Kubernetes v1.14.0 之 kube-controller-manager部署

1、 kube-controller-manager准备

默认kube-controller-manager 部署在kube-apiserver部署的服务器上面服务器的配置等在这就不在列出来
二进制文件以及包含在kube-apiserver一起所以不在进行二进制的下载跟分发

2、生成kube-controller-manager访问kube-apiserver 证书

cat << EOF | tee /apps/work/k8s/cfssl/k8s/k8s_controller_manager.json
{
  "CN": "system:kube-controller-manager",
  "hosts": [""], 
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "GuangDong",
      "L": "GuangZhou",
      "O": "system:kube-controller-manager",
      "OU": "Kubernetes-manual"
    }
  ]
}
EOF

## 生成 Kubernetes Controller Manager 证书和私钥
cfssl gencert 
    -ca=/apps/work/k8s/cfssl/pki/k8s/k8s-ca.pem 
    -ca-key=/apps/work/k8s/cfssl/pki/k8s/k8s-ca-key.pem 
    -config=/apps/work/k8s/cfssl/ca-config.json 
    -profile=kubernetes 
    /apps/work/k8s/cfssl/k8s/k8s_controller_manager.json | 
    cfssljson -bare /apps/work/k8s/cfssl/pki/k8s/k8s_controller_manager

3、创建kube_controller_manager.kubeconfig

cd /apps/work/k8s/kubernetes/server/config
kubectl config set-cluster kubernetes 
   --certificate-authority=/apps/work/k8s/cfssl/pki/k8s/k8s-ca.pem 
   --embed-certs=true 
   --server=https://192.168.3.10:5443 
   --kubeconfig=kube_controller_manager.kubeconfig

kubectl config set-credentials system:kube-controller-manager 
   --client-certificate=/apps/work/k8s/cfssl/pki/k8s/k8s_controller_manager.pem 
   --embed-certs=true 
   --client-key=/apps/work/k8s/cfssl/pki/k8s/k8s_controller_manager-key.pem 
   --kubeconfig=kube_controller_manager.kubeconfig

kubectl config set-context kubernetes 
   --cluster=kubernetes 
   --user=system:kube-controller-manager 
   --kubeconfig=kube_controller_manager.kubeconfig

kubectl config use-context kubernetes --kubeconfig=kube_controller_manager.kubeconfig
说明：--server=https://192.168.3.10:5443  为每台kube-apiserver IP加端口不使用vip ip 连接

4、kube-controller-manager 一些特殊参数的说明

service-account-private-key-file 参数必须与 kube-apiserver 参数service-account-key-file 配对不然自动签发证书会失败没权限
cluster-cidr 参数docker 集群网段 service-cluster-ip-range 参数k8s 集群网段
node-cidr-mask-size k8s node 节点子网

5、创建kube-controller-manager 启动配置 所有服务器配置一样

说明： --address不能是服务器ip如果写服务器的ip kubectl get cs 就会报错
cd /apps/work/k8s/kubernetes/server/conf
vi kube-controller-manager
KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=false 
--leader-elect=true 
--address=0.0.0.0 
--service-cluster-ip-range=10.64.0.0/16 
--cluster-cidr=10.48.0.0/12 
--node-cidr-mask-size=24 
--cluster-name=kubernetes 
--allocate-node-cidrs=true 
--kubeconfig=/apps/kubernetes/config/kube_controller_manager.kubeconfig 
--authentication-kubeconfig=/apps/kubernetes/config/kube_controller_manager.kubeconfig 
--authorization-kubeconfig=/apps/kubernetes/config/kube_controller_manager.kubeconfig 
--use-service-account-credentials=true 
--client-ca-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem 
--requestheader-client-ca-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem 
--node-monitor-grace-period=40s 
--node-monitor-period=5s 
--pod-eviction-timeout=5m0s 
--terminated-pod-gc-threshold=50 
--alsologtostderr=true 
--cluster-signing-cert-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem 
--cluster-signing-key-file=/apps/kubernetes/ssl/k8s/k8s-ca-key.pem  
--deployment-controller-sync-period=10s 
--experimental-cluster-signing-duration=86700h0m0s 
--enable-garbage-collector=true 
--root-ca-file=/apps/kubernetes/ssl/k8s/k8s-ca.pem 
--service-account-private-key-file=/apps/kubernetes/ssl/k8s/k8s-ca-key.pem 
--feature-gates=RotateKubeletServerCertificate=true,RotateKubeletClientCertificate=true 
--controllers=*,bootstrapsigner,tokencleaner 
--horizontal-pod-autoscaler-use-rest-clients=true 
--horizontal-pod-autoscaler-sync-period=10s 
--flex-volume-plugin-dir=/apps/kubernetes/kubelet-plugins/volume 
--tls-cert-file=/apps/kubernetes/ssl/k8s/k8s_controller_manager.pem 
--tls-private-key-file=/apps/kubernetes/ssl/k8s/k8s_controller_manager-key.pem 
--kube-api-qps=100 
--kube-api-burst=100 
--log-dir=/apps/kubernetes/log 
--v=2"

6、创建kube-controller-manager.service 启动文件

cd /apps/work/k8s/kubernetes/
vim kube-controller-manager.service 
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes

[Service]
LimitNOFILE=1024000
LimitNPROC=1024000
LimitCORE=infinity
LimitMEMLOCK=infinity
EnvironmentFile=-/apps/kubernetes/conf/kube-controller-manager
ExecStart=/apps/kubernetes/bin/kube-controller-manager $KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure
RestartSec=5
User=k8s

[Install]
WantedBy=multi-user.target

7、分发kube-controller-manager 配置文件启动文件

说明：  使用ansible 分发时kube_controller_manager.kubeconfig  server=https://192.168.3.10:5443 可以使用参数进行分发
server=https://{{ ansible_ssh_host }}:5443 这样就不用每次修改修改 ansible_ssh_host 参数就是连接远程服务器ip
 分发 kube_controller_manager.kubeconfig 
 ansible -i host master -m  template -a "src=server/config/kube_controller_manager.kubeconfig dest=/apps/kubernetes/config owner=k8s group=root mode=644" 
分发：kube-controller-manager
ansible -i host master -m copy -a "src=server/conf/kube-controller-manager dest=/apps/kubernetes/conf owner=k8s group=root mode=644"
分发：kube-controller-manager.service
ansible -i host master -m copy -a "src=kube-controller-manager.service dest=/usr/lib/systemd/system/kube-controller-manager.service"

8、启动kube-controller-manager

ansible -i host master -m shell -a "systemctl daemon-reload"
ansible -i host master -m shell -a "systemctl enable kube-controller-manager"
ansible -i host master -m shell -a "systemctl start kube-controller-manager"
ansible -i host master -m shell -a "systemctl status kube-controller-manager"

9、查看kube-controller-manager 是否配置成功

kubectl get cs
[root@jenkins bin]# kubectl get cs
NAME                 STATUS    MESSAGE             ERROR
controller-manager   Healthy   ok                  
scheduler            Healthy   ok                  
etcd-4               Healthy   {"health":"true"}   
etcd-3               Healthy   {"health":"true"}   
etcd-5               Healthy   {"health":"true"}   
etcd-0               Healthy   {"health":"true"}   
etcd-1               Healthy   {"health":"true"}   
etcd-2               Healthy   {"health":"true"}   

10 、配置 kube-controller-manager，kubelet 、kube-scheduler 访问kube-api 用户授权

授予 kubernetes API 的权限
kubectl create clusterrolebinding controller-node-clusterrolebing --clusterrole=system:kube-controller-manager  --user=system:kube-controller-manager
kubectl create clusterrolebinding scheduler-node-clusterrolebing  --clusterrole=system:kube-scheduler --user=system:kube-scheduler
kubectl create clusterrolebinding controller-manager:system:auth-delegator --user system:kube-controller-manager --clusterrole system:auth-delegator
授予 kubernetes 证书访问 kubelet API 的权限
kubectl create clusterrolebinding --user system:serviceaccount:kube-system:default kube-system-cluster-admin --clusterrole cluster-admin
kubectl create clusterrolebinding kubelet-node-clusterbinding --clusterrole=system:node --group=system:nodes
kubectl create clusterrolebinding kube-apiserver:kubelet-apis --clusterrole=system:kubelet-api-admin --user kubernetes

下一篇： Kubernetes 生产环境安装部署 基于 Kubernetes v1.14.0 之 kubelet部署