手动安装K8s第四节：Master节点

0、准备软件包

cd /usr/local/src/kubernetes
[[email protected] kubernetes]# cp server/bin/kube-apiserver /opt/kubernetes/bin/
[[email protected] kubernetes]# cp server/bin/kube-controller-manager /opt/kubernetes/bin/
[[email protected] kubernetes]# cp server/bin/kube-scheduler /opt/kubernetes/bin/

1、创建生成CSR的 JSON 配置文件
[[email protected] ~]# cd /usr/local/src/ssl/
[[email protected] ssl]# vim kubernetes-csr.json
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"192.168.137.171",
"10.1.0.1",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}

2、生成 kubernetes 证书和私钥
[[email protected] ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
-ca-key=/opt/kubernetes/ssl/ca-key.pem \
-config=/opt/kubernetes/ssl/ca-config.json \
-profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes

2018/06/12 19:02:13 [INFO] generate received request
2018/06/12 19:02:13 [INFO] received CSR
2018/06/12 19:02:13 [INFO] generating key: rsa-2048
2018/06/12 19:02:14 [INFO] encoded CSR
2018/06/12 19:02:14 [INFO] signed certificate with serial number 386147679531467996147945114491457426445592492176
2018/06/12 19:02:14 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

[[email protected] ssl]# ll
-rw-r--r-- 1 root root 1245 Jun 12 19:02 kubernetes.csr
-rw-r--r-- 1 root root 437 Jun 12 19:01 kubernetes-csr.json
-rw------- 1 root root 1679 Jun 12 19:02 kubernetes-key.pem
-rw-r--r-- 1 root root 1610 Jun 12 19:02 kubernetes.pem

[[email protected] ssl]# cp kubernetes.pem /opt/kubernetes/ssl/
[[email protected] ssl]# scp kubernetes.pem k8snode1:/opt/kubernetes/ssl/
[[email protected] ssl]# scp kubernetes*.pem k8snode2:/opt/kubernetes/ssl/

3、创建 kube-apiserver 使用的客户端 token 文件
[[email protected] ~]# head -c 16 /dev/urandom | od -An -t x | tr -d ‘ ‘
ad6d5bb607a186796d8861557df0d17f

[[email protected] ~]# vim /opt/kubernetes/ssl/bootstrap-token.csv
ad6d5bb607a186796d8861557df0d17f,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

4、创建基础用户名/密码认证配置
[[email protected] ~]# vim /opt/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2

5、部署Kubernetes API Server
[[email protected] ~]# vim /usr/lib/systemd/system/kube-apiserver.service

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target

[Service]
ExecStart=/opt/kubernetes/bin/kube-apiserver \
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
--bind-address=192.168.137.171 \
--insecure-bind-address=127.0.0.1 \
--authorization-mode=Node,RBAC \
--runtime-config=rbac.authorization.k8s.io/v1 \
--kubelet-https=true \
--anonymous-auth=false \
--basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv \
--enable-bootstrap-token-auth \
--token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv \
--service-cluster-ip-range=10.1.0.0/16 \
--service-node-port-range=20000-40000 \
--tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem \
--tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem \
--client-ca-file=/opt/kubernetes/ssl/ca.pem \
--service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \
--etcd-cafile=/opt/kubernetes/ssl/ca.pem \
--etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem \
--etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem \
--etcd-servers=https://192.168.137.171:2379,https://192.168.137.201:2379,https://192.168.137.198:2379 \
--enable-swagger-ui=true \
--allow-privileged=true \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path=/opt/kubernetes/log/api-audit.log \
--event-ttl=1h \
--v=2 \
--logtostderr=false \
--log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

6、启动API Server服务
[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-apiserver
[[email protected] ~]# systemctl start kube-apiserver
[[email protected] ~]# systemctl status kube-apiserver

[[email protected] ~]# netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.137.171:6443 0.0.0.0: LISTEN 4185/kube-apiserver
tcp 0 0 192.168.137.171:2379 0.0.0.0: LISTEN 3955/etcd
tcp 0 0 127.0.0.1:2379 0.0.0.0: LISTEN 3955/etcd
tcp 0 0 192.168.137.171:2380 0.0.0.0: LISTEN 3955/etcd
tcp 0 0 127.0.0.1:8080 0.0.0.0: LISTEN 4185/kube-apiserver
tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN 1154/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0: LISTEN 1239/master
tcp6 0 0 :::22 ::: LISTEN 1154/sshd
tcp6 0 0 ::1:25 :::* LISTEN 1239/master

7、部署Controller Manager服务
[[email protected] ~]# vim /usr/lib/systemd/system/kube-controller-manager.service

[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-controller-manager \
--address=127.0.0.1 \
--master=http://127.0.0.1:8080 \
--allocate-node-cidrs=true \
--service-cluster-ip-range=10.1.0.0/16 \
--cluster-cidr=10.2.0.0/16 \
--cluster-name=kubernetes \
--cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \
--cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \
--service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \
--root-ca-file=/opt/kubernetes/ssl/ca.pem \
--leader-elect=true \
--v=2 \
--logtostderr=false \
--log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-controller-manager

[[email protected] ~]# systemctl start kube-controller-manager
[[email protected] ~]# systemctl status kube-controller-manager

[[email protected] ~]# netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.137.171:6443 0.0.0.0: LISTEN 4185/kube-apiserver
tcp 0 0 192.168.137.171:2379 0.0.0.0: LISTEN 3955/etcd
tcp 0 0 127.0.0.1:2379 0.0.0.0: LISTEN 3955/etcd
tcp 0 0 127.0.0.1:10252 0.0.0.0: LISTEN 4239/kube-controlle
tcp 1 0 192.168.137.171:2380 0.0.0.0: LISTEN 3955/etcd
tcp 0 0 127.0.0.1:8080 0.0.0.0: LISTEN 4185/kube-apiserver
tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN 1154/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0: LISTEN 1239/master
tcp6 0 0 :::22 ::: LISTEN 1154/sshd
tcp6 0 0 ::1:25 ::: LISTEN 1239/master
[[email protected] ~]#

8、部署Kubernetes Scheduler
[[email protected] ~]# vim /usr/lib/systemd/system/kube-scheduler.service

[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-scheduler \
--address=127.0.0.1 \
--master=http://127.0.0.1:8080 \
--leader-elect=true \
--v=2 \
--logtostderr=false \
--log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-scheduler
[[email protected] ~]# systemctl start kube-scheduler
[[email protected] ~]# systemctl status kube-scheduler

原文地址：http://blog.51cto.com/andyliu/2129067

时间： 2024-11-07 13:38:31

手动安装K8s第四节：Master节点的相关文章

手动安装K8s第六节：node节点部署-kubelet

部署kubelet1.准备二进制包[[email protected] ~]# cd /usr/local/src/kubernetes/server/bin/ [[email protected] bin]# scp kubelet kube-proxy k8snode1:/opt/kubernetes/bin/ [[email protected] bin]# scp kubelet kube-proxy k8snode2:/opt/kubernetes/bin/ 2.创建角色绑定[[ema

手动安装K8s第五节：master节点kubectl命令部署

1.部署kubectl 命令行工具准备二进制包[[email protected] ~]# cd /usr/local/src/kubernetes/client/bin[[email protected] bin]# cp kubectl /opt/kubernetes/bin/ 2.创建 admin 证书签名请求[[email protected] bin]# cd /usr/local/src/ssl/[[email protected] ssl]# vim admin-csr.json

Kubernetes（K8s）安装部署过程（四）--Master节点安装

再次明确下架构:  三台虚拟机 centos 7.4系统,docker为17版本,ip为10.10.90.105到107,其中105位master,接下来的master相关组件安装到此机器上. etcd集群为3台,分别复用这3台虚拟机. 作为k8s的核心,master节点主要包含三个组件,分别是: 三个组件:kube-apiserver kube-scheduler kube-controller-manager 这个三个组件密切联系 1.创建TLS证书 这些证书我们在第一篇文章中已经创建,共8

手动安装K8s第三节：etcd集群部署

准备安装包https://github.com/coreos/etcd版本:3.2.18wget https://github.com/coreos/etcd/releases/download/v3.2.18/etcd-v3.2.18-linux-amd64.tar.gz 0.安装[[email protected] src]# tar zxf etcd-v3.2.18-linux-amd64.tar.gz[[email protected] src]# cd etcd-v3.2.18-lin

k8s集群之master节点部署

apiserver的部署 api-server的部署脚本 [[email protected] k8s]# cat apiserver.sh #!/bin/bash MASTER_ADDRESS=$1 主节点IP ETCD_SERVERS=$2 etcd地址 cat <<EOF >/opt/kubernetes/cfg/kube-apiserver KUBE_APISERVER_OPTS="--logtostderr=true \--v=4 \--etcd-servers=${

手动安装K8s第八节：部署Fannel网络

[[email protected] ~]# cd /usr/local/src/ssl/[[email protected] ssl]# vim flanneld-csr.json {"CN": "flanneld","hosts": [],"key": {"algo": "rsa","size": 2048},"names": [{"

Kubernetes Master节点灾备恢复操作指南---升级版

本文档简述了Kubernetes主节点灾备恢复的相关步骤,供在发生k8s master崩溃时操作. 就算是在k8s里部署了etcd群集, 主节点控制组件的高可用节点,灾备恢复也是必须要实现的操作,才能形成完备的企业级服务方案. K8s集群在master节点发生故障时,并不会影响已有的pod运行和服务开放,所以对服务是没有影响的.故而我们可以在发生故障之后,挑选合适的时间窗口进行维护和恢复,可以对外部客户造成最低的影响. 严格来讲,通过kubeadm安装的k8s主节点包括两大类的灾备恢复,etcd

使用yum方法来安装kubernetes(一)Master节点

kubernetes各节点需要安装如下图的软件 2.IP地址分配安装kubernetes一般建议至少2台及以上(条件允许,建议三台Master节点(Master节点做高可用),三台及以上Node节点) 3.设置hosts文件命令:vi /etc/hosts 4.关闭防火墙和Selinux关闭防火墙:systemctl disable firewalld #设置开机关闭防火墙systemctl stop firewalld #停止防火墙,重启失败 关闭selinuxsetenforce 0 #即时

k8s Kubernetes v1.10 单节点 kubeadm 快速安装

k8s Kubernetes v1.10 单节点 kubeadm 快速安装 # Master 单节点快速安装 # 傻瓜式安装,只为快速部署测试环境 #测试环境centos 7.4 #ubuntu环境应该也可以,没测验证过 #1 初始化环境 curl -s http://elven.vip/ks/k8s/oneinstall/0.set.sh |bash #2 下载镜像,安装kubeadm工具 curl http://elven.vip/ks/k8s/oneinstall/1.download.s