Kubernetes集群部署之四Master节点部署

72 阅读 0 评论 48 点赞

我是靠谱客的博主飞快大地，最近开发中收集的这篇文章主要介绍Kubernetes集群部署之四Master节点部署，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

Kubernetes Master节点部署三个服务：kube-apiserver、kube-controller-manager、kube-scheduler和一个命令工具kubectl.

Master节点来负责整个集群的管理和控制，其中

kube-apiserver 服务提供了HTTP Rest接口的关键服务进程，是Kuberneters里所有资源的增删改查等操作的唯一入口，也是集群控制的入口进程.

kube-controller-manager 服务是kubernetes里面所有资源对象的自动化控制中心，可以理解为资源对象的”大总管”

kube-scheduler 服务负责资源调度(pod调度)的进程，相当于公交公司的”调度室”。

Kubernetes API服务部署：

1.准备软件包,软件包有两种下载方式:

方式一(推荐使用):

从https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md 页面下载 client 或 server tar包文件.

[root@k8s-master ~]# cd /usr/local/src/
[root@k8s-master src]# wget https://dl.k8s.io/v1.10.1/kubernetes.tar.gz
[root@k8s-master src]# wget https://dl.k8s.io/v1.10.1/kubernetes-server-linux-amd64.tar.gz
[root@k8s-master src]# wget https://dl.k8s.io/v1.10.1/kubernetes-client-linux-amd64.tar.gz
[root@k8s-master src]# wget https://dl.k8s.io/v1.10.1/kubernetes-node-linux-amd64.tar.gz

方式二：

准备软件包从github release 页面下载发布版tar包,解压后再执行下载脚本.

[root@k8s-master ~]# cd /usr/local/src/
[root@k8s-master src]#wget https://github.com/kubernetes/kubernetes/releases/download/v1.10.3/kubernetes.tar.gz
[root@k8s-master src]# tar -zxvf kubernetes.tar.gz
[root@k8s-master src]# ll
total 2664
drwxr-xr-x 9 root root
156 May 21 18:16 kubernetes
-rw-r--r-- 1 root root 2726918 May 21 19:15 kubernetes.tar.gz
[root@k8s-master src]# cd kubernetes/cluster/
[root@k8s-master cluster]# ./get-kube-binaries.sh
...

解压安装包,并添加可执行文件：

[root@k8s-master kubernetes]# cd /usr/local/src/kubernetes
[root@k8s-master kubernetes]#cp server/bin/kube-apiserver /opt/kubernetes/bin/
[root@k8s-master kubernetes]#cp server/bin/kube-controller-manager /opt/kubernetes/bin/
[root@k8s-master kubernetes]#cp server/bin/kube-scheduler /opt/kubernetes/bin/

2.创建生成CSR的 JSON 配置文件:

[root@k8s-master ssl]# cd /usr/local/src/ssl/
[root@k8s-master ssl]# cat > kubernetes-csr.json <<EOF
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"10.200.3.105",
"10.1.0.1",
"10.254.0.2",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF

3.生成 kubernetes 证书和私钥,并分发到所以节点.

[root@k8s-master src]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem 
-ca-key=/opt/kubernetes/ssl/ca-key.pem 
-config=/opt/kubernetes/ssl/ca-config.json 
-profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
[root@k8s-master ssl]# cp kubernetes*.pem /opt/kubernetes/ssl/
[root@k8s-master ssl]# scp kubernetes*.pem 10.200.3.106:/opt/kubernetes/ssl/
[root@k8s-master ssl]# scp kubernetes*.pem 10.200.3.107:/opt/kubernetes/ssl/

4.创建 kube-apiserver 使用的客户端 token 文件

[root@k8s-master ~]# head -c 16 /dev/urandom | od -An -t x | tr -d ' '
10a89e49bc403bce8fb134e5a2ae82f1
[root@k8s-master ~]# vim /opt/kubernetes/ssl/bootstrap-token.csv
10a89e49bc403bce8fb134e5a2ae82f1,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

5.创建基础用户名/密码认证配置(密码、用户名、uid为后面创建dashborad后用户认证)

[root@k8s-master ~]# vim /opt/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2

.6.部署Kubernetes API Server

[root@k8s-master ~]# cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target
[Service]
ExecStart=/opt/kubernetes/bin/kube-apiserver 
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction 
--bind-address=10.200.3.105 
--insecure-bind-address=127.0.0.1 
--authorization-mode=Node,RBAC 
--runtime-config=rbac.authorization.k8s.io/v1 
--kubelet-https=true 
--anonymous-auth=false 
--basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv 
--enable-bootstrap-token-auth 
--token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv 
--service-cluster-ip-range=10.1.0.0/16 
--service-node-port-range=20000-40000 
--tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem 
--tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem 
--client-ca-file=/opt/kubernetes/ssl/ca.pem 
--service-account-key-file=/opt/kubernetes/ssl/ca-key.pem 
--etcd-cafile=/opt/kubernetes/ssl/ca.pem 
--etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem 
--etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem 
--etcd-servers=https://10.200.3.105:2379,https://10.200.3.106:2379,https://10.200.3.107:2379 
--enable-swagger-ui=true 
--allow-privileged=true 
--audit-log-maxage=30 
--audit-log-maxbackup=3 
--audit-log-maxsize=100 
--audit-log-path=/opt/kubernetes/log/api-audit.log 
--event-ttl=1h 
--v=2 
--logtostderr=false 
--log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF

7.启动API Server服务

[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl enable kube-apiserver
[root@k8s-master ~]# systemctl start kube-apiserver
[root@k8s-master ~]# systemctl status kube-apiserver

部署Controller Manager服务

[root@k8s-master ~]# cat > /usr/lib/systemd/system/kube-controller-manager.service <<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-controller-manager 
--address=127.0.0.1 
--master=http://127.0.0.1:8080 
--allocate-node-cidrs=true 
--service-cluster-ip-range=10.1.0.0/16 
--cluster-cidr=10.2.0.0/16 
--cluster-name=kubernetes 
--cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem 
--cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem 
--service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem 
--root-ca-file=/opt/kubernetes/ssl/ca.pem 
--leader-elect=true 
--v=2 
--logtostderr=false 
--log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF

启动Controller Manager

[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl enable kube-controller-manager
[root@k8s-master ~]# systemctl start kube-controller-manager
[root@k8s-master ~]# systemctl status kube-controller-manager

部署Kubernetes Scheduler:

[root@k8s-master ~]# cat > /usr/lib/systemd/system/kube-scheduler.service <<EOF
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-scheduler 
--address=127.0.0.1 
--master=http://127.0.0.1:8080 
--leader-elect=true 
--v=2 
--logtostderr=false 
--log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF

启动Kubernetes Scheduler

[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl enable kube-scheduler
[root@k8s-master ~]# systemctl start kube-scheduler
[root@k8s-master ~]# systemctl status kube-scheduler

部署kubectl 命令行工具

1.准备二进制命令包

[root@k8s-master ~]# cd /usr/local/src/kubernetes/client/bin/
[root@k8s-master bin]# cp kubectl /opt/kubernetes/bin/

2.创建 admin 证书签名请求

[root@k8s-master ~]# cd /usr/local/src/ssl/
[root@k8s-master ssl]# cat > admin-csr.json <<EOF
{
"CN": "admin",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:masters",
"OU": "System"
}
]
}
EOF

3.生成 admin 证书和私钥：

[root@k8s-master ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem 
-ca-key=/opt/kubernetes/ssl/ca-key.pem 
-config=/opt/kubernetes/ssl/ca-config.json 
-profile=kubernetes admin-csr.json | cfssljson -bare admin
[root@k8s-master ssl]# ls -l admin*
-rw-r--r-- 1 root root 1009 May 31 10:29 admin.csr
-rw-r--r-- 1 root root
230 May 31 10:21 admin-csr.json
-rw------- 1 root root 1679 May 31 10:29 admin-key.pem
-rw-r--r-- 1 root root 1399 May 31 10:29 admin.pem
[root@k8s-master ssl]# cp
admin*.pem /opt/kubernetes/ssl/
[root@k8s-master ssl]#

4.设置集群参数

[root@k8s-master ssl]# kubectl config set-cluster kubernetes 
--certificate-authority=/opt/kubernetes/ssl/ca.pem 
--embed-certs=true 
--server=https://10.200.3.105:6443
Cluster "kubernetes" set.Cluster "kubernetes" set.

5.设置客户端认证参数

[root@k8s-master ssl]# kubectl config set-credentials admin 
--client-certificate=/opt/kubernetes/ssl/admin.pem 
--embed-certs=true 
--client-key=/opt/kubernetes/ssl/admin-key.pem
User "admin" set.

6.设置上下文参数

[root@k8s-master ssl]# kubectl config set-context kubernetes 
--cluster=kubernetes 
--user=admin
Context "kubernetes" created.

7.设置默认上下文

[root@k8s-master ssl]# kubectl config use-context kubernetes
Switched to context "kubernetes".

8.使用kubectl工具

[root@k8s-master ssl]# kubectl get cs
NAME
STATUS
MESSAGE
ERROR
scheduler
Healthy
ok
controller-manager
Healthy
ok
etcd-0
Healthy
{"health": "true"}
etcd-2
Healthy
{"health": "true"}
etcd-1
Healthy
{"health": "true"}
[root@k8s-master ssl]#

9.验证master节点功能：

# kubectl get componentstatuses
NAME
STATUS
MESSAGE
ERROR
controller-manager
Healthy
ok
scheduler
Healthy
ok
etcd-1
Healthy
{"health": "true"}
etcd-0
Healthy
{"health": "true"}
etcd-2
Healthy
{"health": "true"}