Kubernetes Master节点部署四个服务：kube-apiserver、kube-controller-manager、kube-scheduler和kubectl命令工具.
Kubernetes API服务部署：
1.准备软件包,软件包有两种下载方式:
方式一(推荐使用):
从https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md 页面下载 client 或 server tar包 文件.
[[email protected] ~]# cd /usr/local/src/ [[email protected]-master src]# wget https://dl.k8s.io/v1.10.1/kubernetes.tar.gz [[email protected] src]# wget https://dl.k8s.io/v1.10.1/kubernetes-server-linux-amd64.tar.gz [[email protected] src]# wget https://dl.k8s.io/v1.10.1/kubernetes-client-linux-amd64.tar.gz [[email protected] src]# wget https://dl.k8s.io/v1.10.1/kubernetes-node-linux-amd64.tar.gz
方式二：
准备软件包从github release 页面下载发布版tar包,解压后再执行下载脚本.
[[email protected] ~]# cd /usr/local/src/ [[email protected]-master src]#wget https://github.com/kubernetes/kubernetes/releases/download/v1.10.3/kubernetes.tar.gz [[email protected] src]# tar -zxvf kubernetes.tar.gz [[email protected]-master src]# ll total 2664 drwxr-xr-x 9 root root 156 May 21 18:16 kubernetes -rw-r--r-- 1 root root 2726918 May 21 19:15 kubernetes.tar.gz [[email protected]-master src]# cd kubernetes/cluster/ [[email protected]-master cluster]# ./get-kube-binaries.sh ...
解压安装包,并添加可执行文件：
[[email protected] kubernetes]# cd /usr/local/src/kubernetes [[email protected]-master kubernetes]#cp server/bin/kube-apiserver /opt/kubernetes/bin/ [[email protected]-master kubernetes]#cp server/bin/kube-controller-manager /opt/kubernetes/bin/ [[email protected]-master kubernetes]#cp server/bin/kube-scheduler /opt/kubernetes/bin/
2.创建生成CSR的 JSON 配置文件:
[[email protected] ssl]# cd /usr/local/src/ssl/
[[email protected] ssl]# cat > kubernetes-csr.json <<EOF { "CN": "kubernetes", "hosts": [ "127.0.0.1", "10.200.3.105", "10.1.0.1", "10.254.0.2", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ] } EOF
3.生成 kubernetes 证书和私钥,并分发到所以节点.
[[email protected] src]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem / -ca-key=/opt/kubernetes/ssl/ca-key.pem / -config=/opt/kubernetes/ssl/ca-config.json / -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes [[email protected]-master ssl]# cp kubernetes*.pem /opt/kubernetes/ssl/ [[email protected]-master ssl]# scp kubernetes*.pem 10.200.3.106:/opt/kubernetes/ssl/ [[email protected]-master ssl]# scp kubernetes*.pem 10.200.3.107:/opt/kubernetes/ssl/
4.创建 kube-apiserver 使用的客户端 token 文件
[[email protected] ~]# head -c 16 /dev/urandom | od -An -t x | tr -d ' ' 10a89e49bc403bce8fb134e5a2ae82f1 [[email protected]-master ~]# vim /opt/kubernetes/ssl/bootstrap-token.csv 10a89e49bc403bce8fb134e5a2ae82f1,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
5.创建基础用户名/密码认证配置
[[email protected] ~]# vim /opt/kubernetes/ssl/basic-auth.csv admin,admin,1 readonly,readonly,2
.6.部署Kubernetes API Server
[[email protected] ~]# cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF [Unit] Description=Kubernetes API Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes After=network.target [Service] ExecStart=/opt/kubernetes/bin/kube-apiserver / --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction / --bind-address=10.200.3.105 / --insecure-bind-address=127.0.0.1 / --authorization-mode=Node,RBAC / --runtime-config=rbac.authorization.k8s.io/v1 / --kubelet-https=true / --anonymous-auth=false / --basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv / --enable-bootstrap-token-auth / --token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv / --service-cluster-ip-range=10.1.0.0/16 / --service-node-port-range=20000-40000 / --tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem / --tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem / --client-ca-file=/opt/kubernetes/ssl/ca.pem / --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem / --etcd-cafile=/opt/kubernetes/ssl/ca.pem / --etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem / --etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem / --etcd-servers=https://10.200.3.105:2379,https://10.200.3.106:2379,https://10.200.3.107:2379 / --enable-swagger-ui=true / --allow-privileged=true / --audit-log-maxage=30 / --audit-log-maxbackup=3 / --audit-log-maxsize=100 / --audit-log-path=/opt/kubernetes/log/api-audit.log / --event-ttl=1h / --v=2 / --logtostderr=false / --log-dir=/opt/kubernetes/log Restart=on-failure RestartSec=5 Type=notify LimitNOFILE=65536 [Install] WantedBy=multi-user.target EOF
7.启动API Server服务
[[email protected] ~]# systemctl daemon-reload [[email protected]-master ~]# systemctl enable kube-apiserver [[email protected]-master ~]# systemctl start kube-apiserver [[email protected]-master ~]# systemctl status kube-apiserver
部署Controller Manager服务
[[email protected] ~]# cat > /usr/lib/systemd/system/kube-controller-manager.service <<EOF [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/opt/kubernetes/bin/kube-controller-manager / --address=127.0.0.1 / --master=http://127.0.0.1:8080 / --allocate-node-cidrs=true / --service-cluster-ip-range=10.1.0.0/16 / --cluster-cidr=10.2.0.0/16 / --cluster-name=kubernetes / --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem / --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem / --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem / --root-ca-file=/opt/kubernetes/ssl/ca.pem / --leader-elect=true / --v=2 / --logtostderr=false / --log-dir=/opt/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF
启动Controller Manager
[[email protected] ~]# systemctl daemon-reload [[email protected]-master ~]# systemctl enable kube-controller-manager [[email protected]-master ~]# systemctl start kube-controller-manager [[email protected]-master ~]# systemctl status kube-controller-manager
部署Kubernetes Scheduler:
[[email protected] ~]# cat > /usr/lib/systemd/system/kube-scheduler.service <<EOF [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/opt/kubernetes/bin/kube-scheduler / --address=127.0.0.1 / --master=http://127.0.0.1:8080 / --leader-elect=true / --v=2 / --logtostderr=false / --log-dir=/opt/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF
启动Kubernetes Scheduler
[[email protected] ~]# systemctl daemon-reload [[email protected]-master ~]# systemctl enable kube-scheduler [[email protected]-master ~]# systemctl start kube-scheduler [[email protected]-master ~]# systemctl status kube-scheduler
部署kubectl 命令行工具
1.准备二进制命令包
[[email protected] ~]# cd /usr/local/src/kubernetes/client/bin/ [[email protected]-master bin]# cp kubectl /opt/kubernetes/bin/
2.创建 admin 证书签名请求
[[email protected] ~]# cd /usr/local/src/ssl/ [[email protected]-master ssl]# cat > admin-csr.json <<EOF { "CN": "admin", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "system:masters", "OU": "System" } ] } EOF
3.生成 admin 证书和私钥：
[[email protected] ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem / -ca-key=/opt/kubernetes/ssl/ca-key.pem / -config=/opt/kubernetes/ssl/ca-config.json / -profile=kubernetes admin-csr.json | cfssljson -bare admin [[email protected]-master ssl]# ls -l admin* -rw-r--r-- 1 root root 1009 May 31 10:29 admin.csr -rw-r--r-- 1 root root 230 May 31 10:21 admin-csr.json -rw------- 1 root root 1679 May 31 10:29 admin-key.pem -rw-r--r-- 1 root root 1399 May 31 10:29 admin.pem [[email protected]-master ssl]# cp admin*.pem /opt/kubernetes/ssl/ [[email protected]-master ssl]#
4.设置集群参数
[[email protected] ssl]# kubectl config set-cluster kubernetes / --certificate-authority=/opt/kubernetes/ssl/ca.pem / --embed-certs=true / --server=https://10.200.3.105:6443 Cluster "kubernetes" set.Cluster "kubernetes" set.
5.设置客户端认证参数
[[email protected] ssl]# kubectl config set-credentials admin / --client-certificate=/opt/kubernetes/ssl/admin.pem / --embed-certs=true / --client-key=/opt/kubernetes/ssl/admin-key.pem User "admin" set.
6.设置上下文参数
[[email protected] ssl]# kubectl config set-context kubernetes / --cluster=kubernetes / --user=admin Context "kubernetes" created.
7.设置默认上下文
[[email protected] ssl]# kubectl config use-context kubernetes Switched to context "kubernetes".
8.使用kubectl工具
[[email protected] ssl]# kubectl get cs NAME STATUS MESSAGE ERROR scheduler Healthy ok controller-manager Healthy ok etcd-0 Healthy {"health": "true"} etcd-2 Healthy {"health": "true"} etcd-1 Healthy {"health": "true"} [[email protected]-master ssl]#
参考文档：https://github.com/unixhot/salt-kubernetes
原创文章，作者：奋斗，如若转载，请注明出处：https://blog.ytso.com/6896.html