Kubernetes部署(六):Master节点部署
发布时间:2020-12-14 05:18:36 所属栏目:大数据 来源:网络整理
导读:1.部署Kubernetes API服务部署 0.准备软件包 [[email?protected] ~]# cd /usr/local/src/kubernetes[[email?protected] kubernetes]# cp server/bin/kube-apiserver /data/kubernetes/bin/[[email?protected] kubernetes]# cp server/bin/kube-controller-ma
1.部署Kubernetes API服务部署
0.准备软件包[[email?protected] ~]# cd /usr/local/src/kubernetes [[email?protected] kubernetes]# cp server/bin/kube-apiserver /data/kubernetes/bin/ [[email?protected] kubernetes]# cp server/bin/kube-controller-manager /data/kubernetes/bin/ [[email?protected] kubernetes]# cp server/bin/kube-scheduler /data/kubernetes/bin/ [[email?protected] kubernetes]# scp server/bin/kube-apiserver 10.31.90.202:/data/kubernetes/bin/ [[email?protected] kubernetes]# scp server/bin/kube-apiserver 10.31.90.203:/data/kubernetes/bin/ [[email?protected] kubernetes]# scp server/bin/kube-controller-manager 10.31.90.202:/data/kubernetes/bin/ [[email?protected] kubernetes]# scp server/bin/kube-controller-manager 10.31.90.203:/data/kubernetes/bin/ [[email?protected] kubernetes]# scp server/bin/kube-scheduler 10.31.90.202:/data/kubernetes/bin [[email?protected] kubernetes]# scp server/bin/kube-scheduler 10.31.90.203:/data/kubernetes/bin/ 1.创建生成CSR的 JSON 配置文件[[email?protected] src]# vim kubernetes-csr.json { "CN": "kubernetes","hosts": [ "127.0.0.1","10.31.90.200","10.31.90.201","10.31.90.202","10.31.90.203","10.1.0.1","kubernetes","kubernetes.default","kubernetes.default.svc","kubernetes.default.svc.cluster","kubernetes.default.svc.cluster.local" ],"key": { "algo": "rsa","size": 2048 },"names": [ { "C": "CN","ST": "BeiJing","L": "BeiJing","O": "k8s","OU": "System" } ] } 2.生成 kubernetes 证书和私钥[[email?protected] src]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem -ca-key=/data/kubernetes/ssl/ca-key.pem -config=/data/kubernetes/ssl/ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes [[email?protected] ssl]# cp kubernetes*.pem /data/kubernetes/ssl/ [[email?protected] ssl]# scp kubernetes*.pem 10.31.90.202:/data/kubernetes/ssl/ [[email?protected] ssl]# scp kubernetes*.pem 10.31.90.203:/data/kubernetes/ssl/ 3.创建 kube-apiserver 使用的客户端 token 文件[[email?protected] ssl]# head -c 16 /dev/urandom | od -An -t x | tr -d ‘ ‘ cf25becebf64e3fffd7f3890a60ac16d [[email?protected] ssl]# vim /data/kubernetes/ssl/bootstrap-token.csv cf25becebf64e3fffd7f3890a60ac16d,kubelet-bootstrap,10001,"system:kubelet-bootstrap" [[email?protected] ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.202:/data/kubernetes/ssl/ [[email?protected] ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.203:/data/kubernetes/ssl/ 4.创建基础用户名/密码认证配置[[email?protected] ssl]# vim /data/kubernetes/ssl/basic-auth.csv admin,admin,1 readonly,readonly,2 [[email?protected] ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.202:/data/kubernetes/ssl/ [[email?protected] ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.203:/data/kubernetes/ssl/ 5.部署Kubernetes API Server三个master节点都需要部署 [[email?protected] ~]# vim /usr/lib/systemd/system/kube-apiserver.service [Unit] Description=Kubernetes API Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes After=network.target [Service] ExecStart=/data/kubernetes/bin/kube-apiserver --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction --bind-address=10.31.90.201 --insecure-bind-address=10.31.90.201 --authorization-mode=Node,RBAC --runtime-config=rbac.authorization.k8s.io/v1 --kubelet-https=true --anonymous-auth=false --basic-auth-file=/data/kubernetes/ssl/basic-auth.csv --enable-bootstrap-token-auth --token-auth-file=/data/kubernetes/ssl/bootstrap-token.csv --service-cluster-ip-range=10.1.0.0/16 --service-node-port-range=20000-40000 --tls-cert-file=/data/kubernetes/ssl/kubernetes.pem --tls-private-key-file=/data/kubernetes/ssl/kubernetes-key.pem --client-ca-file=/data/kubernetes/ssl/ca.pem --service-account-key-file=/data/kubernetes/ssl/ca-key.pem --etcd-cafile=/data/kubernetes/ssl/ca.pem --etcd-certfile=/data/kubernetes/ssl/kubernetes.pem --etcd-keyfile=/data/kubernetes/ssl/kubernetes-key.pem --etcd-servers=https://10.31.90.201:2379,https://10.31.90.202:2379,https://10.31.90.203:2379 --enable-swagger-ui=true --allow-privileged=true --audit-log-maxage=30 --audit-log-maxbackup=3 --audit-log-maxsize=100 --audit-log-path=/data/kubernetes/log/api-audit.log --event-ttl=1h --v=2 --logtostderr=false --log-dir=/data/kubernetes/log Restart=on-failure RestartSec=5 Type=notify LimitNOFILE=65536 [Install] WantedBy=multi-user.target 6.启动API Server服务[[email?protected] ~]# systemctl daemon-reload [[email?protected] ~]# systemctl enable kube-apiserver [[email?protected] ~]# systemctl start kube-apiserver 查看API Server服务状态 [[email?protected] ~]# systemctl status kube-apiserver 部署Controller Manager服务三个master节点都需要部署 [[email?protected] ~]# vim /usr/lib/systemd/system/kube-controller-manager.service [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/data/kubernetes/bin/kube-controller-manager --address=127.0.0.1 --master=http://10.31.90.200:8080 --allocate-node-cidrs=true --service-cluster-ip-range=10.1.0.0/16 --cluster-cidr=10.2.0.0/16 --cluster-name=kubernetes --cluster-signing-cert-file=/data/kubernetes/ssl/ca.pem --cluster-signing-key-file=/data/kubernetes/ssl/ca-key.pem --service-account-private-key-file=/data/kubernetes/ssl/ca-key.pem --root-ca-file=/data/kubernetes/ssl/ca.pem --leader-elect=true --v=2 --logtostderr=false --log-dir=/data/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target 3.启动Controller Manager[[email?protected] ~]# systemctl daemon-reload [[email?protected] scripts]# systemctl enable kube-controller-manager [[email?protected] scripts]# systemctl start kube-controller-manager 4.查看服务状态[[email?protected] scripts]# systemctl status kube-controller-manager 部署Kubernetes Scheduler三个master节点都需要部署 [[email?protected] ~]# vim /usr/lib/systemd/system/kube-scheduler.service [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/data/kubernetes/bin/kube-scheduler --address=127.0.0.1 --master=http://10.31.90.200:8080 --leader-elect=true --v=2 --logtostderr=false --log-dir=/data/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target 2.部署服务[[email?protected] ~]# systemctl daemon-reload [[email?protected] ~]# systemctl enable kube-scheduler [[email?protected] ~]# systemctl start kube-scheduler [[email?protected] ~]# systemctl status kube-scheduler 部署kubectl 命令行工具这只需在其中一台部署即可,用来管理k8s集群。 1.准备二进制命令包 [[email?protected] ~]# cd /usr/local/src/kubernetes/client/bin [[email?protected] bin]# cp kubectl /opt/kubernetes/bin/ 2.创建 admin 证书签名请求 [[email?protected] ~]# cd /usr/local/src/ssl/ [[email?protected] ssl]# vim admin-csr.json { "CN": "admin","hosts": [],"O": "system:masters","OU": "System" } ] } 3.生成 admin 证书和私钥: [[email?protected] ssl]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem -ca-key=/data/kubernetes/ssl/ca-key.pem -config=/data/kubernetes/ssl/ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin [[email?protected] ssl]# ls -l admin* [[email?protected] ssl]# ls -l admin* -rw-r--r-- 1 root root 1009 Dec 25 11:26 admin.csr -rw-r--r-- 1 root root 229 Dec 25 11:24 admin-csr.json -rw------- 1 root root 1679 Dec 25 11:26 admin-key.pem -rw-r--r-- 1 root root 1399 Dec 25 11:26 admin.pem [[email?protected] ssl]# cp admin*.pem /data/kubernetes/ssl/ 4.设置集群参数 [[email?protected] src]# kubectl config set-cluster kubernetes --certificate-authority=/data/kubernetes/ssl/ca.pem --embed-certs=true --server=https://10.31.90.200:6443 Cluster "kubernetes" set. 5.设置客户端认证参数 [[email?protected] ssl]# kubectl config set-credentials admin --client-certificate=/data/kubernetes/ssl/admin.pem --embed-certs=true --client-key=/data/kubernetes/ssl/admin-key.pem User "admin" set. 6.设置上下文参数 [[email?protected] ssl]# kubectl config set-context kubernetes --cluster=kubernetes --user=admin Context "kubernetes" created. 7.设置默认上下文 [[email?protected] src]# kubectl config use-context kubernetes Switched to context "kubernetes". 8.使用kubectl工具 [[email?protected] ssl]# kubectl get cs NAME STATUS MESSAGE ERROR scheduler Healthy ok controller-manager Healthy ok etcd-1 Healthy {"health": "true"} etcd-0 Healthy {"health": "true"} etcd-2 Healthy {"health": "true"} 后续会陆续更新所有的安装文档,如果你觉得我写的不错,希望大家多多关注点赞,非常感谢! (编辑:李大同) 【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容! |