Kubernetes部署（六）：Master节点部署

1.部署Kubernetes API服务部署

0.准备软件包

[[email protected] ~]# cd /usr/local/src/kubernetes
[[email protected] kubernetes]# cp server/bin/kube-apiserver /data/kubernetes/bin/
[[email protected] kubernetes]# cp server/bin/kube-controller-manager /data/kubernetes/bin/
[[email protected] kubernetes]# cp server/bin/kube-scheduler /data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-apiserver 10.31.90.202:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-apiserver 10.31.90.203:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-controller-manager 10.31.90.202:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-controller-manager 10.31.90.203:/data/kubernetes/bin/
[[email protected] kubernetes]# scp server/bin/kube-scheduler 10.31.90.202:/data/kubernetes/bin
[[email protected] kubernetes]# scp server/bin/kube-scheduler 10.31.90.203:/data/kubernetes/bin/

1.创建生成CSR的 JSON 配置文件

[[email protected] src]# vim kubernetes-csr.json
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "10.31.90.200",
    "10.31.90.201",
    "10.31.90.202",
    "10.31.90.203",
    "10.1.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

2.生成 kubernetes 证书和私钥

 [[email protected] src]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem    -ca-key=/data/kubernetes/ssl/ca-key.pem    -config=/data/kubernetes/ssl/ca-config.json    -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
[[email protected] ssl]# cp kubernetes*.pem /data/kubernetes/ssl/
[[email protected] ssl]# scp kubernetes*.pem 10.31.90.202:/data/kubernetes/ssl/
[[email protected] ssl]# scp kubernetes*.pem 10.31.90.203:/data/kubernetes/ssl/

3.创建 kube-apiserver 使用的客户端 token 文件

[[email protected] ssl]# head -c 16 /dev/urandom | od -An -t x | tr -d ‘ ‘
cf25becebf64e3fffd7f3890a60ac16d
[[email protected] ssl]# vim /data/kubernetes/ssl/bootstrap-token.csv
cf25becebf64e3fffd7f3890a60ac16d,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
[[email protected] ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.202:/data/kubernetes/ssl/
[[email protected] ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.203:/data/kubernetes/ssl/

4.创建基础用户名/密码认证配置

[[email protected] ssl]# vim /data/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2
[[email protected] ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.202:/data/kubernetes/ssl/
[[email protected] ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.203:/data/kubernetes/ssl/

5.部署Kubernetes API Server

三个master节点都需要部署

[[email protected] ~]# vim /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target

[Service]
ExecStart=/data/kubernetes/bin/kube-apiserver   --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction   --bind-address=10.31.90.201   --insecure-bind-address=10.31.90.201   --authorization-mode=Node,RBAC   --runtime-config=rbac.authorization.k8s.io/v1   --kubelet-https=true   --anonymous-auth=false   --basic-auth-file=/data/kubernetes/ssl/basic-auth.csv   --enable-bootstrap-token-auth   --token-auth-file=/data/kubernetes/ssl/bootstrap-token.csv   --service-cluster-ip-range=10.1.0.0/16   --service-node-port-range=20000-40000   --tls-cert-file=/data/kubernetes/ssl/kubernetes.pem   --tls-private-key-file=/data/kubernetes/ssl/kubernetes-key.pem   --client-ca-file=/data/kubernetes/ssl/ca.pem   --service-account-key-file=/data/kubernetes/ssl/ca-key.pem   --etcd-cafile=/data/kubernetes/ssl/ca.pem   --etcd-certfile=/data/kubernetes/ssl/kubernetes.pem   --etcd-keyfile=/data/kubernetes/ssl/kubernetes-key.pem   --etcd-servers=https://10.31.90.201:2379,https://10.31.90.202:2379,https://10.31.90.203:2379   --enable-swagger-ui=true   --allow-privileged=true   --audit-log-maxage=30   --audit-log-maxbackup=3   --audit-log-maxsize=100   --audit-log-path=/data/kubernetes/log/api-audit.log   --event-ttl=1h   --v=2   --logtostderr=false   --log-dir=/data/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

6.启动API Server服务

[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-apiserver
[[email protected] ~]# systemctl start kube-apiserver

查看API Server服务状态

[[email protected] ~]# systemctl status kube-apiserver

部署Controller Manager服务

三个master节点都需要部署

[[email protected] ~]# vim /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/data/kubernetes/bin/kube-controller-manager   --address=127.0.0.1   --master=http://10.31.90.200:8080   --allocate-node-cidrs=true   --service-cluster-ip-range=10.1.0.0/16   --cluster-cidr=10.2.0.0/16   --cluster-name=kubernetes   --cluster-signing-cert-file=/data/kubernetes/ssl/ca.pem   --cluster-signing-key-file=/data/kubernetes/ssl/ca-key.pem   --service-account-private-key-file=/data/kubernetes/ssl/ca-key.pem   --root-ca-file=/data/kubernetes/ssl/ca.pem   --leader-elect=true   --v=2   --logtostderr=false   --log-dir=/data/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

3.启动Controller Manager

[[email protected] ~]# systemctl daemon-reload
[[email protected] scripts]# systemctl enable kube-controller-manager
[[email protected] scripts]# systemctl start kube-controller-manager

4.查看服务状态

[[email protected] scripts]# systemctl status kube-controller-manager

部署Kubernetes Scheduler

三个master节点都需要部署

[[email protected] ~]# vim /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/data/kubernetes/bin/kube-scheduler   --address=127.0.0.1   --master=http://10.31.90.200:8080   --leader-elect=true   --v=2   --logtostderr=false   --log-dir=/data/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

2.部署服务

[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-scheduler
[[email protected] ~]# systemctl start kube-scheduler
[[email protected] ~]# systemctl status kube-scheduler

部署kubectl 命令行工具

这只需在其中一台部署即可，用来管理k8s集群。

1.准备二进制命令包

[[email protected] ~]# cd /usr/local/src/kubernetes/client/bin
[[email protected] bin]# cp kubectl /opt/kubernetes/bin/

2.创建 admin 证书签名请求

[[email protected] ~]# cd /usr/local/src/ssl/
[[email protected] ssl]# vim admin-csr.json
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}

3.生成 admin 证书和私钥：

[[email protected] ssl]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem    -ca-key=/data/kubernetes/ssl/ca-key.pem    -config=/data/kubernetes/ssl/ca-config.json    -profile=kubernetes admin-csr.json | cfssljson -bare admin
[[email protected] ssl]# ls -l admin*
[[email protected] ssl]# ls -l admin*
-rw-r--r-- 1 root root 1009 Dec 25 11:26 admin.csr
-rw-r--r-- 1 root root  229 Dec 25 11:24 admin-csr.json
-rw------- 1 root root 1679 Dec 25 11:26 admin-key.pem
-rw-r--r-- 1 root root 1399 Dec 25 11:26 admin.pem
[[email protected] ssl]# cp admin*.pem /data/kubernetes/ssl/

4.设置集群参数

[[email protected] src]# kubectl config set-cluster kubernetes    --certificate-authority=/data/kubernetes/ssl/ca.pem    --embed-certs=true    --server=https://10.31.90.200:6443
Cluster "kubernetes" set.

5.设置客户端认证参数

[[email protected] ssl]# kubectl config set-credentials admin    --client-certificate=/data/kubernetes/ssl/admin.pem    --embed-certs=true    --client-key=/data/kubernetes/ssl/admin-key.pem
User "admin" set.

6.设置上下文参数

[[email protected] ssl]# kubectl config set-context kubernetes    --cluster=kubernetes    --user=admin
Context "kubernetes" created.

7.设置默认上下文

[[email protected] src]# kubectl config use-context kubernetes
Switched to context "kubernetes".

8.使用kubectl工具

[[email protected] ssl]# kubectl get cs
NAME                 STATUS    MESSAGE              ERROR
scheduler            Healthy   ok
controller-manager   Healthy   ok
etcd-1               Healthy   {"health": "true"}
etcd-0               Healthy   {"health": "true"}
etcd-2               Healthy   {"health": "true"}

后续会陆续更新所有的安装文档，如果你觉得我写的不错，希望大家多多关注点赞，非常感谢！

原文地址：http://blog.51cto.com/billy98/2335161

时间： 2024-10-12 00:24:25

Kubernetes部署（六）：Master节点部署的相关文章

Kubernetes二进制部署——多master节点集群部署（2）

前言: 接上一篇单节点部署(1)部署多节点 部署环境 负载均衡Nginx1:192.168.13.128/24Nginx2:192.168.13.129/24Master节点master1:192.168.13.131/24 kube-apiserver kube-controller-manager kube-scheduler etcdmaster2:192.168.13.130/24 kube-apiserver kube-controller-manager kube-scheduler

OpenStack IceHouse 部署 - 4 - 计算节点部署

Nova计算服务(计算节点) 参考 本页内容依照官方安装文档进行,具体参见Configure a compute node(nova service) 前置工作 数据库 由于我们在Nova(计算管理)部署配置中使用了mysql数据库,所以移除本地sqlite数据库 sudo rm /var/lib/nova/nova.sqlite 修改vmlinuz权限 For security reasons, the Linux kernel is not readable by normal users

OpenStack IceHouse 部署 - 5 - 网络节点部署

Neutron网络服务(网络节点) 目录 [隐藏] 1 参考 2 前置工作 2.1 调整内核参数 3 安装 4 配置 4.1 keystone对接 4.2 rabbitmq对接 4.3 metadata服务对接 4.4 ML2插件配置 4.5 L3-agent 4.6 DHCP-agent 5 接口配置 6 服务更新 7 服务验证 8 附加配置 8.1 共享上网 8.1.1 iptables NAT 8.1.2 虚拟路由 参考 由于硬件条件所限并结合实际网络环境,本页并不是完全按照官方给出的指导

Kubernetes集群部署之五node节点部署

部署kubelet: 1.二进制包准备 将软件包可执行文件从k8s-master复制到node节点中去. [[email protected] ~]# cd /usr/local/src/kubernetes/server/bin [[email protected]-master bin]# scp kubelet kube-proxy 10.200.3.106:/opt/kubernetes/bin/ [[email protected]-master bin]# scp kubelet k

Kubernetes二进制部署之单节点部署

K8s单节点二进制部署 K8s二进制部署搭建步骤: 1:自签ETCD证书 2:ETCD部署 3:Node安装docker 4:Flannel部署(先写入子网到etcd) ---------master---------- 5:自签APIServer证书 6:部署APIServer组件(token,csv) 7:部署controller-manager(指定apiserver证书)和scheduler组件 ----------node---------- 8:生成kubeconfig(bootst

k8s集群之master节点部署

apiserver的部署 api-server的部署脚本 [[email protected] k8s]# cat apiserver.sh #!/bin/bash MASTER_ADDRESS=$1 主节点IP ETCD_SERVERS=$2 etcd地址 cat <<EOF >/opt/kubernetes/cfg/kube-apiserver KUBE_APISERVER_OPTS="--logtostderr=true \--v=4 \--etcd-servers=${

kubeadm高可用master节点部署文档

kubeadm的标准部署里,etcd和master都是单节点的. 但上生产,至少得高可用. etcd的高可用,用kubeadm微微扩散一下就可以. 但master却官方没有提及. 于是搜索了几篇文档,过几天测试一下. ======================= http://www.cnblogs.com/caiwenhao/p/6196014.html http://tonybai.com/2017/05/15/setup-a-ha-kubernetes-cluster-based-on-

4.K8S部署-------- Master节点部署

部署Kubernetes API服务部署 如果没有特别指定在那台服务器执行命令.只需要按照文中的步骤执行即可 0.准备软件包 [[email protected] ~]# cd /usr/local/src/kubernetes      #kubernets解压的目录 [[email protected] kubernetes]# cp server/bin/kube-apiserver /opt/kubernetes/bin/ [[email protected] kubernetes]#

openstack学习笔记六 多节点部署之keystone

keystone    对用户进行验证,每个组件必须得实用一个用户向keystone进行注册,只有成功了,那么这个组件才能正常工作.所以当我们在创建其他组件的时候,也包括keystone本身,都得为这个组件创建一个用户名和密码 keystone也必须知道这些组件到底在什么地方,比如在那台主机上. User 住宾馆的人 Credentials 开启房间的钥匙 Authentication 宾馆为了拒绝不必要的人进出宾馆,专门设置的机制,只有拥有钥匙的人才能进出 Token 也是一种钥匙,有点特别