k8s部署篇之node节点部署（k8s篇四）

时间  2020-06-21 标签 k8s 部署 node 节点

文章目录

node 节点部署

部署 kubelet 组件

解压node节点压缩包，并将其中的二进制文件发送到指定位置node

tar -zxvf kubernetes-node-linux-amd64.tar.gz
 mkdir /k8s/node/{bin,ssl,config} -p
 cd kubernetes/node/bin/
 cp kubelet kube-proxy /k8s/node/bin/
建立 配置文件
  • 建立 kubelet bootstrapping.kubeconfig 文件 设置集群参数（server是api地址）
./kubectl config set-cluster kubernetes \
    --certificate-authority=/k8s/node/ssl/ca.pem \
    --embed-certs=true \
    --server=https://192.168.1.250:6443 \
    --kubeconfig=bootstrap.kubeconfig
  • 设置客户端认证参数(token即是以前master生成的)
./kubectl config set-credentials kubelet-bootstrap \
  --token=1aef0e8e0b24943e3b86db2d01afcc15 \
  --kubeconfig=bootstrap.kubeconfig
  • 设置上下文参数
./kubectl config set-context default \
  --cluster=kubernetes \
  --user=kubelet-bootstrap \
  --kubeconfig=bootstrap.kubeconfig
  • 设置默认上下文
./kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
  • 将bootstrap kubeconfig 文件拷贝到全部 nodes节点
cp bootstrap.kubeconfig  /k8s/node/config/
scp bootstrap.kubeconfig  192.168.1.252:/k8s/node/config/
  • 建立 kubelet 参数配置模板文件
vi /k8s/node/config/kubelet.config
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 192.168.1.251
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS: ["10.0.0.2"]
clusterDomain: cluster.local.
failSwapOn: false
authentication:
  anonymous:
    enabled: true
建立 unit 文件
  • 建立kubelet配置文件
vi /k8s/node/config/kubelet

KUBELET_OPTS="--logtostderr=true \ --v=4 \ --hostname-override=192.168.1.251 \ --kubeconfig=/k8s/node/config/kubelet.kubeconfig \ --bootstrap-kubeconfig=/k8s/node/config/bootstrap.kubeconfig \ --config=/k8s/node/config/kubelet.config \ --cert-dir=/k8s/node/ssl \ --pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"

建立应用linux

vi /usr/lib/systemd/system/kubelet.service 

[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=/k8s/node/config/kubelet
ExecStart=/k8s/node/bin/kubelet $KUBELET_OPTS
Restart=on-failure
KillMode=process

[Install]
WantedBy=multi-user.target
绑定角色(master节点运行)
./kubectl create clusterrolebinding kubelet-bootstrap \
  --clusterrole=system:node-bootstrapper \
  --user=kubelet-bootstrap
启动服务
systemctl daemon-reload
systemctl enable kubelet
systemctl restart kubelet
验证成功状态
systemctl status kubelet
查看csr请求 注意是在master上执行

能够看到有一个未批准的证书web

[root@node9 bin]# kubectl get csr
NAME                                                   AGE   REQUESTOR           CONDITION
node-csr-8kntaktl8b6rd8gkRsnTI0x9JPEQTbSqD2mCqiDNbmc   18m   kubelet-bootstrap   Pending

在这里插入图片描述

复制文件到另外一节点并修改ip
cd /k8s/node/
 scp -r  *  192.168.1.252:/k8s/node/
 scp /usr/lib/systemd/system/kubelet.service  192.168.1.252:/usr/lib/systemd/system/kubelet.service
批准kubelet的TLS证书请求

再次查看csr请求能够看到两个节点都存在了
在这里插入图片描述
执行批准命令docker

kubectl get csr|grep 'Pending' | awk 'NR>0{print $1}'| xargs kubectl certificate approve
kubectl get csr

能够看到两个节点状态是批准的了
在这里插入图片描述shell

能够为某一节点设置角色
##master 角色
kubectl label node 192.168.1.250  node-role.kubernetes.io/master='master'
kubectl label node 192.168.1.251   node-role.kubernetes.io/node='node'
kubectl label node 192.168.1.252  node-role.kubernetes.io/node='node'
##删除某一个
kubectl label node/192.168.1.252  node-role.kubernetes.io/node-
部署 kube-proxy 组件
生成证书
  • 建立kube-proxy证书
cat << EOF | tee kube-proxy-csr.json
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "beijing",
      "ST": "beijing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=/k8s/node/ssl/ca.pem \
   -ca-key=/k8s/node/ssl/ca-key.pem \
   -config=/home/sslTools/ssl/ca-config.json \
   -profile=k8s  kube-proxy-csr.json | cfssljson -bare kube-proxy

 cp kube-proxy* /k8s/node/ssl/
安装LVS
yum install -y ipvsadm ipset conntrack
建立 kube-proxy 配置文件
# 建立kube-proxy kubeconfig文件
 
/home/k8stools/kubernetes/node/bin/kubectl config set-cluster kubernetes \
  --certificate-authority=/k8s/node/ssl/ca.pem \
  --embed-certs=true \
  --server=https://192.168.1.250:6443 \
  --kubeconfig=kube-proxy.kubeconfig

/home/k8stools/kubernetes/node/bin/kubectl config set-credentials kube-proxy \
  --client-certificate=/k8s/node/ssl/kube-proxy.pem \
  --client-key=/k8s/node/ssl/kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-proxy.kubeconfig

/home/k8stools/kubernetes/node/bin/kubectl config set-context default \
  --cluster=kubernetes \
  --user=kube-proxy \
  --kubeconfig=kube-proxy.kubeconfig

/home/k8stools/kubernetes/node/bin/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

 cp kube-proxy* /k8s/node/ssl/
 cp kube-proxy.kubeconfig  /k8s/node/config/

配置文件建立json

vi /k8s/node/config/kube-proxy

KUBE_PROXY_OPTS="--logtostderr=true \ --v=4 \ --hostname-override=192.168.1.251 \ --cluster-cidr=10.0.0.0/24 \ --kubeconfig=/k8s/node/config/kube-proxy.kubeconfig"
建立kube-proxy systemd unit 文件
vi /usr/lib/systemd/system/kube-proxy.service 

[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
EnvironmentFile=-/k8s/node/config/kube-proxy
ExecStart=/k8s/node/bin/kube-proxy $KUBE_PROXY_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
启动服务
systemctl daemon-reload
systemctl enable kube-proxy
systemctl restart kube-proxy
验证状态
systemctl status kube-proxy

ok,将所需文件传输到另外一节点上一样方式启动验证。注意更改 /k8s/node/config/kube-proxy 文件的hostname-override 属性bootstrap

至此，node节点所有配置结束
联系我们 沪ICP备13005482号-10