关于Kubernetes v1.14.0的 kube-controller-manager部署

傷城~ 2021-11-01 10:24 203阅读 0赞

1、 kube-controller-manager准备

默认kube-controller-manager 部署在kube-apiserver部署的服务器上面服务器的配置等在这就不在列出来

二进制文件以及包含在kube-apiserver一起所以不在进行二进制的下载跟分发

2、生成kube-controller-manager访问kube-apiserver 证书

cat << EOF | tee /apps/work/k8s/cfssl/k8s/k8s\_controller\_manager.json

"CN": "system:kube-controller-manager",

"hosts": \[""\],

"key": \{

"algo": "rsa",

"size": 2048

\},

"names": \[

"C": "CN",

"ST": "GuangDong",

"L": "GuangZhou",

"O": "system:kube-controller-manager",

"OU": "Kubernetes-manual"

EOF

\#\# 生成 Kubernetes Controller Manager 证书和私钥

cfssl gencert \\

-ca=/apps/work/k8s/cfssl/pki/k8s/k8s-ca.pem \\

-ca-key=/apps/work/k8s/cfssl/pki/k8s/k8s-ca-key.pem \\

-config=/apps/work/k8s/cfssl/ca-config.json \\

-profile=kubernetes \\

/apps/work/k8s/cfssl/k8s/k8s\_controller\_manager.json | \\

cfssljson -bare /apps/work/k8s/cfssl/pki/k8s/k8s\_controller\_manager

3、创建kube\_controller\_manager.kubeconfig

cd /apps/work/k8s/kubernetes/server/config

kubectl config set-cluster kubernetes \\

--certificate-authority=/apps/work/k8s/cfssl/pki/k8s/k8s-ca.pem \\

--embed-certs=true \\

--server=https://192.168.3.10:5443 \\

--kubeconfig=kube\_controller\_manager.kubeconfig

kubectl config set-credentials system:kube-controller-manager \\

--client-certificate=/apps/work/k8s/cfssl/pki/k8s/k8s\_controller\_manager.pem \\

--embed-certs=true \\

--client-key=/apps/work/k8s/cfssl/pki/k8s/k8s\_controller\_manager-key.pem \\

--kubeconfig=kube\_controller\_manager.kubeconfig

kubectl config set-context kubernetes \\

--cluster=kubernetes \\

--user=system:kube-controller-manager \\

--kubeconfig=kube\_controller\_manager.kubeconfig

kubectl config use-context kubernetes --kubeconfig=kube\_controller\_manager.kubeconfig

说明：--server=https://192.168.3.10:5443 为每台kube-apiserver IP加端口不使用vip ip 连接

4、kube-controller-manager 一些特殊参数的说明

service-account-private-key-file 参数必须与 kube-apiserver 参数service-account-key-file 配对不然自动签发证书会失败没权限

cluster-cidr 参数docker 集群网段 service-cluster-ip-range 参数k8s 集群网段

node-cidr-mask-size k8s node 节点子网

5、创建kube-controller-manager 启动配置 所有服务器配置一样

说明： --address不能是服务器ip如果写服务器的ip kubectl get cs 就会报错

cd /apps/work/k8s/kubernetes/server/conf

vi kube-controller-manager

KUBE\_CONTROLLER\_MANAGER\_OPTS="--logtostderr=false \\

--leader-elect=true \\

--address=0.0.0.0 \\

--service-cluster-ip-range=10.64.0.0/16 \\

--cluster-cidr=10.48.0.0/12 \\

--node-cidr-mask-size=24 \\

--cluster-name=kubernetes \\

--allocate-node-cidrs=true \\

--kubeconfig=/apps/kubernetes/config/kube\_controller\_manager.kubeconfig \\

--authentication-kubeconfig=/apps/kubernetes/config/kube\_controller\_manager.kubeconfig \\

--authorization-kubeconfig=/apps/kubernetes/config/kube\_controller\_manager.kubeconfig \\

--use-service-account-credentials=true \\

--client-ca-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem \\

--requestheader-client-ca-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem \\

--node-monitor-grace-period=40s \\

--node-monitor-period=5s \\

--pod-eviction-timeout=5m0s \\

--terminated-pod-gc-threshold=50 \\

--alsologtostderr=true \\

--cluster-signing-cert-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem \\

--cluster-signing-key-file=/apps/kubernetes/ssl/k8s/k8s-ca-key.pem \\

--deployment-controller-sync-period=10s \\

--experimental-cluster-signing-duration=86700h0m0s \\

--enable-garbage-collector=true \\

--root-ca-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem \\

--service-account-private-key-file=/apps/kubernetes/ssl/k8s/k8s-ca-key.pem \\

--feature-gates=RotateKubeletServerCertificate=true,RotateKubeletClientCertificate=true \\

--controllers=\*,bootstrapsigner,tokencleaner \\

--horizontal-pod-autoscaler-use-rest-clients=true \\

--horizontal-pod-autoscaler-sync-period=10s \\

--flex-volume-plugin-dir=/apps/kubernetes/kubelet-plugins/volume \\

--tls-cert-file=/apps/kubernetes/ssl/k8s/k8s\_controller\_manager.pem \\

--tls-private-key-file=/apps/kubernetes/ssl/k8s/k8s\_controller\_manager-key.pem \\

--kube-api-qps=100 \\

--kube-api-burst=100 \\

--log-dir=/apps/kubernetes/log \\

--v=2"

6、创建kube-controller-manager.service 启动文件

cd /apps/work/k8s/kubernetes/

vim kube-controller-manager.service

\[Unit\]

Description=Kubernetes Controller Manager

Documentation=https://github.com/kubernetes/kubernetes

\[Service\]

LimitNOFILE=1024000

LimitNPROC=1024000

LimitCORE=infinity

LimitMEMLOCK=infinity

EnvironmentFile=-/apps/kubernetes/conf/kube-controller-manager

ExecStart=/apps/kubernetes/bin/kube-controller-manager $KUBE\_CONTROLLER\_MANAGER\_OPTS

Restart=on-failure

RestartSec=5

User=k8s

\[Install\]无锡妇科医院哪家好 http://www.xasgyy.net/

WantedBy=multi-user.target

7、分发kube-controller-manager 配置文件启动文件

说明： 使用ansible 分发时kube\_controller\_manager.kubeconfig server=https://192.168.3.10:5443 可以使用参数进行分发

server=https://\{ \{ ansible\_ssh\_host \}\}:5443 这样就不用每次修改修改 ansible\_ssh\_host 参数就是连接远程服务器ip

分发 kube\_controller\_manager.kubeconfig

ansible -i host master -m template -a "src=server/config/kube\_controller\_manager.kubeconfig dest=/apps/kubernetes/config owner=k8s group=root mode=644"

分发：kube-controller-manager

ansible -i host master -m copy -a "src=server/conf/kube-controller-manager dest=/apps/kubernetes/conf owner=k8s group=root mode=644"

分发：kube-controller-manager.service

ansible -i host master -m copy -a "src=kube-controller-manager.service dest=/usr/lib/systemd/system/kube-controller-manager.service"

8、启动kube-controller-manager

ansible -i host master -m shell -a "systemctl daemon-reload"

ansible -i host master -m shell -a "systemctl enable kube-controller-manager"

ansible -i host master -m shell -a "systemctl start kube-controller-manager"

ansible -i host master -m shell -a "systemctl status kube-controller-manager"

9、查看kube-controller-manager 是否配置成功

kubectl get cs

\[root@jenkins bin\]\# kubectl get cs

NAME STATUS MESSAGE ERROR

controller-manager Healthy ok

scheduler Healthy ok

etcd-4 Healthy \{"health":"true"\}

etcd-3 Healthy \{"health":"true"\}

etcd-5 Healthy \{"health":"true"\}

etcd-0 Healthy \{"health":"true"\}

etcd-1 Healthy \{"health":"true"\}

etcd-2 Healthy \{"health":"true"\}

10 、配置 kube-controller-manager，kubelet 、kube-scheduler 访问kube-api 用户授权

授予 kubernetes API 的权限

kubectl create clusterrolebinding controller-node-clusterrolebing --clusterrole=system:kube-controller-manager --user=system:kube-controller-manager

kubectl create clusterrolebinding scheduler-node-clusterrolebing --clusterrole=system:kube-scheduler --user=system:kube-scheduler

kubectl create clusterrolebinding controller-manager:system:auth-delegator --user system:kube-controller-manager --clusterrole system:auth-delegator

授予 kubernetes 证书访问 kubelet API 的权限

kubectl create clusterrolebinding --user system:serviceaccount:kube-system:default kube-system-cluster-admin --clusterrole cluster-admin

kubectl create clusterrolebinding kubelet-node-clusterbinding --clusterrole=system:node --group=system:nodes

kubectl create clusterrolebinding kube-apiserver:kubelet-apis --clusterrole=system:kubelet-api-admin --user kubernetes

转载于:https://www.cnblogs.com/djw12333/p/10984485.html

关于Kubernetes v1.14.0的 kube-controller-manager部署

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关【Kubernetes】Kubernetes之二进制部署

相关 Kubernetes - Kubernetes部署Kubernetes Dashbaord（三）

相关基于kubernetes v1.17部署dashboard:v2.0-beta8

相关 Kubernetes 部署 Kubernetes-Dashboard v2.0.0

相关使用minikube部署Kubernetes v1.16.2

相关部署v1.18.6版本Kubernetes集群

相关 kubernetes v1.11.0 从代码编译到部署文档-部署

相关 kubernetes v1.14 (bootstrap 部署node)

相关基于 Kubernetes v1.14.0 之 Alertmanager 部署

相关关于Kubernetes v1.14.0的 kube-controller-manager部署