Kubernetes实战(八)——Master节点部署

◎部署组件

Kubernetes实战(八)——Master节点部署

◎Master各组件作用

Kubernetes实战(八)——Master节点部署

部署Kubernetes API服务部署

1.准备软件包

[root@linux-node1 ~]# cd /usr/local/src/kubernetes/server/bin
[root@linux-node1 kubernetes]# cp kube-apiserver kube-controller-manager kube-scheduler /opt/kubernetes/bin/

2.创建生成CSR的 JSON 配置文件

[root@linux-node1 ssl]# cat > kubernetes-csr.json <<EOF
{
 "CN": "kubernetes",
 "hosts": [
   "127.0.0.1",
   "192.168.56.11",
   "10.1.0.1",
   "kubernetes",
   "kubernetes.default",
   "kubernetes.default.svc",
   "kubernetes.default.svc.cluster",
   "kubernetes.default.svc.cluster.local"
 ],
 "key": {
   "algo": "rsa",
   "size": 2048
 },
 "names": [
   {
     "C": "CN",
     "ST": "BeiJing",
     "L": "BeiJing",
     "O": "k8s",
     "OU": "System"
   }
 ]
}
EOF

3.生成 kubernetes 证书和私钥

[root@linux-node1 ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
  -ca-key=/opt/kubernetes/ssl/ca-key.pem \
  -config=/opt/kubernetes/ssl/ca-config.json \
  -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
[root@linux-node1 ssl]# ll  kubernetes*.pem
-rw------- 1 root root 1679 Sep 23 12:58 kubernetes-key.pem
-rw-r--r-- 1 root root 1610 Sep 23 12:58 kubernetes.pem
[root@linux-node1 ssl]# cp kubernetes*.pem /opt/kubernetes/ssl/
[root@linux-node1 ssl]# scp kubernetes*.pem 192.168.56.12:/opt/kubernetes/ssl/
[root@linux-node1 ssl]# scp kubernetes*.pem 192.168.56.13:/opt/kubernetes/ssl/

4.创建 kube-apiserver 使用的客户端 token 文件

[root@linux-node1 ssl]#  head -c 16 /dev/urandom | od -An -t x | tr -d ' '
ad6d5bb607a186796d8861557df0d17f
[root@linux-node1 ssl]# cat > /opt/kubernetes/ssl/bootstrap-token.csv <<EOF
ad6d5bb607a186796d8861557df0d17f,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
EOF

5.创建基础用户名/密码认证配置

[root@linux-node1 ~]# cat > /opt/kubernetes/ssl/basic-auth.csv <<EOF
admin,admin,1
readonly,readonly,2
EOF

6.部署Kubernetes API Server

[root@linux-node1 ~]# cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target

[Service]
ExecStart=/opt/kubernetes/bin/kube-apiserver \
 --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
 --bind-address=192.168.56.11 \
 --insecure-bind-address=127.0.0.1 \
 --authorization-mode=Node,RBAC \
 --runtime-config=rbac.authorization.k8s.io/v1 \
 --kubelet-https=true \
 --anonymous-auth=false \
 --basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv \
 --enable-bootstrap-token-auth \
 --token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv \
 --service-cluster-ip-range=10.1.0.0/16 \
 --service-node-port-range=20000-40000 \
 --tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem \
 --tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem \
 --client-ca-file=/opt/kubernetes/ssl/ca.pem \
 --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \
 --etcd-cafile=/opt/kubernetes/ssl/ca.pem \
 --etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem \
 --etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem \
 --etcd-servers=https://192.168.56.11:2379,https://192.168.56.12:2379,https://192.168.56.13:2379 \
 --enable-swagger-ui=true \
 --allow-privileged=true \
 --audit-log-maxage=30 \
 --audit-log-maxbackup=3 \
 --audit-log-maxsize=100 \
 --audit-log-path=/opt/kubernetes/log/api-audit.log \
 --event-ttl=1h \
 --v=2 \
 --logtostderr=false \
 --log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

7.启动API Server服务

[root@linux-node1 ~]# systemctl daemon-reload && systemctl enable kube-apiserver && systemctl start kube-apiserver

查看API Server服务状态

[root@linux-node1 ~]# systemctl status kube-apiserver
[root@linux-node1 ~]# netstat -tunpl|grep kube
tcp        0      0 192.168.56.11:6443      0.0.0.0:*               LISTEN      2120/kube-apiserver
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      2120/kube-apiserver

部署Controller Manager服务

[root@linux-node1 ~]# cat > /usr/lib/systemd/system/kube-controller-manager.service <<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-controller-manager \
 --address=127.0.0.1 \
 --master=http://127.0.0.1:8080 \
 --allocate-node-cidrs=true \
 --service-cluster-ip-range=10.1.0.0/16 \
 --cluster-cidr=10.2.0.0/16 \
 --cluster-name=kubernetes \
 --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \
 --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \
 --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \
 --root-ca-file=/opt/kubernetes/ssl/ca.pem \
 --leader-elect=true \
 --v=2 \
 --logtostderr=false \
 --log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

1.启动Controller Manager

[root@linux-node1 ~]# systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl start kube-controller-manager

2.查看服务状态

[root@linux-node1 ssl]# systemctl status kube-controller-manager
[root@linux-node1 ssl]# netstat -tunpl|grep kube-controlle
tcp        0      0 127.0.0.1:10252         0.0.0.0:*               LISTEN      2174/kube-controlle



部署Kubernetes Scheduler

[root@linux-node1 ~]# cat > /usr/lib/systemd/system/kube-scheduler.service <<EOF
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-scheduler \
 --address=127.0.0.1 \
 --master=http://127.0.0.1:8080 \
 --leader-elect=true \
 --v=2 \
 --logtostderr=false \
 --log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

1.部署服务

[root@linux-node1 ~]# systemctl daemon-reload && systemctl enable kube-scheduler && systemctl start kube-scheduler && systemctl status kube-scheduler
[root@linux-node1 ssl]# netstat -tunpl|grep kube-scheduler
tcp        0      0 127.0.0.1:10251         0.0.0.0:*               LISTEN      2232/kube-scheduler



部署kubectl 命令行工具

1.准备二进制命令包

[root@linux-node1 ~]# cp /usr/local/src/kubernetes/client/bin/kubectl /opt/kubernetes/bin/

2.创建 admin 证书签名请求

[root@linux-node1 ~]# cd /usr/local/src/ssl/
[root@linux-node1 ssl]# cat > admin-csr.json <<EOF
{
 "CN": "admin",
 "hosts": [],
 "key": {
   "algo": "rsa",
   "size": 2048
 },
 "names": [
   {
     "C": "CN",
     "ST": "BeiJing",
     "L": "BeiJing",
     "O": "system:masters",
     "OU": "System"
   }
 ]
}
EOF

3.生成 admin 证书和私钥:

[root@linux-node1 ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
  -ca-key=/opt/kubernetes/ssl/ca-key.pem \
  -config=/opt/kubernetes/ssl/ca-config.json \
  -profile=kubernetes admin-csr.json | cfssljson -bare admin
[root@linux-node1 ssl]# ls -l admin*
-rw-r--r-- 1 root root 1009 Sep 23 13:13 admin.csr
-rw-r--r-- 1 root root  229 Sep 23 13:13 admin-csr.json
-rw------- 1 root root 1679 Sep 23 13:13 admin-key.pem
-rw-r--r-- 1 root root 1399 Sep 23 13:13 admin.pem

[root@linux-node1 ssl]# mv admin*.pem /opt/kubernetes/ssl/

4.设置集群参数

[root@linux-node1 ssl]# kubectl config set-cluster kubernetes \
  --certificate-authority=/opt/kubernetes/ssl/ca.pem \
  --embed-certs=true \
  --server=https://192.168.56.11:6443
Cluster "kubernetes" set.

5.设置客户端认证参数

[root@linux-node1 ssl]# kubectl config set-credentials admin \
  --client-certificate=/opt/kubernetes/ssl/admin.pem \
  --embed-certs=true \
  --client-key=/opt/kubernetes/ssl/admin-key.pem
User "admin" set.

6.设置上下文参数

[root@linux-node1 src]# kubectl config set-context kubernetes \
  --cluster=kubernetes \
  --user=admin
Context "kubernetes" created.

7.设置默认上下文

[root@linux-node1 src]# kubectl config use-context kubernetes
Switched to context "kubernetes".
最后会在家目录下生成.kube/config认证文件,若别的节点想运行kubectl命令需拷贝此文件
[root@linux-node1 ssl]# cat ~/.kube/config
apiVersion: v1
clusters:
- cluster:
   certificate-authority-data:
   LS0tLS1CRUdJTiB...
   server: https://192.168.56.11:6443
 name: kubernetes
contexts:
- context:
   cluster: kubernetes
   user: admin
 name: kubernetes
current-context: kubernetes
kind: Config
preferences: {}
users:
- name: admin
 user:
   client-certificate-data: LS0tLS1CRUdJT...
   client-key-data: LS0tLS1C...

8.使用kubectl工具

[root@linux-node1 ssl]# kubectl get cs
NAME                 STATUS    MESSAGE              ERROR
controller-manager   Healthy   ok                  
scheduler            Healthy   ok                  
etcd-2               Healthy   {"health": "true"}  
etcd-0               Healthy   {"health": "true"}  
etcd-1               Healthy   {"health": "true"}


anzhihe 安志合个人博客,版权所有 丨 如未注明,均为原创 丨 转载请注明转自:https://chegva.com/3051.html | ☆★★每天进步一点点,加油!★★☆ | 

您可能还感兴趣的文章!

发表评论

电子邮件地址不会被公开。 必填项已用*标注