说明:除集群初始化外与worker加入集群,其余操作三台设备均都要执行。
基于containerd容器运行时部署k8s 1.28集群。
CPU | 内存 | 节点 |
---|---|---|
CPU 2u | 内存4G | k8s-master01 |
CPU 1u | 内存4G | k8s-worker01 |
CPU 1u | 内存4G | k8s-worker02 |
/ | / | / |
系统版本 | Centos7.9 | 全部一致 |
内核版本 | 5.4.260-1.el7.elrepo.x86_64 | 全部一致 |
由于本次使用3台主机完成kubernetes集群部署,其中1台为master节点,名称为k8s-master01
;其中2台为worker节点,名称分别为:k8s-worker01
及k8s-worker02
节点名称 | 主机名 | IP地址 |
---|---|---|
master节点 | hostnamectl set-hostname k8s-master01 | 192.168.31.150 |
worker01节点 | hostnamectl set-hostname k8s-worker01 | 192.168.31.151 |
worker02节点 | hostnamectl set-hostname k8s-worker02 | 192.168.31.152 |
hostnamectl set-hostname xxx
,三台对应的设备分别执行:
master节点
hostnamectl set-hostname k8s-master01
worker01节点
hostnamectl set-hostname k8s-worker01
worker02节点
hostnamectl set-hostname k8s-worker02
PS一些小细节:
1、从此处开始,以下大部分命令,所有集群主机均需要配置,如无需配置,文档会说明。2、使用SSH软件远程,可以批量操作控制台,如果使用的是crt可以参考我另一篇文章:SecureCrt使用小技巧---->发送交互到所有会话,其他软件(xshell等设置都很简单)可以自行百度一下,节省时间,不用每条命令复制到三个终端分别执行。
设置系统主机名以及 Host 文件的相互解析,小集群环境使用修改host,大型环境使用dns方式使他们用户名和ip能相互解析
给每台虚拟机添加hosts
cat >> /etc/hosts << EOF
192.168.31.150 k8s-master01
192.168.31.151 k8s-worker01
192.168.31.152 k8s-worker02
EOF
#关闭防火墙
systemctl disable firewalld && systemctl stop firewalld && firewall-cmd --state
#关闭selinux
sed -ri 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config && getenforce 0
所有主机
#安装ntp
yum install -y ntpdate
#配置ntp自动更新时间
crontab -e #写入同步的计划任务
0 */1 * * * /usr/sbin/ntpdate time1.aliyun.com
所有主机均需升级
#导入elrepo gpg key
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
#安装elrepo YUM源仓库
yum -y install https://www.elrepo.org/elrepo-release-7.0-4.el7.elrepo.noarch.rpm
#安装kernel-ml版本,ml为最新稳定版本,lt为长期维护版本
yum --enablerepo="elrepo-kernel" -y install kernel-lt.x86_64
#设置grub2默认引导为0
echo 'GRUB_DEFAULT="0"' | tee -a /etc/default/grub
#重新生成grub2引导文件
grub2-mkconfig -o /boot/grub2/grub.cfg
#重启系统
reboot
重启后,需要验证内核是否为更新对应的版本
uname -r
5.4.260-1.el7.elrepo.x86_64
所有主机均需要操作。
#添加网桥过滤及内核转发配置文件
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
vm.swappiness = 0
EOF
#加载br_netfilter模块
modprobe br_netfilter
查看是否加载执行命令lsmod | grep br_netfilter
lsmod | grep br_netfilter
br_netfilter 22256 0
bridge 151336 1 br_netfilter
yum -y install ipset ipvsadm
配置ipvsadm模块加载方式,添加需要加载的模块
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack
EOF
授权、运行、检查是否加载
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack
修改完成后需要重启操作系统,如不重启服务器,可临时关闭,命令为:
swapoff -a
永远关闭swap分区,需要重启操作系统
sed -ri 's/.*swap.*/#&/' /etc/fstab
重启系统
reboot
Containerd获取部署文件,访问 github,搜索Containerd
选择历史版本,本次安装版本:1.7.3
选择containerd对应版本,复制链接,使用wget进行下载,
下载
wget https://github.com/containerd/containerd/releases/download/v1.7.3/cri-containerd-1.7.3-linux-amd64.tar.gz
解压
tar zxvf cri-containerd-1.7.3-linux-amd64.tar.gz -C /
mkdir /etc/containerd
containerd config default > /etc/containerd/config.toml
vim /etc/containerd/config.toml
#编辑config.toml,修改如下内容:
sandbox_image = "registry.k8s.io/pause:3.9" 由3.8修改为3.9
# 设置Containerd开机自启动
systemctl enable --now containerd
# 验证其版本
containerd --version
本步骤可跳过,底下有提供wget的链接命令,
访问github.com,搜索以获取runc
获取历史版本的runc,本次安装使用:runc1.1.5
鼠标右击,选择对安装包,复制下载链接,
本步骤可跳过,底下有提供wget的链接命令
访问github,搜索libseccomp
,下载安装包
本步骤必须按照,不安装 ibseccomp,直接安装runc会报错缺少依赖
#安装 gcc,编译需要
yum install gcc -y
#下载libseccomp-2.5.4.tar.gz
wget https://github.com/opencontainers/runc/releases/download/v1.1.5/libseccomp-2.5.4.tar.gz
#解压
tar xf libseccomp-2.5.4.tar.gz
#进入解压文件夹
cd libseccomp-2.5.4/
#安装gperf
yum install gperf -y
#编译
./configure
# 安装
make && make install
#查看该文件是否存在,检查是否安装成功
find / -name "libseccomp.so"
#下载runc安装包
wget https://github.com/opencontainers/runc/releases/download/v1.1.9/runc.amd64
#赋权
chmod +x runc.amd64
#查找containerd安装时已安装的runc所在的位置,然后替换
which runc
#替换containerd安装已安装的runc
mv runc.amd64 /usr/local/sbin/runc
#执行runc命令,如果有命令帮助则为正常
runc
如果运行runc命令时提示:runc:
error while loading shared libraries:libseccomp.so.2: cannot open shared object file: No such file or directory
则表明runc没有找到libseccomp,需要检查libseccomp是否安装,本次安装默认就可以查询到。
使用google提供的YUM源 或者使用阿里云的都可以。
cat > /etc/yum.repos.d/k8s.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF
#本次使用默认安装
yum -y install kubeadm kubelet kubectl
#查看指定版本(可忽略)
# yum list kubeadm.x86_64 --showduplicates | sort -r
# yum list kubelet.x86_64 --showduplicates | sort -r
# yum list kubectl.x86_64 --showduplicates | sort -r
#安装指定版本(可忽略)
# yum -y install kubeadm-1.28.X-0 kubelet-1.28.X-0 kubectl-1.28.X-0
为了实现docker使用的cgroupdriver与kubelet使用的cgroup的一致性,建议修改如下文件内容。
#编辑/etc/sysconfig/kubelet文件
vim /etc/sysconfig/kubelet
#写入如下配置:
KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"
# 设置kubelet为开机自启动即可,由于没有生成配置文件,集群初始化后自动启动
systemctl enable kubelet
配置证书在实验环境中非必须步骤(可以跳过)
执行命令which kubeadm
,查看是否有kubeadm命令
which kubeadm
#/usr/bin/kubeadm
访问github,搜索kubernetes
选择该项
根据需要选择版本,此处使用:v1.28.0.tar.gz
复制下载链接
# 下载
wget https://github.com/kubernetes/kubernetes/archive/refs/tags/v1.28.0.tar.gz
#ls查看该包
ls
v1.28.0.tar.gz
#剪切到目录
mv v1.28.0.tar.gz /usr/local/src/
#进入目录
cd /usr/local/src/
# 解压
tar zxvf v1.28.0.tar.gz
#通过ls再查看解压后的包名:kubernetes-1.28.0
kubernetes-1.28.0
修改CA证书为100年有效期(默认为10年)
[root@k8s-master01 ~]# vim kubernetes-1.28.0/staging/src/k8s.io/client-go/util/cert/cert.go
72 tmpl := x509.Certificate{
73 SerialNumber: serial,
74 Subject: pkix.Name{
75 CommonName: cfg.CommonName,
76 Organization: cfg.Organization,
77 },
78 DNSNames: []string{cfg.CommonName},
79 NotBefore: notBefore,
80 NotAfter: now.Add(duration365d * 100).UTC(),
81 KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
82 BasicConstraintsValid: true,
83 IsCA: true,
84 }
修改说明:
把文件中80行,10修改为100即可 。
修改kubeadm证书有效期为100年(默认为1年)
[root@k8s-master01 ~]# vim kubernetes-1.28.0/cmd/kubeadm/app/constants/constants.go
......
37 const (
38 // KubernetesDir is the directory Kubernetes owns for storing various configuration files
39 KubernetesDir = "/etc/kubernetes"
40 // ManifestsSubDirName defines directory name to store manifests
41 ManifestsSubDirName = "manifests"
42 // TempDirForKubeadm defines temporary directory for kubeadm
43 // should be joined with KubernetesDir.
44 TempDirForKubeadm = "tmp"
45
46 // CertificateBackdate defines the offset applied to notBefore for CA certificates generated by kubeadm
47 CertificateBackdate = time.Minute * 5
48 // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
49 CertificateValidity = time.Hour * 24 * 365 * 100
修改说明:
把CertificateValidity = time.Hour * 24 * 365 修改为:CertificateValidity = time.Hour * 24 * 365 * 100
因为kubernetes是go语言写的,所以安装go语言环境用作编译
访问官网下载go
选择安装包,复制链接,进行下载
#下载
wget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz
#解压
tar zxvf go1.21.0.linux-amd64.tar.gz
#移动文件夹
mv go /usr/local/go
#添加全局变量:export PATH=$PATH:/usr/local/go/bin
vim /etc/profile
export PATH=$PATH:/usr/local/go/bin
#使变量生效
source /etc/profile
#测试go是否安装成功
go version
,编译要用rsync,安装rsync命令:yum install rsync -y
yum install rsync -y
[root@k8s-master01 ~]# cd kubernetes-1.28.0/
[root@k8s-master01 kubernetes-1.28.0]# make all WHAT=cmd/kubeadm GOFLAGS=-v
[root@k8s-master01 kubernetes-1.28.0]# ls
_output
[root@k8s-master01 kubernetes-1.28.0]# ls _output/
bin local
[root@k8s-master01 kubernetes-1.28.0]# ls _output/bin/
kubeadm ncpu
[root@k8s-master01 kubernetes-1.28.0]# which kubeadm
/usr/bin/kubeadm
[root@k8s-master01 kubernetes-1.28.0]# rm -rf `which kubeadm`
[root@k8s-master01 kubernetes-1.28.0]# cp _output/bin/kubeadm /usr/bin/kubeadm
[root@k8s-master01 kubernetes-1.28.0]# which kubeadm
/usr/bin/kubeadm
worker01和worker02删除
[root@k8s-worker01 ~]# rm -rf `which kubeadm`
[root@k8s-worker02 ~]# rm -rf `which kubeadm`
复制文件到worker01 和 worker02
[root@k8s-master01 kubernetes-1.28.0]# scp _output/bin/kubeadm 192.168.31.151:/usr/bin/kubeadm
[root@k8s-master01 kubernetes-1.28.0]# scp _output/bin/kubeadm 192.168.31.152:/usr/bin/kubeadm
执行kubeadm config images list
会列出所有镜像
kubeadm config images list
#列出的镜像列表
registry.k8s.io/kube-apiserver:v1.28.0
registry.k8s.io/kube-controller-manager:v1.28.0
registry.k8s.io/kube-scheduler:v1.28.0
registry.k8s.io/kube-proxy:v1.28.0
registry.k8s.io/pause:3.9
registry.k8s.io/etcd:3.5.9-0
registry.k8s.io/coredns/coredns:v1.10.1
拉取全部镜像kubeadm config images pull
kubeadm config images pull
#拉去完成的提示:
[config/images] Pulled registry.k8s.io/kube-apiserver:v1.28.3
[config/images] Pulled registry.k8s.io/kube-controller-manager:v1.28.3
[config/images] Pulled registry.k8s.io/kube-scheduler:v1.28.3
[config/images] Pulled registry.k8s.io/kube-proxy:v1.28.3
[config/images] Pulled registry.k8s.io/pause:3.9
[config/images] Pulled registry.k8s.io/etcd:3.5.9-0
[config/images] Pulled registry.k8s.io/coredns/coredns:v1.10.1
等待…可能会很长时间,网速快好很多。
镜像拉取完成后,进行集群初始化,初始化只有Master需要执行
master节点执行初始化命令:bash kubeadm init --kubernetes-version=v1.28.0 --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.31.150 --cri-socket unix:///var/run/containerd/containerd.sock
如果只用Containerd,不用docker,可以不加–cri-socket unix:///var/run/containerd/containerd.sock
在Kubernetes(通常简称为K8s)中,–cri-socket 参数用于指定容器运行时(Container Runtime Interface,CRI)的套接字地址。CRI是Kubernetes与容器运行时之间的接口,允许Kubernetes与不同的容器运行时进行通信,如Docker、containerd等。
[root@k8s-master01 ~]# kubeadm init --kubernetes-version=v1.28.0 --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.31.150 --cri-socket unix:///var/run/containerd/containerd.sock
#初始化结果输出内容:
[init] Using Kubernetes version: v1.28.0
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [k8s-master01 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.31.150]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [k8s-master01 localhost] and IPs [192.168.31.150 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [k8s-master01 localhost] and IPs [192.168.31.150 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[kubelet-check] Initial timeout of 40s passed.
[apiclient] All control plane components are healthy after 103.502051 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node k8s-master01 as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node k8s-master01 as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule]
[bootstrap-token] Using token: 2n0t62.gvuu8x3zui9o8xnc
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.31.150:6443 --token 2n0t62.gvuu8x3zui9o8xnc \
--discovery-token-ca-cert-hash sha256:d294c082cc7e0d5f620fb10e527a8a7cb4cb6ccd8dc45ffaf2cddd9bd3016695
在master节点初始化完成后,worker或node节点需要加入集群,通过master初始化生成的token作为命令。
如上述master初始化完成最后两行,复制到worker节点执行 kubeadm join 192.168.31.150:6443 --token 2n0t62.gvuu8x3zui9o8xnc \ --discovery-token-ca-cert-hash sha256:d294c082cc7e0d5f620fb10e527a8a7cb4cb6
worker工作节点加入集群后,稍微等待,可以在master节点通过kubectl get nodes
获取worker节点是否加入,如下,可以看到master和worker都存在即为正常现象。
[root@k8s-master01 ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master01 NotReady control-plane 30m v1.28.2
k8s-worker01 NotReady <none> 19m v1.28.2
k8s-worker02 NotReady <none> 18m v1.28.2
master执行kubectl get nodes
报错
master执行如下配置,修正配置文件的路径:
配置 Kubernetes 客户端,使其能够连接到你的 Kubernetes 集群,并使用相应的管理员权限进行操作
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
完毕后,再次执行kubectl get nodes
验证
如有配置修改证书,可以通过以下方式验证证书的有效期:
[root@k8s-master01 ~]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep ' Not '
Not Before: Nov 14 08:10:42 2023 GMT
Not After : Oct 21 08:15:42 2123 GMT
[root@k8s-master01 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Oct 21, 2123 08:15 UTC 99y ca no
apiserver Oct 21, 2123 08:15 UTC 99y ca no
apiserver-etcd-client Oct 21, 2123 08:15 UTC 99y etcd-ca no
apiserver-kubelet-client Oct 21, 2123 08:15 UTC 99y ca no
controller-manager.conf Oct 21, 2123 08:15 UTC 99y ca no
etcd-healthcheck-client Oct 21, 2123 08:15 UTC 99y etcd-ca no
etcd-peer Oct 21, 2123 08:15 UTC 99y etcd-ca no
etcd-server Oct 21, 2123 08:15 UTC 99y etcd-ca no
front-proxy-client Oct 21, 2123 08:15 UTC 99y front-proxy-ca no
scheduler.conf Oct 21, 2123 08:15 UTC 99y ca no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Oct 21, 2123 08:15 UTC 99y no
etcd-ca Oct 21, 2123 08:15 UTC 99y no
front-proxy-ca Oct 21, 2123 08:15 UTC 99y no
calico访问链接:https://projectcalico.docs.tigera.io/about/about-calico
下载安装和配置Calico,使其能够为集群提供网络功能。
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/tigera-operator.yaml
下载Calico 安装的配置信息,YAML 文件通常包含 :例如网络CIDR、节点选择器、Encapsulation设置等
wget https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/custom-resources.yaml
vim custom-resources.yaml
修改Calico安装配置文件中的cidr字段,将其更改为初始Pod网络CIDR。以下是修改后的YAML配置示例:
# This section includes base Calico installation configuration.
# For more information, see: https://projectcalico.docs.tigera.io/master/reference/installation/api#operator.tigera.io/v1.Installation
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
name: default
spec:
# Configures Calico networking.
calicoNetwork:
# Note: The ipPools section cannot be modified post-install.
ipPools:
- blockSize: 26
cidr: 10.244.0.0/16 修改此行内容为初始化时定义的pod network cidr
encapsulation: VXLANCrossSubnet
natOutgoing: Enabled
nodeSelector: all()
---
# This section configures the Calico API server.
# For more information, see: https://projectcalico.docs.tigera.io/master/reference/installation/api#operator.tigera.io/v1.APIServer
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
name: default
spec: {}
使用kubectl create -f custom-resources.yaml
命令创建了两个Kubernetes自定义资源(Custom Resource,CR)的实例
kubectl create -f custom-resources.yaml
installation.operator.tigera.io/default created
apiserver.operator.tigera.io/default created
kubectl get pods -n calico-system
查看calico-system 命名空间中运行的所有 Pod 的信息
所有 Pod 都处于 Running 状态,表示它们都正常运行。如果有 Pod 处于 Pending 或 Error 状态,可能需要进一步调查和解决问题。
[root@k8s-master01 ~]# kubectl get pods -n calico-system
NAME READY STATUS RESTARTS AGE
calico-kube-controllers-7dbdcfcfcb-gv74j 1/1 Running 0 120m
calico-node-7k2dq 1/1 Running 7 (107m ago) 120m
calico-node-bf8kk 1/1 Running 7 (108m ago) 120m
calico-node-xbh6b 1/1 Running 7 (107m ago) 120m
calico-typha-9477d4bb6-lcv9f 1/1 Running 0 120m
calico-typha-9477d4bb6-wf4hn 1/1 Running 0 120m
csi-node-driver-44vt4 2/2 Running 0 120m
csi-node-driver-6867q 2/2 Running 0 120m
csi-node-driver-x96sz 2/2 Running 0 120m
以下是calico-system 命名空间各个 Pod 的解释:
calico-kube-controllers-7dbdcfcfcb-gv74j
#Calico 的控制器 Pod,负责处理网络策略和其他控制平面功能。
calico-node-7k2dq, calico-node-bf8kk, calico-node-xbh6b
#这些是 Calico 的节点 Pod,负责在每个节点上运行的工作负载。
#在这里,有三个节点 (calico-node-7k2dq, calico-node-bf8kk, calico-node-xbh6b)。
calico-typha-9477d4bb6-lcv9f, calico-typha-9477d4bb6-wf4hn
#这是 Typha Pod,用于处理 Calico 网络中的数据平面流量。
csi-node-driver-44vt4, csi-node-driver-6867q, csi-node-driver-x96sz
#这些是 CSI(Container Storage Interface)节点驱动程序的 Pods。它们可能与存储卷相关的功能有关。
完结~emmm