Kubernetes部署(六):Master節點部署
阿新 • • 發佈:2018-12-25
1.部署Kubernetes API服務部署
0.準備軟體包
[[email protected] ~]# cd /usr/local/src/kubernetes
[[email protected] kubernetes]# cp server/bin/kube-apiserver /data/kubernetes/bin/
[[email protected] kubernetes]# cp server/bin/kube-controller-manager /data/kubernetes/bin/
[[email protected] kubernetes]# cp server/bin/kube-scheduler /data/kubernetes/bin/
[ [email protected] kubernetes]# scp server/bin/kube-apiserver 10.31.90.202:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-apiserver 10.31.90.203:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-controller-manager 10.31.90.202:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-controller-manager 10.31.90.203:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-scheduler 10.31.90.202:/data/kubernetes/bin
[[email protected] kubernetes]# scp server/bin/kube-scheduler 10.31.90.203:/data/kubernetes/bin/
1.建立生成CSR的 JSON 配置檔案
[[email protected] src]# vim kubernetes-csr.json
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"10.31.90.200",
"10.31.90.201",
"10.31.90.202",
"10.31.90.203",
"10.1.0.1",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
2.生成 kubernetes 證書和私鑰
[[email protected] src]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem \
-ca-key=/data/kubernetes/ssl/ca-key.pem \
-config=/data/kubernetes/ssl/ca-config.json \
-profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
[[email protected] ssl]# cp kubernetes*.pem /data/kubernetes/ssl/
[[email protected] ssl]# scp kubernetes*.pem 10.31.90.202:/data/kubernetes/ssl/
[[email protected] ssl]# scp kubernetes*.pem 10.31.90.203:/data/kubernetes/ssl/
3.建立 kube-apiserver 使用的客戶端 token 檔案
[[email protected] ssl]# head -c 16 /dev/urandom | od -An -t x | tr -d ' '
cf25becebf64e3fffd7f3890a60ac16d
[[email protected] ssl]# vim /data/kubernetes/ssl/bootstrap-token.csv
cf25becebf64e3fffd7f3890a60ac16d,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
[[email protected] ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.202:/data/kubernetes/ssl/
[[email protected] ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.203:/data/kubernetes/ssl/
4.建立基礎使用者名稱/密碼認證配置
[[email protected] ssl]# vim /data/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2
[[email protected] ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.202:/data/kubernetes/ssl/
[[email protected] ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.203:/data/kubernetes/ssl/
5.部署Kubernetes API Server
三個master節點都需要部署
[[email protected] ~]# vim /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target
[Service]
ExecStart=/data/kubernetes/bin/kube-apiserver \
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
--bind-address=10.31.90.201 \
--insecure-bind-address=10.31.90.201 \
--authorization-mode=Node,RBAC \
--runtime-config=rbac.authorization.k8s.io/v1 \
--kubelet-https=true \
--anonymous-auth=false \
--basic-auth-file=/data/kubernetes/ssl/basic-auth.csv \
--enable-bootstrap-token-auth \
--token-auth-file=/data/kubernetes/ssl/bootstrap-token.csv \
--service-cluster-ip-range=10.1.0.0/16 \
--service-node-port-range=20000-40000 \
--tls-cert-file=/data/kubernetes/ssl/kubernetes.pem \
--tls-private-key-file=/data/kubernetes/ssl/kubernetes-key.pem \
--client-ca-file=/data/kubernetes/ssl/ca.pem \
--service-account-key-file=/data/kubernetes/ssl/ca-key.pem \
--etcd-cafile=/data/kubernetes/ssl/ca.pem \
--etcd-certfile=/data/kubernetes/ssl/kubernetes.pem \
--etcd-keyfile=/data/kubernetes/ssl/kubernetes-key.pem \
--etcd-servers=https://10.31.90.201:2379,https://10.31.90.202:2379,https://10.31.90.203:2379 \
--enable-swagger-ui=true \
--allow-privileged=true \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path=/data/kubernetes/log/api-audit.log \
--event-ttl=1h \
--v=2 \
--logtostderr=false \
--log-dir=/data/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
6.啟動API Server服務
[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-apiserver
[[email protected] ~]# systemctl start kube-apiserver
檢視API Server服務狀態
[[email protected] ~]# systemctl status kube-apiserver
部署Controller Manager服務
三個master節點都需要部署
[[email protected] ~]# vim /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/data/kubernetes/bin/kube-controller-manager \
--address=127.0.0.1 \
--master=http://10.31.90.200:8080 \
--allocate-node-cidrs=true \
--service-cluster-ip-range=10.1.0.0/16 \
--cluster-cidr=10.2.0.0/16 \
--cluster-name=kubernetes \
--cluster-signing-cert-file=/data/kubernetes/ssl/ca.pem \
--cluster-signing-key-file=/data/kubernetes/ssl/ca-key.pem \
--service-account-private-key-file=/data/kubernetes/ssl/ca-key.pem \
--root-ca-file=/data/kubernetes/ssl/ca.pem \
--leader-elect=true \
--v=2 \
--logtostderr=false \
--log-dir=/data/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
3.啟動Controller Manager
[[email protected] ~]# systemctl daemon-reload
[[email protected] scripts]# systemctl enable kube-controller-manager
[[email protected] scripts]# systemctl start kube-controller-manager
4.檢視服務狀態
[[email protected] scripts]# systemctl status kube-controller-manager
部署Kubernetes Scheduler
三個master節點都需要部署
[[email protected] ~]# vim /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/data/kubernetes/bin/kube-scheduler \
--address=127.0.0.1 \
--master=http://10.31.90.200:8080 \
--leader-elect=true \
--v=2 \
--logtostderr=false \
--log-dir=/data/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
2.部署服務
[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-scheduler
[[email protected] ~]# systemctl start kube-scheduler
[[email protected] ~]# systemctl status kube-scheduler
部署kubectl 命令列工具
這隻需在其中一臺部署即可,用來管理k8s叢集。
1.準備二進位制命令包
[[email protected] ~]# cd /usr/local/src/kubernetes/client/bin
[[email protected] bin]# cp kubectl /opt/kubernetes/bin/
2.建立 admin 證書籤名請求
[[email protected] ~]# cd /usr/local/src/ssl/
[[email protected] ssl]# vim admin-csr.json
{
"CN": "admin",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:masters",
"OU": "System"
}
]
}
3.生成 admin 證書和私鑰:
[[email protected] ssl]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem \
-ca-key=/data/kubernetes/ssl/ca-key.pem \
-config=/data/kubernetes/ssl/ca-config.json \
-profile=kubernetes admin-csr.json | cfssljson -bare admin
[[email protected] ssl]# ls -l admin*
[[email protected] ssl]# ls -l admin*
-rw-r--r-- 1 root root 1009 Dec 25 11:26 admin.csr
-rw-r--r-- 1 root root 229 Dec 25 11:24 admin-csr.json
-rw------- 1 root root 1679 Dec 25 11:26 admin-key.pem
-rw-r--r-- 1 root root 1399 Dec 25 11:26 admin.pem
[[email protected] ssl]# cp admin*.pem /data/kubernetes/ssl/
4.設定叢集引數
[[email protected] src]# kubectl config set-cluster kubernetes \
--certificate-authority=/data/kubernetes/ssl/ca.pem \
--embed-certs=true \
--server=https://10.31.90.200:6443
Cluster "kubernetes" set.
5.設定客戶端認證引數
[[email protected] ssl]# kubectl config set-credentials admin \
--client-certificate=/data/kubernetes/ssl/admin.pem \
--embed-certs=true \
--client-key=/data/kubernetes/ssl/admin-key.pem
User "admin" set.
6.設定上下文引數
[[email protected] ssl]# kubectl config set-context kubernetes \
--cluster=kubernetes \
--user=admin
Context "kubernetes" created.
7.設定預設上下文
[[email protected] src]# kubectl config use-context kubernetes
Switched to context "kubernetes".
8.使用kubectl工具
[[email protected] ssl]# kubectl get cs
NAME STATUS MESSAGE ERROR
scheduler Healthy ok
controller-manager Healthy ok
etcd-1 Healthy {"health": "true"}
etcd-0 Healthy {"health": "true"}
etcd-2 Healthy {"health": "true"}
後續會陸續更新所有的安裝文件,如果你覺得我寫的不錯,希望大家多多關注點贊,非常感謝!