AI 助理
备案控制台
开发者社区 云原生 文章 正文

云原生|kubernetes|minikube的部署安装完全手册（修订版）（二）

2022-11-09 553
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： 云原生|kubernetes|minikube的部署安装完全手册（修订版）

（1）关于kubeadmin，kubelet，kubectl这三个命令的缓存：

    > kubectl.sha256:  65 B / 65 B [-------------------------] 100.00% ? p/s 0s
    > kubelet:  108.05 MiB / 108.05 MiB [--------] 100.00% 639.49 KiB p/s 2m53s

这几个命令是下载到/root/.minikube/cache/linux/amd64/v1.18.8/这个目录下的，因此，想要提高速度，离线化部署就需要这么做：

建立以上的目录：

mkdir -p /root/.minikube/cache/linux/amd64/v1.18.8/

给文件赋予权限并拷贝文件到这个目录下：

chmod a+x kube*  #赋予权限
[root@node3 v1.18.8]# pwd
/root/.minikube/cache/linux/amd64/v1.18.8
[root@slave3 v1.18.8]# ll
total 192544
-rwxr-xr-x 1 root root  39821312 Sep 11 11:24 kubeadm
-rwxr-xr-x 1 root root  44040192 Sep 11 11:24 kubectl
-rwxr-xr-x 1 root root 113300248 Sep 11 11:26 kubelet

（2）集群健康检查报错的解决方案：

[root@slave3 ~]# kubectl get cs
NAME                 STATUS      MESSAGE                                                                                     ERROR
controller-manager   Unhealthy   Get http://127.0.0.1:10252/healthz: dial tcp 127.0.0.1:10252: connect: connection refused   
scheduler            Unhealthy   Get http://127.0.0.1:10251/healthz: dial tcp 127.0.0.1:10251: connect: connection refused   
etcd-0               Healthy     {"health":"true"}

解决方案：

删除/etc/kubernetes/manifests/kube-scheduler.yaml和/etc/kubernetes/manifests/kube-controller-manager.yaml两个文件内的--port=0 这个字段

稍等片刻，再次查询就正常了：

[root@slave3 ~]# kubectl get cs
NAME                 STATUS    MESSAGE             ERROR
controller-manager   Healthy   ok                  
scheduler            Healthy   ok                  
etcd-0               Healthy   {"health":"true"}

三，dashboard的安装

[root@slave3 ~]# minikube dashboard
* Enabling dashboard ...
  - Using image kubernetesui/metrics-scraper:v1.0.8
  - Using image kubernetesui/dashboard:v2.6.0
* Verifying dashboard health ...
* Launching proxy ...
* Verifying proxy health ...
http://127.0.0.1:32844/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/

设置代理：

[root@slave3 v1.18.8]# kubectl proxy --port=45396 --address='0.0.0.0' --disable-filter=true --accept-hosts='^.*' 
W0911 12:49:38.664081    8709 proxy.go:167] Request filter disabled, your proxy is vulnerable to XSRF attacks, please be cautious
Starting to serve on [::]:45396

浏览器登录网址：

本机IP是192.168.217.11，和上面的http://127.0.0.1:32844/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/

拼接就好了

http://192.168.217.11:45396/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/

e693485c8668497882b9df08e639a065.png

至此，minikube就安装完了。

附录：

关于addons

可以看到有安装StorageClass，但很多addons还没有安装

[root@slave3 v1.18.8]# minikube addons list
|-----------------------------|----------|--------------|--------------------------------|
|         ADDON NAME          | PROFILE  |    STATUS    |           MAINTAINER           |
|-----------------------------|----------|--------------|--------------------------------|
| ambassador                  | minikube | disabled     | 3rd party (Ambassador)         |
| auto-pause                  | minikube | disabled     | Google                         |
| csi-hostpath-driver         | minikube | disabled     | Kubernetes                     |
| dashboard                   | minikube | enabled ✅   | Kubernetes                     |
| default-storageclass        | minikube | enabled ✅   | Kubernetes                     |
| efk                         | minikube | disabled     | 3rd party (Elastic)            |
| freshpod                    | minikube | disabled     | Google                         |
| gcp-auth                    | minikube | disabled     | Google                         |
| gvisor                      | minikube | disabled     | Google                         |
| headlamp                    | minikube | disabled     | 3rd party (kinvolk.io)         |
| helm-tiller                 | minikube | disabled     | 3rd party (Helm)               |
| inaccel                     | minikube | disabled     | 3rd party (InAccel             |
|                             |          |              | [info@inaccel.com])            |
| ingress                     | minikube | disabled     | Kubernetes                     |
| ingress-dns                 | minikube | disabled     | Google                         |
| istio                       | minikube | disabled     | 3rd party (Istio)              |
| istio-provisioner           | minikube | disabled     | 3rd party (Istio)              |
| kong                        | minikube | disabled     | 3rd party (Kong HQ)            |
| kubevirt                    | minikube | disabled     | 3rd party (KubeVirt)           |
| logviewer                   | minikube | disabled     | 3rd party (unknown)            |
| metallb                     | minikube | disabled     | 3rd party (MetalLB)            |
| metrics-server              | minikube | disabled     | Kubernetes                     |
| nvidia-driver-installer     | minikube | disabled     | Google                         |
| nvidia-gpu-device-plugin    | minikube | disabled     | 3rd party (Nvidia)             |
| olm                         | minikube | disabled     | 3rd party (Operator Framework) |
| pod-security-policy         | minikube | disabled     | 3rd party (unknown)            |
| portainer                   | minikube | disabled     | 3rd party (Portainer.io)       |
| registry                    | minikube | disabled     | Google                         |
| registry-aliases            | minikube | disabled     | 3rd party (unknown)            |
| registry-creds              | minikube | disabled     | 3rd party (UPMC Enterprises)   |
| storage-provisioner         | minikube | enabled ✅   | Google                         |
| storage-provisioner-gluster | minikube | disabled     | 3rd party (Gluster)            |
| volumesnapshots             | minikube | disabled     | Kubernetes                     |
|-----------------------------|----------|--------------|--------------------------------|

以安装ingress为例（安装的同时，输出安装的错误日志）：

[root@slave3 v1.18.8]# minikube addons enable ingress --alsologtostderr
I0911 13:09:08.559523   14428 out.go:296] Setting OutFile to fd 1 ...
I0911 13:09:08.572541   14428 out.go:343] TERM=xterm,COLORTERM=, which probably does not support color
I0911 13:09:08.572593   14428 out.go:309] Setting ErrFile to fd 2...
I0911 13:09:08.572609   14428 out.go:343] TERM=xterm,COLORTERM=, which probably does not support color
I0911 13:09:08.572908   14428 root.go:333] Updating PATH: /root/.minikube/bin
I0911 13:09:08.577988   14428 out.go:177] * ingress is an addon maintained by Kubernetes. For any concerns contact minikube on GitHub.
You can view the list of minikube maintainers at: https://github.com/kubernetes/minikube/blob/master/OWNERS
* ingress is an addon maintained by Kubernetes. For any concerns contact minikube on GitHub.
You can view the list of minikube maintainers at: https://github.com/kubernetes/minikube/blob/master/OWNERS
I0911 13:09:08.580137   14428 config.go:180] Loaded profile config "minikube": Driver=none, ContainerRuntime=docker, KubernetesVersion=v1.18.8
I0911 13:09:08.580198   14428 addons.go:65] Setting ingress=true in profile "minikube"
I0911 13:09:08.580243   14428 addons.go:153] Setting addon ingress=true in "minikube"
I0911 13:09:08.580572   14428 host.go:66] Checking if "minikube" exists ...
I0911 13:09:08.581080   14428 exec_runner.go:51] Run: systemctl --version
I0911 13:09:08.584877   14428 kubeconfig.go:92] found "minikube" server: "https://192.168.217.136:8443"
I0911 13:09:08.584942   14428 api_server.go:165] Checking apiserver status ...
I0911 13:09:08.584982   14428 exec_runner.go:51] Run: sudo pgrep -xnf kube-apiserver.*minikube.*
I0911 13:09:08.611630   14428 exec_runner.go:51] Run: sudo egrep ^[0-9]+:freezer: /proc/15576/cgroup
I0911 13:09:08.626851   14428 api_server.go:181] apiserver freezer: "9:freezer:/kubepods/burstable/pod1a4a24f29bac3cef528a8b328b9798b5/c8a589a612154591de984664d86a3ad96a449f3d0b1145527ceea9c5ed267124"
I0911 13:09:08.626952   14428 exec_runner.go:51] Run: sudo cat /sys/fs/cgroup/freezer/kubepods/burstable/pod1a4a24f29bac3cef528a8b328b9798b5/c8a589a612154591de984664d86a3ad96a449f3d0b1145527ceea9c5ed267124/freezer.state
I0911 13:09:08.638188   14428 api_server.go:203] freezer state: "THAWED"
I0911 13:09:08.638329   14428 api_server.go:240] Checking apiserver healthz at https://192.168.217.136:8443/healthz ...
I0911 13:09:08.649018   14428 api_server.go:266] https://192.168.217.136:8443/healthz returned 200:
ok
I0911 13:09:08.650082   14428 out.go:177]   - Using image k8s.gcr.io/ingress-nginx/controller:v0.49.3
  - Using image k8s.gcr.io/ingress-nginx/controller:v0.49.3
I0911 13:09:08.652268   14428 out.go:177]   - Using image docker.io/jettech/kube-webhook-certgen:v1.5.1
  - Using image docker.io/jettech/kube-webhook-certgen:v1.5.1
I0911 13:09:08.653129   14428 out.go:177]   - Using image docker.io/jettech/kube-webhook-certgen:v1.5.1
  - Using image docker.io/jettech/kube-webhook-certgen:v1.5.1
I0911 13:09:08.654440   14428 addons.go:345] installing /etc/kubernetes/addons/ingress-deploy.yaml
I0911 13:09:08.654528   14428 exec_runner.go:151] cp: memory --> /etc/kubernetes/addons/ingress-deploy.yaml (15118 bytes)
I0911 13:09:08.654720   14428 exec_runner.go:51] Run: sudo cp -a /tmp/minikube4099945938 /etc/kubernetes/addons/ingress-deploy.yaml
I0911 13:09:08.668351   14428 exec_runner.go:51] Run: sudo KUBECONFIG=/var/lib/minikube/kubeconfig /var/lib/minikube/binaries/v1.18.8/kubectl apply -f /etc/kubernetes/addons/ingress-deploy.yaml
I0911 13:09:09.748481   14428 exec_runner.go:84] Completed: sudo KUBECONFIG=/var/lib/minikube/kubeconfig /var/lib/minikube/binaries/v1.18.8/kubectl apply -f /etc/kubernetes/addons/ingress-deploy.yaml: (1.080019138s)
I0911 13:09:09.748552   14428 addons.go:383] Verifying addon ingress=true in "minikube"
I0911 13:09:09.751805   14428 out.go:177] * Verifying ingress addon...

可以看到，安装的时候使用的资源清单文件是这个：

sudo KUBECONFIG=/var/lib/minikube/kubeconfig /var/lib/minikube/binaries/v1.18.8/kubectl apply -f /etc/kubernetes/addons/ingress-deploy.yaml

该文件内容非常多，但，由于是使用的国外的镜像网址，因此，一般是不会安装成功的。

解决方案为查找里面涉及的images，替换为国内可下载的镜像即可。

还有一个权限问题，可能会报错：

F0911 05:24:52.171825       6 ssl.go:389] unexpected error storing fake SSL Cert: could not create PEM certificate file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem: permission denied

解决方案是：

还是编辑下面这个文件， runAsUser 的值修改为33

重新apply 此文件：

kubectl apply -f /etc/kubernetes/addons/ingress-deploy.yaml

[root@slave3 v1.18.8]# cat /etc/kubernetes/addons/ingress-deploy.yaml
# Copyright 2021 The Kubernetes Authors All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ref: https://github.com/kubernetes/ingress-nginx/blob/main/deploy/static/provider/kind/deploy.yaml
apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
  namespace: ingress-nginx
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
  namespace: ingress-nginx
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - configmaps
  - pods
  - secrets
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resourceNames:
  - ingress-controller-leader
  resources:
  - configmaps
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission
  namespace: ingress-nginx
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - nodes
  - pods
  - secrets
  - namespaces
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - get
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
  namespace: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-nginx
subjects:
- kind: ServiceAccount
  name: ingress-nginx
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission
  namespace: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
  name: ingress-nginx-admission
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingress-nginx
subjects:
- kind: ServiceAccount
  name: ingress-nginx
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
  name: ingress-nginx-admission
  namespace: ingress-nginx
---
apiVersion: v1
data:
  # see https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md for all possible options and their description
  hsts: "false"
  # see https://github.com/kubernetes/minikube/pull/12702#discussion_r727519180: 'allow-snippet-annotations' should be used only if strictly required by another part of the deployment
#  allow-snippet-annotations: "true"
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-controller
  namespace: ingress-nginx
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/component: controller
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: udp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/component: controller
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  - name: https
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-controller-admission
  namespace: ingress-nginx
spec:
  ports:
  - name: https-webhook
    port: 443
    targetPort: webhook
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  minReadySeconds: 0
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
        gcp-auth-skip-secret: "true"
    spec:
      containers:
      - args:
        - /nginx-ingress-controller
        - --election-id=ingress-controller-leader
        - --ingress-class=nginx
        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
        - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
        - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: LD_PRELOAD
          value: /usr/local/lib/libmimalloc.so
        image: k8s.gcr.io/ingress-nginx/controller:v0.49.3@sha256:35fe394c82164efa8f47f3ed0be981b3f23da77175bbb8268a9ae438851c8324
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - /wait-shutdown
        livenessProbe:
          failureThreshold: 5
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: controller
        ports:
        - containerPort: 80
          hostPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          name: https
          protocol: TCP
        - containerPort: 8443
          name: webhook
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          requests:
            cpu: 100m
            memory: 90Mi
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          runAsUser: 101
        volumeMounts:
        - mountPath: /usr/local/certificates/
          name: webhook-cert
          readOnly: true
      dnsPolicy: ClusterFirst
      nodeSelector:
        minikube.k8s.io/primary: "true"
        kubernetes.io/os: linux
      serviceAccountName: ingress-nginx
      terminationGracePeriodSeconds: 0
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Equal
      volumes:
      - name: webhook-cert
        secret:
          secretName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission-create
  namespace: ingress-nginx
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/component: admission-webhook
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
      name: ingress-nginx-admission-create
    spec:
      containers:
      - args:
        - create
        - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
        - --namespace=$(POD_NAMESPACE)
        - --secret-name=ingress-nginx-admission
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: docker.io/jettech/kube-webhook-certgen:v1.5.1@sha256:950833e19ade18cd389d647efb88992a7cc077abedef343fa59e012d376d79b7
        imagePullPolicy: IfNotPresent
        name: create
        securityContext:
          allowPrivilegeEscalation: false
      nodeSelector:
        minikube.k8s.io/primary: "true"
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000
      serviceAccountName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission-patch
  namespace: ingress-nginx
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/component: admission-webhook
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
      name: ingress-nginx-admission-patch
    spec:
      containers:
      - args:
        - patch
        - --webhook-name=ingress-nginx-admission
        - --namespace=$(POD_NAMESPACE)
        - --patch-mutating=false
        - --secret-name=ingress-nginx-admission
        - --patch-failure-policy=Fail
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: docker.io/jettech/kube-webhook-certgen:v1.5.1@sha256:950833e19ade18cd389d647efb88992a7cc077abedef343fa59e012d376d79b7
        imagePullPolicy: IfNotPresent
        name: patch
        securityContext:
          allowPrivilegeEscalation: false
      nodeSelector:
        minikube.k8s.io/primary: "true"
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000
      serviceAccountName: ingress-nginx-admission
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-admission
webhooks:
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: ingress-nginx-controller-admission
      namespace: ingress-nginx
      path: /networking/v1beta1/ingresses
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: validate.nginx.ingress.kubernetes.io
  rules:
  - apiGroups:
    - networking.k8s.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ingresses
  sideEffects: None

安装完毕后可以看到：

[root@slave3 v1.18.8]# kubectl get all -n ingress-nginx
NAME                                            READY   STATUS      RESTARTS   AGE
pod/ingress-nginx-admission-create-n5hc5        0/1     Completed   0          28m
pod/ingress-nginx-admission-patch-cgzl9         0/1     Completed   0          28m
pod/ingress-nginx-controller-54b856d6d7-7fr7q   1/1     Running     0          9m54s
NAME                                         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
service/ingress-nginx-controller             NodePort    10.107.186.74   <none>        80:31411/TCP,443:32683/TCP   28m
service/ingress-nginx-controller-admission   ClusterIP   10.106.184.40   <none>        443/TCP                      28m
NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ingress-nginx-controller   1/1     1            1           28m
NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/ingress-nginx-controller-54b856d6d7   1         1         1       9m54s
replicaset.apps/ingress-nginx-controller-7689b8b4f9   0         0         0       17m
replicaset.apps/ingress-nginx-controller-77cc874b76   0         0         0       28m
NAME                                       COMPLETIONS   DURATION   AGE
job.batch/ingress-nginx-admission-create   1/1           21s        28m
job.batch/ingress-nginx-admission-patch    1/1           22s        28m
[root@slave3 v1.18.8]#

addons里的ingress就安装好啦。

文章标签：
容器服务Kubernetes版
容器
Cloud Native
Linux
Kubernetes
API
缓存
关键词：
云原生部署
容器服务Kubernetes版部署
容器服务Kubernetes版安装
容器服务Kubernetes版云原生
云原生kubernetes部署
相关实践学习
深入解析Docker容器化技术
Docker是一个开源的应用容器引擎，让开发者可以打包他们的应用以及依赖包到一个可移植的容器中，然后发布到任何流行的Linux机器上，也可以实现虚拟化，容器是完全使用沙箱机制，相互之间不会有任何接口。Docker是世界领先的软件容器平台。开发人员利用Docker可以消除协作编码时“在我的机器上可正常工作”的问题。运维人员利用Docker可以在隔离容器中并行运行和管理应用，获得更好的计算密度。企业利用Docker可以构建敏捷的软件交付管道，以更快的速度、更高的安全性和可靠的信誉为Linux和Windows Server应用发布新功能。 在本套课程中，我们将全面的讲解Docker技术栈，从环境安装到容器、镜像操作以及生产环境如何部署开发的微服务应用。本课程由黑马程序员提供。 &nbsp; &nbsp; 相关的阿里云产品：容器服务 ACK 容器服务 Kubernetes 版（简称 ACK）提供高性能可伸缩的容器应用管理能力，支持企业级容器化应用的全生命周期管理。整合阿里云虚拟化、存储、网络和安全能力，打造云端最佳容器化应用运行环境。 了解产品详情: https://www.aliyun.com/product/kubernetes
晚风_END
目录
相关文章
凉凉心.
|
1月前
|
Java Linux 虚拟化
【Docker】（1）Docker的概述与架构，手把手带你安装Docker，云原生路上不可缺少的一门技术！
1. Docker简介 1.1 Docker是什么 为什么docker会出现？ 假定您在开发一款平台项目，您的开发环境具有特定的配置。其他开发人员身处的环境配置也各有不同。 您正在开发的应用依赖于您当前的配置且还要依赖于某些配置文件。 您的企业还拥有标准化的测试和生产环境，且具有自身的配置和一系列支持文件。 **要求：**希望尽可能多在本地模拟这些环境而不产生重新创建服务器环境的开销 问题： 要如何确保应用能够在这些环境中运行和通过质量检测？ 在部署过程中不出现令人头疼的版本、配置问题 无需重新编写代码和进行故障修复
凉凉心.
321 2
云技术达人
|
3月前
|
运维 Dubbo Cloud Native
Dubbo 云原生重构出击：更快部署、更强控制台、更智能运维
Apache Dubbo 最新升级支持云原生，提供一键部署微服务集群与全新可视化控制台，提升全生命周期管理体验，助力企业高效构建云原生应用。
云技术达人
342 25
流水刀客6
|
8月前
|
存储 Kubernetes 开发工具
使用ArgoCD管理Kubernetes部署指南
ArgoCD 是一款基于 Kubernetes 的声明式 GitOps 持续交付工具，通过自动同步 Git 存储库中的配置与 Kubernetes 集群状态，确保一致性与可靠性。它支持实时同步、声明式设置、自动修复和丰富的用户界面，极大简化了复杂应用的部署管理。结合 Helm Charts，ArgoCD 提供模块化、可重用的部署流程，显著减少人工开销和配置错误。对于云原生企业，ArgoCD 能优化部署策略，提升效率与安全性，是实现自动化与一致性的理想选择。
流水刀客6
502 0
阿里云基础设施.
|
7月前
|
存储 Kubernetes 异构计算
Qwen3 大模型在阿里云容器服务上的极简部署教程
通义千问 Qwen3 是 Qwen 系列最新推出的首个混合推理模型，其在代码、数学、通用能力等基准测试中，与 DeepSeek-R1、o1、o3-mini、Grok-3 和 Gemini-2.5-Pro 等顶级模型相比，表现出极具竞争力的结果。
阿里云基础设施.
1324 34
蓝易云
|
8月前
|
存储 Kubernetes 监控
K8s集群实战：使用kubeadm和kuboard部署Kubernetes集群
总之，使用kubeadm和kuboard部署K8s集群就像回归童年一样，简单又有趣。不要忘记，技术是为人服务的，用K8s集群操控云端资源，我们不过是想在复杂的世界找寻简单。尽管部署过程可能遇到困难，但朝着简化复杂的目标，我们就能找到意义和乐趣。希望你也能利用这些工具，找到你的乐趣，满足你的需求。
蓝易云
815 33
蓝易云
|
8月前
|
Kubernetes 开发者 Docker
集群部署：使用Rancher部署Kubernetes集群。
以上就是使用 Rancher 部署 Kubernetes 集群的流程。使用 Rancher 和 Kubernetes，开发者可以受益于灵活性和可扩展性，允许他们在多种环境中运行多种应用，同时利用自动化工具使工作负载更加高效。
蓝易云
481 19
阿里云基础设施.
|
8月前
|
存储 测试技术 对象存储
使用容器服务ACK快速部署QwQ-32B模型并实现推理智能路由
阿里云最新发布的QwQ-32B模型，通过强化学习大幅度提升了模型推理能力。QwQ-32B模型拥有320亿参数，其性能可以与DeepSeek-R1 671B媲美。
阿里云基础设施.
532 16
码农小达人
|
9月前
|
存储 Kubernetes 测试技术
企业级LLM推理部署新范式：基于ACK的DeepSeek蒸馏模型生产环境落地指南
企业级LLM推理部署新范式：基于ACK的DeepSeek蒸馏模型生产环境落地指南
码农小达人
498 12
八进智
|
1月前
|
人工智能 算法 调度
阿里云ACK托管集群Pro版共享GPU调度操作指南
本文介绍在阿里云ACK托管集群Pro版中，如何通过共享GPU调度实现显存与算力的精细化分配，涵盖前提条件、使用限制、节点池配置及任务部署全流程，提升GPU资源利用率，适用于AI训练与推理场景。
八进智
212 1
探索云世界
|
1月前
|
弹性计算 监控 调度
ACK One 注册集群云端节点池升级：IDC 集群一键接入云端 GPU 算力，接入效率提升 80%
ACK One注册集群节点池实现“一键接入”，免去手动编写脚本与GPU驱动安装，支持自动扩缩容与多场景调度，大幅提升K8s集群管理效率。
探索云世界
222 89

热门文章

最新文章

  • 1
    阿里云ACK托管集群Pro版共享GPU调度操作指南
  • 2
    阿里云PolarDB云原生数据库收费价格：MySQL和PostgreSQL详细介绍
  • 3
    2025 云栖精选资料：《从云原生到 AI 原生核心技术与最佳实践》PPT 免费下载
  • 4
    云原生进化论：加速构建 AI 应用
  • 5
    Higress（云原生AI网关） 架构学习指南
  • 6
    云栖重磅｜瑶池数据库：从云原生数据底座向“AI就绪”的多模态数据底座演进
  • 7
    【Docker】（1）Docker的概述与架构，手把手带你安装Docker，云原生路上不可缺少的一门技术！
  • 8
    微服务架构实战指南：从单体应用到云原生的蜕变之路
  • 9
    全栈开发：从LAMP到云原生的技术革命
  • 10
    云计算与云原生技术探索
  • 1
    智联招聘 × 阿里云 ACK One：云端弹性算力颠覆传统 IDC 架构，打造春招技术新范式
    380
  • 2
    KubeRay on ACK：更高效、更安全
    438
  • 3
    从单集群到多集群的快速无损转型：ACK One 多集群应用分发
    322
  • 4
    从单集群到多集群的快速无损转型：ACK One 多集群应用分发
    270
  • 5
    ACK AI Profiling：从黑箱到透明的问题剖析
    451
  • 6
    Qwen3 大模型在阿里云容器服务上的极简部署教程
    1324
  • 7
    突破地域限制，实现算力无限供给 —阿里云ACK One注册集群开启多地域Serverless算力调度
    270
  • 8
    ACK Gateway with Inference Extension：优化多机分布式大模型推理服务实践
    378
  • 9
    突破地域限制，实现算力无限供给 -- 阿里云ACK One注册集群开启多地域Serverless算力调度
    247
  • 10
    容器数据保护：基于容器服务 Kubernetes 版(ACK)备份中心实现K8s存储卷一键备份与恢复
    325

    • 相关课程

    更多
  • 阿里云 EMR on ACK 实战
  • 阿里云K8S微服务部署案例
  • Kubernetes极速入门
  • Serverless 容器从入门到精通: - Serverless Kubernetes
  • Kubernetes云原生管理实践
  • Kubernetes入门

    • 相关电子书

    更多
  • ACK 云原生弹性方案—云原生时代的加速器
  • ACK集群类型选择最佳实践
  • 企业运维之云原生和Kubernetes 实战

    • 推荐镜像

    更多
  • kubernetes
    • 下一篇
    拔俗AI临床大数据科研分析平台：让医学研究更智能、更高效