# wsl2 ubuntu20.04 上使用 kubeadm 建立一個單主叢集 - 官方文件[使用 kubeadm 建立一個單主叢集](https://kubernetes.io/zh/docs/setup/independent/create-cluster-kubeadm/) ## 環境初始化 - 建議儘可能初始化環境，命令`wsl --unregister Ubuntu-20.04`可重新安裝，相當於重灌系統。安裝或重置過程中，開啟這個 wsl2 視窗，提示如下： ```bash Installing, this may take a few minutes... 適用於 Linux 的 Windows 子系統例項已終止。 Please create a default UNIX user account. The username does not need to match your Windows username. For more information visit: https://aka.ms/wslusers Enter new UNIX username: ``` - 此時關掉視窗再開啟，以後則預設使用 root 使用者登入。 - 使用阿里映象： ```bash sudo cat </etc/apt/sources.list deb http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs) main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs) main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-security main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-security main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-updates main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-updates main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-proposed main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-proposed main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-backports main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ $(lsb_release -cs)-backports main restricted universe multiverse EOF ``` - 更新快取 ```bash sudo apt update ``` - wsl2 官方 ubuntu 系統啟動方式為 init，而 k8s 安裝過程需要系統以 systemd 方式啟動。[查詢 docker 狀態的原始碼](https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/app/util/initsystem/initsystem_unix.go#L138)，可以看到是通過`systemctl is-active docker`查詢，因此要想辦法在 wsl2 啟用 systemd。 - 參考[Using snapd in WSL2](https://discourse.ubuntu.com/t/using-snapd-in-wsl2/12113)可知： Systemd 已經預安裝，但並未啟用。使用方式很簡單，就是將它放到一個“容器”，在該容器裡，Systemd 的 pid 是 1。命令如下： - 安裝`daemonize` ```bash sudo apt install daemonize ``` ```bash sudo daemonize /usr/bin/unshare --fork --pid --mount-proc /lib/systemd/systemd --system-unit=basic.target ``` - 使用命令`ps -aux`檢視程序 pid。使用以下命令進入這個“容器”，在此檢視程序 pid，可以看到 pid 為 1 的程序變成了 systemd。使用命令`stat /proc/1/exe`亦可驗證。 ```bash exec sudo nsenter -t $(pidof systemd) -a su - $LOGNAME ``` ## 安裝 Docker - 安裝命令，參考[安裝 Docker](https://kubernetes.io/zh/docs/setup/production-environment/container-runtimes/#docker)。 ```bash # 安裝 Docker CE ## 設定倉庫 ### 安裝軟體包以允許 apt 通過 HTTPS 使用儲存庫 apt-get update && apt-get install \ apt-transport-https ca-certificates curl software-properties-common ### 新增 Docker 的 官方 GPG 祕鑰 curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - ### 新增 Docker apt 倉庫 add-apt-repository \ "deb [arch=amd64] https://download.docker.com/linux/ubuntu \ $(lsb_release -cs) \ stable" ## 安裝 Docker CE apt-get update && apt-get install \ containerd.io \ docker-ce \ docker-ce-cli -y # 設定 daemon cat > /etc/docker/daemon.json </etc/apt/sources.list.d/kubernetes.list deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main EOF apt-get update apt-get install -y kubelet kubeadm kubectl ``` ## 使用 kubeadm 建立單個控制平面叢集 - [初始化文件](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) - 外掛列表參考文件[安裝擴充套件](https://kubernetes.io/zh/docs/concepts/cluster-administration/addons/) - 汙點和容忍： [Taint 和 Toleration](https://kubernetes.io/zh/docs/concepts/configuration/taint-and-toleration/) - https://hub.docker.com/u/gotok8s - 初始化命令：`kubeadm init --pod-network-cidr=10.244.0.0/16 --control-plane-endpoint=ubuntu.wsl --image-repository=gotok8s --v=5` - 其中 pod-network-cidr 指定網路驅動的 CIDR，根據使用的外掛而定。這裡使用 [flannel](https://github.com/coreos/flannel/blob/master/Documentation/kubernetes.md)，[文件](https://github.com/coreos/flannel/blob/master/Documentation/kubernetes.md)指示使用值`10.244.0.0/16`。 - control-plane-endpoint 指定主節點地址，可以是 IP 地址或者是可以對映 ip 地址的 DNS 名稱。因此使用前要設定一下: ```bash cat <>/etc/hosts $(ip address | grep eth0 | grep inet | awk -F ' ' '{ print $2}' | awk -F / '{ print $1}') ubuntu.wsl EOF ``` - image-repository 指定拉取映象的倉庫，[gotok8s](https://hub.docker.com/u/gotok8s)是 docker hub 上的使用者，同步了安裝所需映象，否則國內會因訪問不了 gcr.io 而安裝失敗。 - `--v=5`是除錯選項，加上後可看到更詳細輸出。 ```text root@DESKTOP-QNMROJ1:~# kubeadm init --pod-network-cidr=10.244.0.0/16 --control-plane-endpoint=ubuntu.wsl --image-repository=gotok8s W0706 21:45:49.154779 1903997 version.go:102] could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt": Get https://dl.k8s.io/release/stable-1.txt: dial tcp: lookup dl.k8s.io on 127.0.0.53:53: server misbehaving W0706 21:45:49.154839 1903997 version.go:103] falling back to the local client version: v1.18.5 W0706 21:45:49.155372 1903997 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io] [init] Using Kubernetes version: v1.18.5 [preflight] Running pre-flight checks [preflight] Pulling images required for setting up a Kubernetes cluster [preflight] This might take a minute or two, depending on the speed of your internet connection [preflight] You can also perform this action in beforehand using 'kubeadm config images pull' [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" [kubelet-start] Starting the kubelet [certs] Using certificateDir folder "/etc/kubernetes/pki" [certs] Generating "ca" certificate and key [certs] Generating "apiserver" certificate and key [certs] apiserver serving cert is signed for DNS names [desktop-qnmroj1 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local ubuntu.wsl] and IPs [10.96.0.1 172.25.14.224] [certs] Generating "apiserver-kubelet-client" certificate and key [certs] Generating "front-proxy-ca" certificate and key [certs] Generating "front-proxy-client" certificate and key [certs] Generating "etcd/ca" certificate and key [certs] Generating "etcd/server" certificate and key [certs] etcd/server serving cert is signed for DNS names [desktop-qnmroj1 localhost] and IPs [172.25.14.224 127.0.0.1 ::1] [certs] Generating "etcd/peer" certificate and key [certs] etcd/peer serving cert is signed for DNS names [desktop-qnmroj1 localhost] and IPs [172.25.14.224 127.0.0.1 ::1] [certs] Generating "etcd/healthcheck-client" certificate and key [certs] Generating "apiserver-etcd-client" certificate and key [certs] Generating "sa" key and public key [kubeconfig] Using kubeconfig folder "/etc/kubernetes" [kubeconfig] Writing "admin.conf" kubeconfig file [kubeconfig] Writing "kubelet.conf" kubeconfig file [kubeconfig] Writing "controller-manager.conf" kubeconfig file [kubeconfig] Writing "scheduler.conf" kubeconfig file [control-plane] Using manifest folder "/etc/kubernetes/manifests" [control-plane] Creating static Pod manifest for "kube-apiserver" [control-plane] Creating static Pod manifest for "kube-controller-manager" W0706 21:45:54.052056 1903997 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC" [control-plane] Creating static Pod manifest for "kube-scheduler" W0706 21:45:54.053414 1903997 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC" [etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests" [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s [apiclient] All control plane components are healthy after 33.002925 seconds [upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace [kubelet] Creating a ConfigMap "kubelet-config-1.18" in namespace kube-system with the configuration for the kubelets in the cluster [upload-certs] Skipping phase. Please see --upload-certs [mark-control-plane] Marking the node desktop-qnmroj1 as control-plane by adding the label "node-role.kubernetes.io/master=''" [mark-control-plane] Marking the node desktop-qnmroj1 as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule] [bootstrap-token] Using token: 8328sm.dh21due3jz2okibj [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster [bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace [kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key [addons] Applied essential addon: CoreDNS [addons] Applied essential addon: kube-proxy Your Kubernetes control-plane has initialized successfully! To start using your cluster, you need to run the following as a regular user: mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config You should now deploy a pod network to the cluster. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at: https://kubernetes.io/docs/concepts/cluster-administration/addons/ You can now join any number of control-plane nodes by copying certificate authorities and service account keys on each node and then running the following as root: kubeadm join ubuntu.wsl:6443 --token 8328sm.dh21due3jz2okibj \ --discovery-token-ca-cert-hash sha256:31f44da2c275026d9d71ddcd138f8c6a5ac4fecbc167d8b6247788f9651afa53 \ --control-plane Then you can join any number of worker nodes by running the following on each as root: kubeadm join ubuntu.wsl:6443 --token 8328sm.dh21due3jz2okibj \ --discovery-token-ca-cert-hash sha256:31f44da2c275026d9d71ddcd138f8c6a5ac4fecbc167d8b6247788f9651afa53 ``` - 配置 cluster 資訊使 kubectl 可用 ```bash # 非 root 使用者執行下面命令 mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config # root使用者可執行如下命令 export KUBECONFIG=/etc/kubernetes/admin.conf ``` - 安裝網路外掛 ```bash kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml ``` - 控制平面節點隔離。預設情況下，出於安全原因，群集不會在控制平面節點上排程 Pod。如果希望能夠在控制平面節點上安排 Pod，例如對於用於開發的單機 Kubernetes 群集，請執行： ```bash kubectl taint nodes --all node-role.kubernetes.io/master- ``` - 執行 nginx 測試。如果遇到`Temporary failure in name resolution`這種訪問的問題，請開啟非 systemd 空間的控制檯操作。 ```bash kubectl run nginx --image=nginx --port=80 --hostport=80 curl 127.0.0.1 ``` - 監控叢集狀態，大概每兩秒重新整理一次。 ```bash watch kubectl get all -A ``` - [kubeadm 常用命令](https://kubernetes.io/docs/reference/setup-tools/kubeadm/) - [kubectl 常用命令](https://kubernetes.io/docs/reference/kubectl/ku