kubeadm部署k8sv1.24使用cri-docker做为CRI

这篇具有很好参考价值的文章主要介绍了kubeadm部署k8sv1.24使用cri-docker做为CRI。希望对大家有所帮助。如果存在错误或未考虑完全的地方,请大家不吝赐教,您也可以点击"举报违法"按钮提交疑问。

目的

测试使用cri-docker做为containerd和docker的中间层垫片。

规划

IP 系统 主机名
10.0.6.5 ubuntu 22.04.3 jammy master01.kktb.org
10.0.6.6 ubuntu 22.04.3 jammy master02.kktb.org
10.0.6.7 ubuntu 22.04.3 jammy master03.kktb.org

配置

步骤:

  1. 系统优化 禁用swap,设置ip_forward hosts地址配置 等
  2. 配置docker源
  3. 配置kubernetes源
  4. kubeadm初始化
  5. 取消master节点的污点

由于在局域网中配置了代理,所以不使用国内源。

配置hosts地址

[root@master02 ~]#grep master /etc/hosts
10.0.6.5 master01.kktb.org
10.0.6.6 master02.kktb.org
10.0.6.7 master03.kktb.org
# 这样get node出来的节点名是主机名
[root@master01 ~]#kubectl get node 
NAME                STATUS   ROLES           AGE   VERSION
master01.kktb.org   Ready    control-plane   35m   v1.24.3
master02.kktb.org   Ready    control-plane   28m   v1.24.3
master03.kktb.org   Ready    control-plane   22m   v1.24.3

docker

for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt-get remove $pkg; done
sudo install -m 0755 -d /etc/apt/keyrings

apt-get install -y apt-transport-https ca-certificates curl

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo   "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
"$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" |   sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
apt-cache madison docker-ce | awk '{ print $3 }'
VERSION_STRING=5:20.10.24~3-0~ubuntu-jammy
apt-get install docker-ce=$VERSION_STRING docker-ce-cli=$VERSION_STRING containerd.io docker-buildx-plugin docker-compose-plugin
docker run hello-world

查看当前的cgroup驱动是不是systemd,不是的话要更改

[root@master03 ~]#docker info |grep -i driver
 Storage Driver: overlay2
 Logging Driver: json-file
 Cgroup Driver: systemd

kubernetes源

curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.24/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

apt update

配置组件

apt install -y kubeadm=1.24.3-1.1 kubelet=1.24.3-1.1 kubectl=1.24.3-1.1

配置cri-docker中间层

curl -LO https://github.com/Mirantis/cri-dockerd/releases/download/v0.3.0/cri-dockerd_0.3.0.3-0.ubuntu-jammy_amd64.deb
dpkg -i cri-dockerd_0.3.0.3-0.ubuntu-jammy_amd64.deb
systemctl status cri-docker.service

kubeadm初始化集群

列出需要的镜像

[root@master01 ~]#kubeadm config images list
I0917 08:39:15.852977  207252 version.go:255] remote version is much newer: v1.28.2; falling back to: stable-1.24
k8s.gcr.io/kube-apiserver:v1.24.17
k8s.gcr.io/kube-controller-manager:v1.24.17
k8s.gcr.io/kube-scheduler:v1.24.17
k8s.gcr.io/kube-proxy:v1.24.17
k8s.gcr.io/pause:3.7
k8s.gcr.io/etcd:3.5.3-0
k8s.gcr.io/coredns/coredns:v1.8.6

拉取镜像

[root@master01 ~]#kubeadm config images pull --kubernetes-version=v1.24.0 --cri-socket unix:///run/cri-dockerd.sock
[config/images] Pulled k8s.gcr.io/kube-apiserver:v1.24.0
[config/images] Pulled k8s.gcr.io/kube-controller-manager:v1.24.0
[config/images] Pulled k8s.gcr.io/kube-scheduler:v1.24.0
[config/images] Pulled k8s.gcr.io/kube-proxy:v1.24.0
[config/images] Pulled k8s.gcr.io/pause:3.7
[config/images] Pulled k8s.gcr.io/etcd:3.5.3-0
[config/images] Pulled k8s.gcr.io/coredns/coredns:v1.8.6

初始化集群

[root@master01 ~]#kubeadm init --control-plane-endpoint="master01.kktb.org" --kubernetes-version=v1.24.0 --pod-network-cidr=10.244.0.0/16 --service-cidr=10.96.0.0/12 --token-ttl=0 --cri-socket unix:///run/cri-dockerd.sock --upload-certs

逐个参数解释

init 初始化集群
reset 重置集群,如果创建集群失败可以执行此命令重置集群
--control-plane-endpoint 控制平面的节点,可以是IP地址也可以是主机名,主机名要配置到hosts文件中,不然解析失败
--kubernetes-version 安装的k8s集群版本,跟配置的apt 源和拉取的镜像版本要保持一致
--pod-network-cidr 集群中的pod的网段
--service-cidr 集群中service的网段
--token-ttl 加入集群的token过期时间 0 表示永远不过期,不安全 
--cri-socket 指定集群调用的cri的socket路径

输出

[init] Using Kubernetes version: v1.24.0
# 执行安装前检查
[preflight] Running pre-flight checks
	[WARNING SystemVerification]: missing optional cgroups: blkio
# 拉取启动集群所需要的镜像 这要花费一段时间 取决于你的网络连接
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
# 也可以在安装集群前使用Kubeam config images pull提前拉取镜像
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
# 使用的证书文件夹
[certs] Using certificateDir folder "/etc/kubernetes/pki"
# 生成集群ca证书和key
[certs] Generating "ca" certificate and key
# 生成apiserver证书
[certs] Generating "apiserver" certificate and key
# apiserver服务的证书地址已签发,service名称和IP是xxx
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local master01.kktb.org] and IPs [10.96.0.1 10.0.6.5]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
# etcd的service证书和dns解析名字
[certs] etcd/server serving cert is signed for DNS names [localhost master01.kktb.org] and IPs [10.0.6.5 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [localhost master01.kktb.org] and IPs [10.0.6.5 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
# 生成serviceaccount的私钥和公钥
[certs] Generating "sa" key and public key
# kubeconfig集群密钥的文件夹
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
# kubelet服务配置文件
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
# 使用的清单文件夹
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
# 创建k8s集群的关键服务的静态pod
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
# 创建惊天pod etcd的部署文件位置
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
# 等待kubelet服务启动控制节点的静态pod 从/etc/xxx目录 
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
# apiclient检查所有的控制平面节点的健康状态用时
[apiclient] All control plane components are healthy after 24.002949 seconds
# 在kube-system 命名空间中使用configmap资源类型存储配置信息kubeadm-config
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
# 存储证书
[upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
[upload-certs] Using certificate key:
1df01c66c2f92b14360bcaf893f6b3f6a5921fa65a6b080d9423a8362243f487
# 标记master01节点未控制平面节点并添加label标签
[mark-control-plane] Marking the node master01.kktb.org as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
# 添加控制平面节点禁止调度污点
[mark-control-plane] Marking the node master01.kktb.org as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule node-role.kubernetes.io/control-plane:NoSchedule]
[bootstrap-token] Using token: zcg7j7.zti8f568uzi9k6hn
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
# 配置rbac role-based access control 基于角色的访问控制密钥获取节点
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
# 应用 必要的插件 coredns kube-proxy
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
# 控制平面初始化完成
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:
# 配置kubeconfig文件到当前用户的家目录中
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:
# root用户可以运行
  export KUBECONFIG=/etc/kubernetes/admin.conf
# 部署网络插件
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of the control-plane node running the following command on each as root:
# 在其他控制平面节点使用下面的命令将节点添加到集群
  kubeadm join master01.kktb.org:6443 --token zcg7j7.zti8f568uzi9k6hn \
	--discovery-token-ca-cert-hash sha256:23d1070adacf75c3f79b577d966afe0286c9a06bc77dc25a8fd766487935fb94 \
	--control-plane --certificate-key 1df01c66c2f92b14360bcaf893f6b3f6a5921fa65a6b080d9423a8362243f487
# 默认证书在两个小时删除,可以使用如下命令重新生成证书
Please note that the certificate-key gives access to cluster sensitive data, keep it secret!
As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use
"kubeadm init phase upload-certs --upload-certs" to reload certs afterward.
# 在工作节点worker 添加主机到集群中
Then you can join any number of worker nodes by running the following on each as root:

kubeadm join master01.kktb.org:6443 --token zcg7j7.zti8f568uzi9k6hn \
	--discovery-token-ca-cert-hash sha256:23d1070adacf75c3f79b577d966afe0286c9a06bc77dc25a8fd766487935fb94 

配置网络插件flannel,安装时候用了flannel中默认的pod和svc的地址段,所以直接apply就行无需更改任何内容

[root@master01 ~]#kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
namespace/kube-flannel created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created

其他master节点加入集群

kubeadm join master01.kktb.org:6443 --token zcg7j7.zti8f568uzi9k6hn --discovery-token-ca-cert-hash sha256:23d1070adacf75c3f79b577d966afe0286c9a06bc77dc25a8fd766487935fb94 --control-plane --certificate-key 1df01c66c2f92b14360bcaf893f6b3f6a5921fa65a6b080d9423a8362243f487 --cri-socket unix:///run/cri-dockerd.sock
[root@master01 ~]#kubectl get pod -o wide 
NAME                       READY   STATUS    RESTARTS   AGE     IP           NODE                NOMINATED NODE   READINESS GATES
demoapp-78b49597cf-5f5dc   1/1     Running   0          9m44s   10.244.0.2   master01.kktb.org   <none>           <none>
demoapp-78b49597cf-fmqn8   1/1     Running   0          9m44s   10.244.0.3   master01.kktb.org   <none>           <none>

允许master节点参与调度

[root@master01 ~]#kubectl taint node master01.kktb.org node-role.kubernetes.io/master-
node/master01.kktb.org untainted
[root@master01 ~]#kubectl taint node master01.kktb.org node-role.kubernetes.io/control-plane-
node/master01.kktb.org untainted
# 一次允许所有的master节点允许调度
[root@master01 ~]#kubectl taint nodes --all node-role.kubernetes.io/control-plane-
[root@master01 ~]#kubectl taint nodes --all node-role.kubernetes.io/master-

创建pod测试

[root@master01 ~]#kubectl create deployment demoapp --image=ikubernetes/demoapp:v1.0 --replicas=2

验证其他节点也能被调度文章来源地址https://www.toymoban.com/news/detail-731650.html

[root@master01 ~]#kubectl scale deployment demoapp --replicas 3
deployment.apps/demoapp scaled
[root@master01 ~]#kubectl scale deployment demoapp --replicas 6
[root@master01 ~]#kubectl get pod -o wide 
NAME                       READY   STATUS    RESTARTS   AGE   IP           NODE                NOMINATED NODE   READINESS GATES
demoapp-78b49597cf-5f5dc   1/1     Running   0          10m   10.244.0.2   master01.kktb.org   <none>           <none>
demoapp-78b49597cf-dgcdz   1/1     Running   0          16s   10.244.2.3   master03.kktb.org   <none>           <none>
demoapp-78b49597cf-fmqn8   1/1     Running   0          10m   10.244.0.3   master01.kktb.org   <none>           <none>
demoapp-78b49597cf-j94ts   1/1     Running   0          16s   10.244.1.4   master02.kktb.org   <none>           <none>
demoapp-78b49597cf-k8mkw   1/1     Running   0          16s   10.244.1.5   master02.kktb.org   <none>           <none>
demoapp-78b49597cf-sq6vz   1/1     Running   0          24s   10.244.2.2   master03.kktb.org   <none>           <none>

到了这里,关于kubeadm部署k8sv1.24使用cri-docker做为CRI的文章就介绍完了。如果您还想了解更多内容,请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章,希望大家以后多多支持TOY模板网!

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处: 如若内容造成侵权/违法违规/事实不符,请点击违法举报进行投诉反馈,一经查实,立即删除!

领支付宝红包 赞助服务器费用

相关文章

  • Ubuntu系统kubeadm安装K8S_v1.25.x容器使用docker(K8S_v1.24版本以后依然使用docker容器管理)

    安装所需要的全部文档请点击这里下载 系统是: root@k8s-master:~# cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=22.04 DISTRIB_CODENAME=jammy DISTRIB_DESCRIPTION=“Ubuntu 22.04.3 LTS” root@k8s-master:~# uname -a Linux k8s-master 5.15.0-76-generic #83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux root@k8s-

    2024年02月13日
    浏览(41)
  • kubeadm k8s 1.24之后版本安装,带cri-dockerd

    最后编辑时间:2024/3/26 适用于1.24之后的版本 检查是否已经安装kubectl, kubelet, kubeadm直接输入命令确定,如果提示没有该指令则正确 如果之前安装,首先reset,然后使用apt remove和snap remove删除 关闭防火墙 查看防火墙状态 inactive说明是未激活 开机不启动防火墙,重启即可生效

    2024年04月24日
    浏览(32)
  • 云原生之深入解析K8S 1.24的高可用环境部署

    2022 年 5 月 3 日,Kubernetes 1.24 正式发布,在新版本中,可以看到 Kubernetes 作为容器编排的事实标准,正愈发变得成熟,有 12 项功能都更新到了稳定版本,同时引入了很多实用的功能,例如 StatefulSets 支持批量滚动更新,NetworkPolicy 新增 NetworkPolicyStatus 字段方便进行故障排查等

    2024年02月10日
    浏览(48)
  • 云原生|kubernetes|使用cri-docker部署基于kubeadm-1.25.4的集群

    前言: kubernetes的部署从1.24版本开始后,弃用docker-shim,也就是说部署1.24版本后的集群不能使用docker-ce了。 比较清晰的解决方案有两个,一是使用containerd,这个是一个新的支持cri标准的shim,一个是使用cri-docker这样的中间插件形式, 一头通过CRI跟kubelet交互,另一头跟docker

    2024年02月07日
    浏览(75)
  • ​k8s 1.24 1.25 集群使用docker作为容器

    背景 在新版本Kubernetes环境(1.24以及以上版本)下官方不在支持docker作为容器运行时了,若要继续使用docker 需要对docker进行配置一番。需要安装cri-docker作为Kubernetes容器 查看当前容器运行时 安装docker 安装cri-docker 为kubelet配置容器运行时 关于 https://www.oiox.cn/ https://www.oiox.cn

    2024年02月12日
    浏览(67)
  • k8s 1.18 VS 1.24

    Kubernetes是一个开源的容器编排平台,它致力于自动化容器的部署、扩展和管理。1.24和1.18是Kubernetes的两个版本,它们之间的区别包括以下几个方面: API版本:Kubernetes 1.24支持API版本为v1.22,而Kubernetes 1.18支持API版本为v1.17。 功能特性:Kubernetes 1.24相对于1.18增加了许多新的功

    2023年04月23日
    浏览(50)
  • 【云原生-K8s】kubeadm搭建安装k8s集群v1.25版本完整教程【docker、网络插件calico、中间层cri-docker】

    从 k8s 1.24开始,dockershim已经从kubelet中移除,但因为历史问题docker却不支持kubernetes主推的CRI(容器运行时接口)标准,所以docker不能再作为k8s的容器运行时了,即从k8s v1.24开始不再使用docker了 但是如果想继续使用docker的话,可以在kubelet和docker之间加上一个中间层cri-docker。

    2024年02月03日
    浏览(41)
  • 使用kubeadm部署kubernetes 1.24.3

     节点信息:  这里使用containerd作为运行时,部署可参照 https://blog.csdn.net/weixin_46476452/article/details/127670046 目录 一、系统环境初始化 二、配置apt源、下载kubeadm 三、安装cni 四、初始化kubernetes 五、配置节点认证,加入集群 六、部署calico网络插件 七、验证 八、报错处理  我系

    2024年02月13日
    浏览(42)
  • 最后的组合:K8s 1.24 基于 Hekiti 实现 GlusterFS 动态存储管理实践

    知识点 定级: 入门级 GlusterFS 和 Heketi 简介 GlusterFS 安装部署 Heketi 安装部署 Kubernetes 命令行对接 GlusterFS 实战服务器配置(架构 1:1 复刻小规模生产环境,配置略有不同) 主机名 IP CPU 内存 系统盘 数据盘 用途 ks-master-0 192.168.9.91 2 4 50 100 KubeSphere/k8s-master ks-master-1 192.168.9.92 2 4 5

    2024年02月09日
    浏览(35)
  • Kubeadm 部署 k8s 使用国内镜像源

    Kubernetes官方文档的安装过程中,有些地方需要使用国内的镜像源才能完成 这篇文章整合了所有需要替换国内镜像的地方,供参考 操作系统:Rocky 9(最小安装) 容器运行时:containerd k8s阿里云源 docker-ce阿里云源 安装containerd时需要,实测输入这一行命令就可以了

    2024年02月11日
    浏览(44)

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

博客赞助

微信扫一扫打赏

请作者喝杯咖啡吧~博客赞助

支付宝扫一扫领取红包,优惠每天领

二维码1

领取红包

二维码2

领红包