◎部署组件
◎Master各组件作用
部署Kubernetes API服务部署
1.准备软件包
[root@linux-node1 ~]# cd /usr/local/src/kubernetes/server/bin [root@linux-node1 kubernetes]# cp kube-apiserver kube-controller-manager kube-scheduler /opt/kubernetes/bin/
2.创建生成CSR的 JSON 配置文件
[root@linux-node1 ssl]# cat > kubernetes-csr.json <<EOF
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"192.168.56.11",
"10.1.0.1",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF3.生成 kubernetes 证书和私钥
[root@linux-node1 ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \ -ca-key=/opt/kubernetes/ssl/ca-key.pem \ -config=/opt/kubernetes/ssl/ca-config.json \ -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes [root@linux-node1 ssl]# ll kubernetes*.pem -rw------- 1 root root 1679 Sep 23 12:58 kubernetes-key.pem -rw-r--r-- 1 root root 1610 Sep 23 12:58 kubernetes.pem [root@linux-node1 ssl]# cp kubernetes*.pem /opt/kubernetes/ssl/ [root@linux-node1 ssl]# scp kubernetes*.pem 192.168.56.12:/opt/kubernetes/ssl/ [root@linux-node1 ssl]# scp kubernetes*.pem 192.168.56.13:/opt/kubernetes/ssl/
4.创建 kube-apiserver 使用的客户端 token 文件
[root@linux-node1 ssl]# head -c 16 /dev/urandom | od -An -t x | tr -d ' ' ad6d5bb607a186796d8861557df0d17f [root@linux-node1 ssl]# cat > /opt/kubernetes/ssl/bootstrap-token.csv <<EOF ad6d5bb607a186796d8861557df0d17f,kubelet-bootstrap,10001,"system:kubelet-bootstrap" EOF
5.创建基础用户名/密码认证配置
[root@linux-node1 ~]# cat > /opt/kubernetes/ssl/basic-auth.csv <<EOF admin,admin,1 readonly,readonly,2 EOF
6.部署Kubernetes API Server
[root@linux-node1 ~]# cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF [Unit] Description=Kubernetes API Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes After=network.target [Service] ExecStart=/opt/kubernetes/bin/kube-apiserver \ --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \ --bind-address=192.168.56.11 \ --insecure-bind-address=127.0.0.1 \ --authorization-mode=Node,RBAC \ --runtime-config=rbac.authorization.k8s.io/v1 \ --kubelet-https=true \ --anonymous-auth=false \ --basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv \ --enable-bootstrap-token-auth \ --token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv \ --service-cluster-ip-range=10.1.0.0/16 \ --service-node-port-range=20000-40000 \ --tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem \ --tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem \ --client-ca-file=/opt/kubernetes/ssl/ca.pem \ --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \ --etcd-cafile=/opt/kubernetes/ssl/ca.pem \ --etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem \ --etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem \ --etcd-servers=https://192.168.56.11:2379,https://192.168.56.12:2379,https://192.168.56.13:2379 \ --enable-swagger-ui=true \ --allow-privileged=true \ --audit-log-maxage=30 \ --audit-log-maxbackup=3 \ --audit-log-maxsize=100 \ --audit-log-path=/opt/kubernetes/log/api-audit.log \ --event-ttl=1h \ --v=2 \ --logtostderr=false \ --log-dir=/opt/kubernetes/log Restart=on-failure RestartSec=5 Type=notify LimitNOFILE=65536 [Install] WantedBy=multi-user.target EOF
7.启动API Server服务
[root@linux-node1 ~]# systemctl daemon-reload && systemctl enable kube-apiserver && systemctl start kube-apiserver
查看API Server服务状态
[root@linux-node1 ~]# systemctl status kube-apiserver [root@linux-node1 ~]# netstat -tunpl|grep kube tcp 0 0 192.168.56.11:6443 0.0.0.0:* LISTEN 2120/kube-apiserver tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 2120/kube-apiserver
部署Controller Manager服务
[root@linux-node1 ~]# cat > /usr/lib/systemd/system/kube-controller-manager.service <<EOF [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/opt/kubernetes/bin/kube-controller-manager \ --address=127.0.0.1 \ --master=http://127.0.0.1:8080 \ --allocate-node-cidrs=true \ --service-cluster-ip-range=10.1.0.0/16 \ --cluster-cidr=10.2.0.0/16 \ --cluster-name=kubernetes \ --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \ --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \ --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \ --root-ca-file=/opt/kubernetes/ssl/ca.pem \ --leader-elect=true \ --v=2 \ --logtostderr=false \ --log-dir=/opt/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF
1.启动Controller Manager
[root@linux-node1 ~]# systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl start kube-controller-manager
2.查看服务状态
[root@linux-node1 ssl]# systemctl status kube-controller-manager [root@linux-node1 ssl]# netstat -tunpl|grep kube-controlle tcp 0 0 127.0.0.1:10252 0.0.0.0:* LISTEN 2174/kube-controlle
部署Kubernetes Scheduler
[root@linux-node1 ~]# cat > /usr/lib/systemd/system/kube-scheduler.service <<EOF [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/opt/kubernetes/bin/kube-scheduler \ --address=127.0.0.1 \ --master=http://127.0.0.1:8080 \ --leader-elect=true \ --v=2 \ --logtostderr=false \ --log-dir=/opt/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF
1.部署服务
[root@linux-node1 ~]# systemctl daemon-reload && systemctl enable kube-scheduler && systemctl start kube-scheduler && systemctl status kube-scheduler [root@linux-node1 ssl]# netstat -tunpl|grep kube-scheduler tcp 0 0 127.0.0.1:10251 0.0.0.0:* LISTEN 2232/kube-scheduler
部署kubectl 命令行工具
1.准备二进制命令包
[root@linux-node1 ~]# cp /usr/local/src/kubernetes/client/bin/kubectl /opt/kubernetes/bin/
2.创建 admin 证书签名请求
[root@linux-node1 ~]# cd /usr/local/src/ssl/
[root@linux-node1 ssl]# cat > admin-csr.json <<EOF
{
"CN": "admin",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:masters",
"OU": "System"
}
]
}
EOF3.生成 admin 证书和私钥：
[root@linux-node1 ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \ -ca-key=/opt/kubernetes/ssl/ca-key.pem \ -config=/opt/kubernetes/ssl/ca-config.json \ -profile=kubernetes admin-csr.json | cfssljson -bare admin [root@linux-node1 ssl]# ls -l admin* -rw-r--r-- 1 root root 1009 Sep 23 13:13 admin.csr -rw-r--r-- 1 root root 229 Sep 23 13:13 admin-csr.json -rw------- 1 root root 1679 Sep 23 13:13 admin-key.pem -rw-r--r-- 1 root root 1399 Sep 23 13:13 admin.pem [root@linux-node1 ssl]# mv admin*.pem /opt/kubernetes/ssl/
4.设置集群参数
[root@linux-node1 ssl]# kubectl config set-cluster kubernetes \ --certificate-authority=/opt/kubernetes/ssl/ca.pem \ --embed-certs=true \ --server=https://192.168.56.11:6443 Cluster "kubernetes" set.
5.设置客户端认证参数
[root@linux-node1 ssl]# kubectl config set-credentials admin \ --client-certificate=/opt/kubernetes/ssl/admin.pem \ --embed-certs=true \ --client-key=/opt/kubernetes/ssl/admin-key.pem User "admin" set.
6.设置上下文参数
[root@linux-node1 src]# kubectl config set-context kubernetes \ --cluster=kubernetes \ --user=admin Context "kubernetes" created.
7.设置默认上下文
[root@linux-node1 src]# kubectl config use-context kubernetes
Switched to context "kubernetes".
最后会在家目录下生成.kube/config认证文件，若别的节点想运行kubectl命令需拷贝此文件
[root@linux-node1 ssl]# cat ~/.kube/config
apiVersion: v1
clusters:
- cluster:
certificate-authority-data:
LS0tLS1CRUdJTiB．．．
server: https://192.168.56.11:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: admin
name: kubernetes
current-context: kubernetes
kind: Config
preferences: {}
users:
- name: admin
user:
client-certificate-data: LS0tLS1CRUdJT．．．
client-key-data: LS0tLS1C．．．8.使用kubectl工具
[root@linux-node1 ssl]# kubectl get cs
NAME STATUS MESSAGE ERROR
controller-manager Healthy ok
scheduler Healthy ok
etcd-2 Healthy {"health": "true"}
etcd-0 Healthy {"health": "true"}
etcd-1 Healthy {"health": "true"}
