-context my-context \--cluster=my-cluster \--user=my-user \--namespace=default// 4 切换上下文
kubectl config use-context my-contextkubectl config set-credentials system:kube-proxy \--client-certificate=/opt/crt/kube-proxy.pem \--client-key=/opt/crt/kube-proxy-key.pemkubectl config set-context system-context \--cluster=system-cluster \--user=system:kube-proxy \--namespace=system-name 命令： 
kubectl config view   // 查看配置
kubectl config get-contexts  // 上下文
kubectl config use-context system-context  //切换上下文
kubectl get pods

systemd管理kubelet组件：

# vim /usr/lib/systemd/system/kubelet.service[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service
[Service]
EnvironmentFile=/opt/k8s/cfg/kubelet
ExecStart=/opt/k8s/bin/kubelet $KUBELET_OPTS
Restart=on-failure
KillMode=process
[Install]
WantedBy=multi-user.target--
启动：
systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet

systemd管理kube-proxy组件：

[root@k8s-node1 ~]# cd /usr/lib/systemd/system
# vim  /usr/lib/systemd/system/kube-proxy.service[Unit]
Description=Kubernetes Proxy
After=network.target
[Service]
EnvironmentFile=-/opt/k8s/cfg/kube-proxy
ExecStart=/opt/k8s/bin/kube-proxy $KUBE_PROXY_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target--启动：
systemctl daemon-reload
systemctl enable kube-proxy
systemctl start kube-proxy

kubernetes部署运行项目

./kubectl get cs
pwd
./kubectl get node
./kubectl get csr
./kubectl get pods--
kubernetes部署运行项目参考： https://blog.csdn.net/qq_21187515/article/details/112320972在k8s中，我们不会单独创建一个pod资源对象，而是创建Deployment对象，通过Deployment来管理pod。apiVersion: v1   #描述文件遵循v1版本的kubernetes API 
kind: Pod        #我们在描述一个pod
metadata:          name: kubia-manual   #pod的名称
spec:containers:- image: luksa/kubia   #创建容器所用的镜像name: kubia 		#容器的名称ports:- containerPort: 8080  #应用监听的端口protocol: TCP
--apiVersion: v1
kind: Pod   // k8s资源类型
metadata: // pod元数据name: dnsutil-pod // pod的名称
spec: // pod规格containers:- image: tutum/dnsutils // 创建容器所用的镜像name: dnsutil // 容器的名称command: ["sleep", "infinity"]
--
apiVersion: v1
kind: Service
metadata:name: test-svc
spec:ports:- port: 80 // 该服务的可用端口targetPort: 8080 // 服务将连接转发到的容器端口selector: // label app=testing的pod属于该服务app: testing

创建Deployment的YAML描述文件

kubectl create deployment countgame --image=192.xxx.xxx.xxx:5000/countgame:0.91 --dry-run -o yaml  > deploy.yaml

命令：

kubectl config view   // 查看配置
kubectl config get-contexts  // 上下文
kubectl config use-context system-context  //切换上下文
kubectl config use-context my-contextkubectl get csr     // 查看申请加入集群的节点（master）
kubectl certificate approve XXXXID // master审批通过允许加入集群
kubectl get node
kubectl get cs     // 通过kubectl⼯具查看当前集群组件状态
kubectl get pods// 创建Deployment对象
kubectl apply -f deploy.yamlkubectl get namespaces // 命名空间

创建管理员账户

1 创建一个 ServiceAccount。ServiceAccount 是 Kubernetes 中用于运行 Pod 的账户。
admin-user.yaml ：apiVersion: v1
kind: ServiceAccount
metadata:name: admin-usernamespace: kube-systemkubectl apply -f admin-user.yamlapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:name: admin-role
rules:
- apiGroups: ["*"]resources: ["*"]verbs: ["*"]kubectl apply -f admin-role.yamlapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:name: admin-role-binding
subjects:
- kind: ServiceAccountname: admin-usernamespace: kube-system
roleRef:kind: ClusterRolename: admin-roleapiGroup: rbac.authorization.k8s.iokubectl apply -f admin-role-binding.yaml/opt/kubernetes/bin/kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrapkubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymouskubectl -n kube-system get secret $(kubectl -n kube-system get sa admin-user -o jsonpath="{.secrets[0].name}") -o jsonpath="{.data.token}" | base64 --decodekubectl config set-credentials admin-user --token=<TOKEN>
kubectl config set-context admin-context --cluster=<CLUSTER_NAME> --user=admin-user
kubectl config use-context admin-contextkubectl config set-credentials admin-user --token=<TOKEN>
kubectl config set-context admin-context --cluster=admin-cluster  --user=admin-user
kubectl config use-context admin-context验证权限
kubectl auth can-i create deployments --namespace=default

K8S kubelet logs报错

设置 
https://blog.51cto.com/shunzi115/24321641.error: You must be logged in to the server (the server has asked for the client to provide credentials ( pods/log nginx-7bb7cd8db5-v756s))
处理方法：
kubelet配置文件配置默认用户权限如图：
kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous2.Error from server (Forbidden): Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy) ( pods/log nginx-7bb7cd8db5-v756s)
处理方法：
anonymous用户绑定一个cluster-admin的权限
kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous