k8s笔记2-kubernetes master组件配置

参考自：http://blog.51cto.com/lizhenliang/2325770
部署kubernetes之前，要保证etcd、flannel、docker的正常工作。

在master节点部署组件

三个组件：
kube-apiserver、kube-controller-manager、kube-scheduler
必须先配置apiserver。

1、首先生成自签证书

# 在k8s中创建自签证书的存放文件夹k8s-cert，///mkdir k8s-cert
cd k8s/k8s-cert
./k8s-cert.sh #生成自签证书

# cat k8s-cert.sh
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
      	    "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

#-----------------------

cat > server-csr.json <<EOF
{
    "CN": "kubernetes",
    "hosts": [
      "10.0.0.1", # api-server集群内部IP，不变
      "127.0.0.1", #不变
      "10.0.3.171", # 加载master地址，包括LB负载均衡器的地址（多master集群时记得修改）
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

#-----------------------

cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

检查生成的证书

ls *pem
#------生成以下证书
ca-key.pem  ca.pem  kube-proxy-key.pem  kube-proxy.pem  server-key.pem  server.pem

2、在master节点部署apiserver组件

下载kubernetes二进制包，选择一个稳定版1.12.1
在kubernetes网页中复制链接地址，并下载

cd k8s/soft
wget https://dl.k8s.io/v1.12.1/kubernetes-server-linux-amd64.tar.gz

mkdir /opt/kubernetes/{bin,cfg,ssl} -p
tar zxvf kubernetes-server-linux-amd64.tar.gz
cd kubernetes/server/bin
cp kube-apiserver kube-scheduler kube-controller-manager kubectl /opt/kubernetes/bin

由于apiserver配置文件需要用到自签证书，这里先将需要的证书拷贝到相应的位置

cp /root/k8s/k8s-cert/{ca,ca-key,server,server-key}.pem /opt/kubernetes/ssl/

可随机生成一个32位字符串，用以创建一个token文件：

head -c 16 /dev/urandom |od -An -t x |tr -d ' '

#vi /opt/kubernetes/cfg/token.csv
#token的格式为：(第一列)随机字符串，(第二列)用户名，(第三列)UID，(第四列)用户名
eacee0f07c4b0866b37c577e6056f876,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

创建apiserver配置文件，并执行

./apiserver.sh 10.0.3.171 https://10.0.3.171:2379,https://10.0.3.104:2379,https://10.0.3.150:2379
# etcd-server地址，可在node中通过cat /opt/kubernetes/cfg/flanneld查看

#cat apiserver.sh
#!/bin/bash

MASTER_ADDRESS=$1
ETCD_SERVERS=$2

cat <<EOF >/opt/kubernetes/cfg/kube-apiserver

KUBE_APISERVER_OPTS="--logtostderr=true \\
--v=4 \\
--etcd-servers=${ETCD_SERVERS} \\
--bind-address=${MASTER_ADDRESS} \\
--secure-port=6443 \\
--advertise-address=${MASTER_ADDRESS} \\
--allow-privileged=true \\
--service-cluster-ip-range=10.0.0.0/24 \\
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction \\
--authorization-mode=RBAC,Node \\
--kubelet-https=true \\
--enable-bootstrap-token-auth \\
--token-auth-file=/opt/kubernetes/cfg/token.csv \\
--service-node-port-range=30000-50000 \\
--tls-cert-file=/opt/kubernetes/ssl/server.pem  \\
--tls-private-key-file=/opt/kubernetes/ssl/server-key.pem \\
--client-ca-file=/opt/kubernetes/ssl/ca.pem \\
--service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \\
--etcd-cafile=/opt/etcd/ssl/ca.pem \\
--etcd-certfile=/opt/etcd/ssl/server.pem \\
--etcd-keyfile=/opt/etcd/ssl/server-key.pem"
# etcd的证书要配置好，莫忘
EOF

cat <<EOF >/usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver
ExecStart=/opt/kubernetes/bin/kube-apiserver \$KUBE_APISERVER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kube-apiserver
systemctl restart kube-apiserver

查看日志，及apiserver进程

tail /var/log/messages -f
ps -ef |grep apiserver

3、部署scheduler组件

./scheduler.sh 127.0.0.1

#vi scheduler.sh
#!/bin/bash

MASTER_ADDRESS=$1

cat <<EOF >/opt/kubernetes/cfg/kube-scheduler

KUBE_SCHEDULER_OPTS="--logtostderr=true \\
--v=4 \\
--master=${MASTER_ADDRESS}:8080 \\
--leader-elect"
# master连接本地apiserver
# leader-elect当该组件启动多个时，自动选举

EOF

cat <<EOF >/usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-scheduler
ExecStart=/opt/kubernetes/bin/kube-scheduler \$KUBE_SCHEDULER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF
# 启动
systemctl daemon-reload
systemctl enable kube-scheduler
systemctl restart kube-scheduler

查看监听

ss -antp |grep 8080 |grep LISTEN

4、部署controler-manage组件

./controller-manager.sh 127.0.0.1

# vi controller-manager.sh
#!/bin/bash

MASTER_ADDRESS=$1
#创建controller-manager配置文件
cat <<EOF >/opt/kubernetes/cfg/kube-controller-manager

KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=true \\
--v=4 \\
--master=${MASTER_ADDRESS}:8080 \\
--leader-elect=true \\
--address=127.0.0.1 \\
--service-cluster-ip-range=10.0.0.0/24 \\
--cluster-name=kubernetes \\
--cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \\
--cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem  \\
--root-ca-file=/opt/kubernetes/ssl/ca.pem \\
--service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \\
--experimental-cluster-signing-duration=87600h0m0s"

EOF

#systemd管理controller-manager组件
cat <<EOF >/usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-controller-manager
ExecStart=/opt/kubernetes/bin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

#启动
systemctl daemon-reload
systemctl enable kube-controller-manager
systemctl restart kube-controller-manager

查看kube启动组件及通过kubectl工具查看当前集群组件状态

ps -ef |grep kube
/opt/kubernetes/bin/kubectl get cs

=========================
配置多master集群时
在master01主机上，拷贝相关文件到master02上

scp -r /opt/kubernetes/ [email protected]:/opt/
scp /usr/lib/systemd/system/{kube-apiserver,kube-scheduler,kube-controller-manager}.service [email protected]:/usr/lib/systemd/system

在master02上修改地址

cd /opt/kubernetes/cfg
vi kube-apiserver

启动

systemctl daemon-reload
systemctl start kube-apiserver
systemctl start kube-scheduler
systemctl start kube-controller-manager
/opt/kubernetes/bin/kubectl get cs