是容器编排管理平台用来批量管理 Docker 这类容器实现容器自动化部署、扩缩容、故障自愈管理大量容器化应用。原理把多台服务器组成集群划分两类角色Master 控制节点集群大脑接收用户指令调度容器管控集群状态kube‑apiserver集群入口所有请求必经etcd集群数据库保存全部集群配置数据kube‑scheduler调度器决定 Pod 跑在哪台机器kube‑controller‑manager控制器维持资源期望状态Worker 工作节点真正跑业务容器的机器kubelet节点代理接收 master 指令管理本机 Podkube‑proxy网络代理负责服务网络转发容器运行时docker/containerd真正运行容器常用名词Master集群控制节点每个集群需要至少一个master节点负责集群的管控Node工作负载节点由master分配容器到这些node工作节点上然后node节点上的Podkubernetes的最小控制单元容器都是运行在pod中的一个pod中可以有1个或者多个容器Controller控制器通过它来实现对pod的管理比如启动pod、停止pod、伸缩pod的数量等等Servicepod对外服务的统一入口下面可以维护者同一类的多个podLabel标签用于对pod进行分类同一类pod会拥有相同的标签NameSpace命名空间用来隔离pod的运行环境部署一.构建harbor镜像仓库1.部署docker本地仓库搭建本地 docker yum 源#httpdapache 网页服务用来对外提供本地 yum 源访问#createrepo生成 yum 仓库元数据制作本地软件源[rootharbor ~]# dnf install httpd createrepo -y[rootharbor ~]# mkdir /var/www/html/docker/ -p[rootharbor ~]# vim /etc/httpd/conf/httpd.conf[rootharbor ~]# systemctl enable --now httpd[rootharbor ~]# dnf install docker-ce --downloadonly --destdir /mnt/ -y[rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/[rootharbor ~]# createrepo -v /var/www/html/docker/[rootharbor ~]# dnf install docker-ce -y2.安装docker在harbor仓库节点[rootharbor ~]# dnf install docker-ce -y[rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf[rootharbor ~]# modprobe -a br_netfilter[rootharbor ~]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1[rootharbor ~]# systemctl restart systemd-modules-load.service[rootharbor ~]# sysctl --system[rootharbor ~]# vim /lib/systemd/system/docker.serviceExecStart/usr/bin/dockerd-Hfd://--containerd/run/containerd/containerd.sock--iptablestrue[rootharbor ~]# systemctl daemon-reload2.生成key3.编辑harbor配置文件配置文件并检测运行2.利用ansible剧本部署docker[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all tasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.151:4444/docker#harbor ipfile:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.bor.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.bor.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/docker/certs.d/reg.bor.org/ca.crt - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt - name: load module copy: dest:{{item.dest}}content:{{item.value}}loop: - dest: /etc/modules-load.d/docker_mod.conf value: br_netfilter - dest: /etc/sysctl.d/docker.conf value:|net.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1- name: update ca cert shell:update-ca-trust extract;sysctl --system- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml3.利用ansible安装cri-dockerd[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all become:yestasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.151:4444/docker#harbor ipfile:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.bor.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.bor.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/docker/certs.d/reg.bor.org/ca.crt - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt########################################################- name: stup cri-dockerd copy: src:{{item.src}}dest:{{item.dest}}mode:0755loop: - src: ./cri-dockerd/cri-dockerd dest: /usr/bin/cri-dockerd - src:./cri-dockerd/cri-docker.servicedest:/lib/systemd/system/cri-docker.service- src:./cri-dockerd/cri-docker.socketdest:/lib/systemd/system/cri-docker.socket- name: update ca cert shell:update-ca-trust extract;sysctl --system;systemctl daemon-reload- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service - cri-docker[devopsharbor ansible]$ ansible-playbook-iinventory kubernetes-devops.yml4.利用ansible部署k8s软件[devopsharbor ansible]$vimkubernetes-devops.yml - name:installkubernetes from ansible hosts: all tasks: - name: setup k8s repo yum_repository: name: kubernetes description: kubernetes baseurl: https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm file: kubernetes gpgcheck: no - name:installsoftwareinmaster dnf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 - kubectl-1.35.7-150500.1.1 when: inventory_hostname172.25.254.150- name:installsoftwareinworknodednf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 when: inventory_hostname172.25.254.10or inventory_hostname172.25.254.20- name: setup kubectl kubeadm complication lineinfile: path: /root/.bashrc line:|source(kubectl completionbash)source(kubeadm completionbash)when: inventory_hostname172.25.254.150- name: start kubelet service: name: kubelet state: started enabled:yes[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml#让补齐功能生效[rootk8s-master mnt]# source ~/.bashrc三.下载kubernetes集群所需镜像四.在master中初始化kubernetes集群在master中完成集群初始化#每个人不一样其他主机加入本集群的凭证kubeadmjoin172.25.254.100:6443--tokentdwjoc.8d1yw3wl4r4tm6c4\--discovery-token-ca-cert-hash sha256:6b5950ef2cdba85d6dfdb564ee90d4187fa3d341767dc9852cbdd5c9dee4f927#如果忘记[rootmaster ~]# kubeadm token create --print-join-commandkubeadmjoin172.25.254.150:6443--tokenuvrr1z.03m17zret5c9gg2t\--discovery-token-ca-cert-hash sha256:9ffa91849f52ea4a831243853f57b068be438867fc4b2e2f2ae78c853ac309ac#如果初始化出问题[rootmaster ~]# kubeadm reset --cri-socketunix:///var/run/cri-dockerd.sock #可以重置集群设定添加kubernets环境变量到本机添加node节点到本集群#删除#kubeadm reset --force --cri-socket unix:///var/run/containerd/containerd.sockrm-rf/etc/kubernetes /var/lib/kubelet /etc/cni/net.d测试五.安装网络插件[rootmaster flannel]# vim kube-flannel.yml[rootk8s-master flannel]# grep -n image: kube-flannel.yml #要改内容所在行的位置148: image: flannel-io/flannel:v0.28.9175: image: flannel-io/flannel-cni-plugin:v1.9.1-flannel3186: image: flannel-io/flannel:v0.28.9
是容器编排管理平台用来批量管理 Docker 这类容器实现容器自动化部署、扩缩容、故障自愈管理大量容器化应用。原理把多台服务器组成集群划分两类角色Master 控制节点集群大脑接收用户指令调度容器管控集群状态kube‑apiserver集群入口所有请求必经etcd集群数据库保存全部集群配置数据kube‑scheduler调度器决定 Pod 跑在哪台机器kube‑controller‑manager控制器维持资源期望状态Worker 工作节点真正跑业务容器的机器kubelet节点代理接收 master 指令管理本机 Podkube‑proxy网络代理负责服务网络转发容器运行时docker/containerd真正运行容器常用名词Master集群控制节点每个集群需要至少一个master节点负责集群的管控Node工作负载节点由master分配容器到这些node工作节点上然后node节点上的Podkubernetes的最小控制单元容器都是运行在pod中的一个pod中可以有1个或者多个容器Controller控制器通过它来实现对pod的管理比如启动pod、停止pod、伸缩pod的数量等等Servicepod对外服务的统一入口下面可以维护者同一类的多个podLabel标签用于对pod进行分类同一类pod会拥有相同的标签NameSpace命名空间用来隔离pod的运行环境部署一.构建harbor镜像仓库1.部署docker本地仓库搭建本地 docker yum 源#httpdapache 网页服务用来对外提供本地 yum 源访问#createrepo生成 yum 仓库元数据制作本地软件源[rootharbor ~]# dnf install httpd createrepo -y[rootharbor ~]# mkdir /var/www/html/docker/ -p[rootharbor ~]# vim /etc/httpd/conf/httpd.conf[rootharbor ~]# systemctl enable --now httpd[rootharbor ~]# dnf install docker-ce --downloadonly --destdir /mnt/ -y[rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/[rootharbor ~]# createrepo -v /var/www/html/docker/[rootharbor ~]# dnf install docker-ce -y2.安装docker在harbor仓库节点[rootharbor ~]# dnf install docker-ce -y[rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf[rootharbor ~]# modprobe -a br_netfilter[rootharbor ~]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1[rootharbor ~]# systemctl restart systemd-modules-load.service[rootharbor ~]# sysctl --system[rootharbor ~]# vim /lib/systemd/system/docker.serviceExecStart/usr/bin/dockerd-Hfd://--containerd/run/containerd/containerd.sock--iptablestrue[rootharbor ~]# systemctl daemon-reload2.生成key3.编辑harbor配置文件配置文件并检测运行2.利用ansible剧本部署docker[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all tasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.151:4444/docker#harbor ipfile:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.bor.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.bor.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/docker/certs.d/reg.bor.org/ca.crt - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt - name: load module copy: dest:{{item.dest}}content:{{item.value}}loop: - dest: /etc/modules-load.d/docker_mod.conf value: br_netfilter - dest: /etc/sysctl.d/docker.conf value:|net.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1- name: update ca cert shell:update-ca-trust extract;sysctl --system- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml3.利用ansible安装cri-dockerd[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all become:yestasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.151:4444/docker#harbor ipfile:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.bor.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.bor.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/docker/certs.d/reg.bor.org/ca.crt - src: /etc/docker/certs.d/reg.bor.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt########################################################- name: stup cri-dockerd copy: src:{{item.src}}dest:{{item.dest}}mode:0755loop: - src: ./cri-dockerd/cri-dockerd dest: /usr/bin/cri-dockerd - src:./cri-dockerd/cri-docker.servicedest:/lib/systemd/system/cri-docker.service- src:./cri-dockerd/cri-docker.socketdest:/lib/systemd/system/cri-docker.socket- name: update ca cert shell:update-ca-trust extract;sysctl --system;systemctl daemon-reload- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service - cri-docker[devopsharbor ansible]$ ansible-playbook-iinventory kubernetes-devops.yml4.利用ansible部署k8s软件[devopsharbor ansible]$vimkubernetes-devops.yml - name:installkubernetes from ansible hosts: all tasks: - name: setup k8s repo yum_repository: name: kubernetes description: kubernetes baseurl: https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm file: kubernetes gpgcheck: no - name:installsoftwareinmaster dnf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 - kubectl-1.35.7-150500.1.1 when: inventory_hostname172.25.254.150- name:installsoftwareinworknodednf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 when: inventory_hostname172.25.254.10or inventory_hostname172.25.254.20- name: setup kubectl kubeadm complication lineinfile: path: /root/.bashrc line:|source(kubectl completionbash)source(kubeadm completionbash)when: inventory_hostname172.25.254.150- name: start kubelet service: name: kubelet state: started enabled:yes[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml#让补齐功能生效[rootk8s-master mnt]# source ~/.bashrc三.下载kubernetes集群所需镜像四.在master中初始化kubernetes集群在master中完成集群初始化#每个人不一样其他主机加入本集群的凭证kubeadmjoin172.25.254.100:6443--tokentdwjoc.8d1yw3wl4r4tm6c4\--discovery-token-ca-cert-hash sha256:6b5950ef2cdba85d6dfdb564ee90d4187fa3d341767dc9852cbdd5c9dee4f927#如果忘记[rootmaster ~]# kubeadm token create --print-join-commandkubeadmjoin172.25.254.150:6443--tokenuvrr1z.03m17zret5c9gg2t\--discovery-token-ca-cert-hash sha256:9ffa91849f52ea4a831243853f57b068be438867fc4b2e2f2ae78c853ac309ac#如果初始化出问题[rootmaster ~]# kubeadm reset --cri-socketunix:///var/run/cri-dockerd.sock #可以重置集群设定添加kubernets环境变量到本机添加node节点到本集群#删除#kubeadm reset --force --cri-socket unix:///var/run/containerd/containerd.sockrm-rf/etc/kubernetes /var/lib/kubelet /etc/cni/net.d测试五.安装网络插件[rootmaster flannel]# vim kube-flannel.yml[rootk8s-master flannel]# grep -n image: kube-flannel.yml #要改内容所在行的位置148: image: flannel-io/flannel:v0.28.9175: image: flannel-io/flannel-cni-plugin:v1.9.1-flannel3186: image: flannel-io/flannel:v0.28.9
全解析：从ERM失效到领域泛化与不变性学习)
