k8s笔记2-kubernetes master组件配置

ゝ一纸荒年。 2022-03-22 03:58 342阅读 0赞

参考自：[http://blog.51cto.com/lizhenliang/2325770][http_blog.51cto.com_lizhenliang_2325770]  
部署kubernetes之前，要保证etcd、flannel、docker的正常工作。

### 在master节点部署组件 ###

三个组件：  
kube-apiserver、kube-controller-manager、kube-scheduler  
必须先配置apiserver。

#### 1、首先生成自签证书 ####

# 在k8s中创建自签证书的存放文件夹k8s-cert，///mkdir k8s-cert
    cd k8s/k8s-cert
    ./k8s-cert.sh #生成自签证书

# cat k8s-cert.sh
    cat > ca-config.json <<EOF
    {
      "signing": {
        "default": {
          "expiry": "87600h"
        },
        "profiles": {
          "kubernetes": {
             "expiry": "87600h",
             "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
            ]
          }
        }
      }
    }
    EOF
    
    cat > ca-csr.json <<EOF
    {
        "CN": "kubernetes",
        "key": {
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            {
                "C": "CN",
                "L": "Beijing",
                "ST": "Beijing",
          	    "O": "k8s",
                "OU": "System"
            }
        ]
    }
    EOF
    
    cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
    
    #-----------------------
    
    cat > server-csr.json <<EOF
    {
        "CN": "kubernetes",
        "hosts": [
          "10.0.0.1", # api-server集群内部IP，不变
          "127.0.0.1", #不变
          "10.0.3.171", # 加载master地址，包括LB负载均衡器的地址（多master集群时记得修改）
          "kubernetes",
          "kubernetes.default",
          "kubernetes.default.svc",
          "kubernetes.default.svc.cluster",
          "kubernetes.default.svc.cluster.local"
        ],
        "key": {
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            {
                "C": "CN",
                "L": "BeiJing",
                "ST": "BeiJing",
                "O": "k8s",
                "OU": "System"
            }
        ]
    }
    EOF
    
    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
    
    #-----------------------
    
    cat > kube-proxy-csr.json <<EOF
    {
      "CN": "system:kube-proxy",
      "hosts": [],
      "key": {
        "algo": "rsa",
        "size": 2048
      },
      "names": [
        {
          "C": "CN",
          "L": "BeiJing",
          "ST": "BeiJing",
          "O": "k8s",
          "OU": "System"
        }
      ]
    }
    EOF
    
    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

检查生成的证书

./k8s-cert.sh
    ls *pem
    #------生成以下证书
    ca-key.pem  ca.pem  kube-proxy-key.pem  kube-proxy.pem  server-key.pem  server.pem

#### 2、在master节点部署apiserver组件 ####

下载kubernetes二进制包，选择一个稳定版1.12.1  
在[kubernetes网页][kubernetes]中复制链接地址，并下载

cd k8s/soft
    wget https://dl.k8s.io/v1.12.1/kubernetes-server-linux-amd64.tar.gz

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTA4MDE5OTQ_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTA4MDE5OTQ_size_16_color_FFFFFF_t_70 1]

mkdir /opt/kubernetes/{bin,cfg,ssl} -p
    tar zxvf kubernetes-server-linux-amd64.tar.gz
    cd kubernetes/server/bin
    cp kube-apiserver kube-scheduler kube-controller-manager kubectl /opt/kubernetes/bin

由于apiserver配置文件需要用到自签证书，这里先将需要的证书拷贝到相应的位置

cp /root/k8s/k8s-cert/{ca,ca-key,server,server-key}.pem /opt/kubernetes/ssl/

可随机生成一个32位字符串，用以创建一个token文件：

head -c 16 /dev/urandom |od -An -t x |tr -d ' '

#vi /opt/kubernetes/cfg/token.csv
    #token的格式为：(第一列)随机字符串，(第二列)用户名，(第三列)UID，(第四列)用户名
    eacee0f07c4b0866b37c577e6056f876,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

创建apiserver配置文件，并执行

./apiserver.sh 10.0.3.171 https://10.0.3.171:2379,https://10.0.3.104:2379,https://10.0.3.150:2379
    # etcd-server地址，可在node中通过cat /opt/kubernetes/cfg/flanneld查看

![在这里插入图片描述][20190125172448247.png]

#cat apiserver.sh
    #!/bin/bash
    
    MASTER_ADDRESS=$1
    ETCD_SERVERS=$2
    
    cat <<EOF >/opt/kubernetes/cfg/kube-apiserver
    
    KUBE_APISERVER_OPTS="--logtostderr=true \\
    --v=4 \\
    --etcd-servers=${ETCD_SERVERS} \\
    --bind-address=${MASTER_ADDRESS} \\
    --secure-port=6443 \\
    --advertise-address=${MASTER_ADDRESS} \\
    --allow-privileged=true \\
    --service-cluster-ip-range=10.0.0.0/24 \\
    --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction \\
    --authorization-mode=RBAC,Node \\
    --kubelet-https=true \\
    --enable-bootstrap-token-auth \\
    --token-auth-file=/opt/kubernetes/cfg/token.csv \\
    --service-node-port-range=30000-50000 \\
    --tls-cert-file=/opt/kubernetes/ssl/server.pem  \\
    --tls-private-key-file=/opt/kubernetes/ssl/server-key.pem \\
    --client-ca-file=/opt/kubernetes/ssl/ca.pem \\
    --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \\
    --etcd-cafile=/opt/etcd/ssl/ca.pem \\
    --etcd-certfile=/opt/etcd/ssl/server.pem \\
    --etcd-keyfile=/opt/etcd/ssl/server-key.pem"
    # etcd的证书要配置好，莫忘
    EOF
    
    cat <<EOF >/usr/lib/systemd/system/kube-apiserver.service
    [Unit]
    Description=Kubernetes API Server
    Documentation=https://github.com/kubernetes/kubernetes
    
    [Service]
    EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver
    ExecStart=/opt/kubernetes/bin/kube-apiserver \$KUBE_APISERVER_OPTS
    Restart=on-failure
    
    [Install]
    WantedBy=multi-user.target
    EOF
    
    systemctl daemon-reload
    systemctl enable kube-apiserver
    systemctl restart kube-apiserver

查看日志，及apiserver进程

tail /var/log/messages -f
    ps -ef |grep apiserver

### 3、部署scheduler组件 ###

./scheduler.sh 127.0.0.1

#vi scheduler.sh
    #!/bin/bash
    
    MASTER_ADDRESS=$1
    
    cat <<EOF >/opt/kubernetes/cfg/kube-scheduler
    
    KUBE_SCHEDULER_OPTS="--logtostderr=true \\
    --v=4 \\
    --master=${MASTER_ADDRESS}:8080 \\
    --leader-elect"
    # master连接本地apiserver
    # leader-elect当该组件启动多个时，自动选举
    
    EOF
    
    cat <<EOF >/usr/lib/systemd/system/kube-scheduler.service
    [Unit]
    Description=Kubernetes Scheduler
    Documentation=https://github.com/kubernetes/kubernetes
    
    [Service]
    EnvironmentFile=-/opt/kubernetes/cfg/kube-scheduler
    ExecStart=/opt/kubernetes/bin/kube-scheduler \$KUBE_SCHEDULER_OPTS
    Restart=on-failure
    
    [Install]
    WantedBy=multi-user.target
    EOF
    # 启动
    systemctl daemon-reload
    systemctl enable kube-scheduler
    systemctl restart kube-scheduler

查看监听

ss -antp |grep 8080 |grep LISTEN

![在这里插入图片描述][20190309130657167.png]

### 4、部署controler-manage组件 ###

./controller-manager.sh 127.0.0.1

# vi controller-manager.sh
    #!/bin/bash
    
    MASTER_ADDRESS=$1
    #创建controller-manager配置文件
    cat <<EOF >/opt/kubernetes/cfg/kube-controller-manager
    
    KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=true \\
    --v=4 \\
    --master=${MASTER_ADDRESS}:8080 \\
    --leader-elect=true \\
    --address=127.0.0.1 \\
    --service-cluster-ip-range=10.0.0.0/24 \\
    --cluster-name=kubernetes \\
    --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \\
    --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem  \\
    --root-ca-file=/opt/kubernetes/ssl/ca.pem \\
    --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \\
    --experimental-cluster-signing-duration=87600h0m0s"
    
    EOF
    
    #systemd管理controller-manager组件
    cat <<EOF >/usr/lib/systemd/system/kube-controller-manager.service
    [Unit]
    Description=Kubernetes Controller Manager
    Documentation=https://github.com/kubernetes/kubernetes
    
    [Service]
    EnvironmentFile=-/opt/kubernetes/cfg/kube-controller-manager
    ExecStart=/opt/kubernetes/bin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS
    Restart=on-failure
    
    [Install]
    WantedBy=multi-user.target
    EOF
    
    #启动
    systemctl daemon-reload
    systemctl enable kube-controller-manager
    systemctl restart kube-controller-manager

查看kube启动组件及通过kubectl工具查看当前集群组件状态

ps -ef |grep kube
    /opt/kubernetes/bin/kubectl get cs

![在这里插入图片描述][20190125181012654.png]

=========================  
配置多master集群时  
在master01主机上，拷贝相关文件到master02上

scp -r /opt/kubernetes/ root@10.0.3.172:/opt/
    scp /usr/lib/systemd/system/{kube-apiserver,kube-scheduler,kube-controller-manager}.service root@10.0.3.172:/usr/lib/systemd/system

在master02上修改地址

cd /opt/kubernetes/cfg
    vi kube-apiserver

![在这里插入图片描述][20190127094900802.png]  
启动

systemctl daemon-reload
    systemctl start kube-apiserver
    systemctl start kube-scheduler
    systemctl start kube-controller-manager
    /opt/kubernetes/bin/kubectl get cs

![在这里插入图片描述][20190127095326719.png]

[http_blog.51cto.com_lizhenliang_2325770]: http://blog.51cto.com/lizhenliang/2325770
[kubernetes]: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTA4MDE5OTQ_size_16_color_FFFFFF_t_70]: /images/20220322/382d6aaf65cc4c2f9f214c4b0a99a264.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTA4MDE5OTQ_size_16_color_FFFFFF_t_70 1]: /images/20220322/08a41daa133b48a4aa1fa81bdf7b19aa.png
[20190125172448247.png]: /images/20220322/558d395ecbc543af91d1f181c36cb954.png
[20190309130657167.png]: /images/20220322/f18871c4f365468fa142d243f5bfe121.png
[20190125181012654.png]: /images/20220322/e472d3c93e024a0ab9c1ba685d0e2c56.png
[20190127094900802.png]: /images/20220322/f1321075190f4371b57f97fd966fc57d.png
[20190127095326719.png]: /images/20220322/e70c6a2d18b343d3b76c4934a433a187.png