kubernetes搭建四、kubeconfig

朱雀 2023-07-12 11:40 15阅读 0赞

kubernetes搭建 四、kubeconfig

kubeconfig是用于在node节点上kubelet和kube-proxy访问集群的认证。

以下操作在master上进行，然后到时候再统一分发到node节点上

kubernetes安装包下载，下载后然后解压

下载地址https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md
    
    mkdir k8s_download
    cd k8s_download
    wget https://dl.k8s.io/v1.12.2/kubernetes-server-linux-amd64.tar.gz
    
    解压后可以看到有这些文件
    [root@k8s-master-101 bin]# pwd
    /root/k8s_download/kubernetes/server/bin
    [root@k8s-master-101 bin]# ls
    apiextensions-apiserver              kube-apiserver.docker_tag           kube-proxy.docker_tag
    cloud-controller-manager             kube-apiserver.tar                  kube-proxy.tar
    cloud-controller-manager.docker_tag  kube-controller-manager             kube-scheduler
    cloud-controller-manager.tar         kube-controller-manager.docker_tag  kube-scheduler.docker_tag
    hyperkube                            kube-controller-manager.tar         kube-scheduler.tar
    kubeadm                              kubelet                             mounter
    kube-apiserver                       kube-proxy

在master上下载kubectl

cd  k8s_download/kubernetes/server/bin/
    chmod +x kubectl
    mv kubectl /opt/kubernetes/bin

创建 TLS Bootstrapping Token，即token.csv文件。TLS Bootstrapping Token用于引导kubelet自动生成证书。

export BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ')
    cat > token.csv <<EOF
    ${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,"system:kubelet-bootstrap"
    EOF
    cp token.csv /opt/kubernetes/ssl/
    cd /opt/kubernetes/ssl/
    
    [root@k8s-master-101 ssl]# cat token.csv 
    427699856e2f019164f5d0b61bbb8195,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
    其中涉及到RBAC的知识。它表示使用kubelet-bootstrap并拥有10001权限，通过kubelet-bootstrap用户组使用第一个随机字符串来访问k8s集群。

创建bootstrap.kubeconfig，这个文件是用于kubelet自动签发证书的。

#首先指定kube-api访问入口，即master ip
    export KUBE_APISERVER=https://10.0.0.101:6443
    
    #设置集群参数
    kubectl config set-cluster kubernetes \
      --certificate-authority=/opt/kubernetes/ssl/ca.pem \
      --embed-certs=true \
      --server=${KUBE_APISERVER} \
      --kubeconfig=bootstrap.kubeconfig
    
    #设置客户端认证参数
    kubectl config set-credentials kubelet-bootstrap \
      --token=${BOOTSTRAP_TOKEN} \
      --kubeconfig=bootstrap.kubeconfig
    
    #设置上下文参数
    kubectl config set-context default \
      --cluster=kubernetes \
      --user=kubelet-bootstrap \
      --kubeconfig=bootstrap.kubeconfig
    
    #设置默认上下文
    kubectl config use-context default --kubeconfig=bootstrap.kubeconfig

执行完后将生成bootstrap.kubeconfig文件

[root@k8s-master-101 ssl]# cat bootstrap.kubeconfig 
    apiVersion: v1
    clusters:
    - cluster:
        certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR4RENDQXF5Z0F3SUJBZ0lVVFcwZFhZMEZBWEdvcFppcXE1N05JQTIvWGlZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2FERUxNQWtHQTFVRUJoTUNRMDR4RWpBUUJnTlZCQWdUQ1VkMVlXNW5lbWh2ZFRFUk1BOEdBMVVFQnhNSQpVMmhsYm5wb1pXNHhEREFLQmdOVkJBb1RBMnM0Y3pFUE1BMEdBMVVFQ3hNR1UzbHpkR1Z0TVJNd0VRWURWUVFECkV3cHJkV0psY201bGRHVnpNQjRYRFRFNU1ETXdOekUyTVRRd01Gb1hEVEkwTURNd05URTJNVFF3TUZvd2FERUwKTUFrR0ExVUVCaE1DUTA0eEVqQVFCZ05WQkFnVENVZDFZVzVuZW1odmRURVJNQThHQTFVRUJ4TUlVMmhsYm5wbwpaVzR4RERBS0JnTlZCQW9UQTJzNGN6RVBNQTBHQTFVRUN4TUdVM2x6ZEdWdE1STXdFUVlEVlFRREV3cHJkV0psCmNtNWxkR1Z6TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFzZmQ2NDRiV3RHNEsKYTZJS052bXg0RWZReHl1czVPQy9kUkZVRng0eE1iakV3eGVWbXRiUXh0cEV0TWs1UVMxMXpFNmdIcUhRWXFuMQpMOXVjVG5NZUZVYmJDaTBITXVOTFdSUGpJWmtnNzRuTnV3VlBkSjYvYkZPL21qSFd1Q2gzY2xWdE9tNGg1by9IClFZZkdWR2VIeWFXL3kvWW5IbzFWaHZWMlJONTJNTHRoUG0rVUtLQTlLeUJIUVJKWURKbXVoV2owUDJ4R01vVmkKd3VaU0tiT0c2R2xFeUxoRlNjbEd2d0FtNjRrL3RPMDVwZ0tZWHZtbmg2S0UwelhHVzR5M3BMYVZrMmhkc3RNWgpvM3hjTkZab0tlei9XbzdSZXR2enA1UFNLYnBkNTB5UTZ6MDhvaE56UlJhL2xXRWFxa0xUbndhT0ZRekhMQk5KCjE2WHh5T0RzZVFJREFRQUJvMll3WkRBT0JnTlZIUThCQWY4RUJBTUNBUVl3RWdZRFZSMFRBUUgvQkFnd0JnRUIKL3dJQkFqQWRCZ05WSFE0RUZnUVVPejBPN2RKSUdBbXRUbkxOaWh5TFZWbkNIY1F3SHdZRFZSMGpCQmd3Rm9BVQpPejBPN2RKSUdBbXRUbkxOaWh5TFZWbkNIY1F3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUlSbndCT0hEdldyCjdmNFJGa3VzZXpVa25uWkRvYzZEOStIalF4YXJHYitFd2ZrZWNqUjkwOStOUjI4bUVmeDB3eXhRVkwwUjJrT28KRXFPOGtVc252eGxZdXZ4S1NiZHNhYTdTTEU2YS9mcHc3OTUxUzdSRDZEbktYREpMVENTZHRSRityeHBYYlBJUgp1WVVrVml1YndudU16VlMwRXZFSG1KcDNVTC9jVkFMYnJiV3JQVXkzellQM1J4ZXpEUTE0N2ZVajBFd3FLUTFWClNVRkRFNXkyTmRZZCtnbHV3MHRRRll2VlJBOWp1UjgvYnFYNVZLWHVublNLKzNEZVlKcGtTelU1dzlrcmhOUWQKTFZuQzBpdyttUm4zTm80WWpsdkR1eWJGeTdVSTJwV0w2aFg1c29SRlA4N2tyWEF2THgxcHNHdDFYYytYcmhVVwpkazlxMlF3bVVuQT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
        server: https://10.0.0.101:6443
      name: kubernetes
    contexts:
    - context:
        cluster: kubernetes
        user: kubelet-bootstrap
      name: default
    current-context: default
    kind: Config
    preferences: {}
    users:
    - name: kubelet-bootstrap
      user:
        token: 427699856e2f019164f5d0b61bbb8195

创建节点要用的kube-proxy kubeconfig文件

# 设置集群参数
    kubectl config set-cluster kubernetes \
      --certificate-authority=/opt/kubernetes/ssl/ca.pem \
      --embed-certs=true \
      --server=${KUBE_APISERVER} \
      --kubeconfig=kube-proxy.kubeconfig
    
    # 设置客户端认证参数
    kubectl config set-credentials kube-proxy \
      --client-certificate=/opt/kubernetes/ssl/kube-proxy.pem \
      --client-key=/opt/kubernetes/ssl/kube-proxy-key.pem \
      --embed-certs=true \
      --kubeconfig=kube-proxy.kubeconfig
    
    # 设置上下文参数
    kubectl config set-context default \
      --cluster=kubernetes \
      --user=kube-proxy \
      --kubeconfig=kube-proxy.kubeconfig
    
    # 设置默认上下文
    kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

最后生成了两个kubeconfig文件

[root@k8s-master-101 ssl]# ls *config
    bootstrap.kubeconfig  kube-proxy.kubeconfig