Kubernetes-V1.14.2 二进制编译部署（master节点部署篇）

原创

运维搬砖

修改于 2019-07-24 10:35:25

1.3K0

修改于 2019-07-24 10:35:25

文章被收录于专栏：LeorizonLeorizon

Kubernetes-V1.14.2 二进制编译安装（master节点部署篇）

3.1 复制二进制文件

tar xf kubernetes-server-linux-amd64.tar.gz
cd /root/kubernetes/server/bin
cp kube-apiserver kube-controller-manager kube-scheduler /app/kubernetes/bin/

3.2 部署kube-apiserver

3.2.1、创建生成CSR的 JSON 配置文件

vim kubernetes-csr.json
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    ### 需要将IP改为自己master的IP，并将注释删除
    "192.168.189.139", 
    "10.1.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

3.2.2、生成 kubernetes 证书和私钥

cfssl gencert -ca=/app/kubernetes/ssl/ca.pem \
  -ca-key=/app/kubernetes/ssl/ca-key.pem  \
  -config=/app/kubernetes/ssl/ca-config.json \
  -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes

cp kubernetes*.pem /app/kubernetes/ssl/
scp kubernetes*.pem k8s-node-1:/app/kubernetes/ssl/
scp kubernetes*.pem k8s-node-2:/app/kubernetes/ssl/

3.2.3、创建 kube-apiserver 使用的客户端 token 文件

### 下面这个命令会产生一串字符串
head -c 16 /dev/urandom | od -An -t x | tr -d ' '
 
#### 创建这个文件  
vim /app/kubernetes/ssl/bootstrap-token.csv  
 
### 用生成的字符串替换下面的 “8fa448.... ”这一串数字
8fa4488b7751e2ba9f58555a8cb0cef4,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

3.2.4、创建基础用户名/密码认证配置

vim /app/kubernetes/ssl/basic-auth.csv

admin,admin,1
readonly,readonly,2

3.2.5、配置kubernetes apiserver 启动服务

vim  /usr/lib/systemd/system/kube-apiserver.service

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target
 
[Service]
ExecStart=/app/kubernetes/bin/kube-apiserver \
  --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
  --bind-address=192.168.189.139 \
  --insecure-bind-address=127.0.0.1 \
  --authorization-mode=Node,RBAC \
  --runtime-config=rbac.authorization.k8s.io/v1 \
  --kubelet-https=true \
  --anonymous-auth=false \
  --basic-auth-file=/app/kubernetes/ssl/basic-auth.csv \
  --enable-bootstrap-token-auth \
  --token-auth-file=/app/kubernetes/ssl/bootstrap-token.csv \
  --service-cluster-ip-range=10.1.0.0/16 \
  --service-node-port-range=9000-40000 \
  --tls-cert-file=/app/kubernetes/ssl/kubernetes.pem \
  --tls-private-key-file=/app/kubernetes/ssl/kubernetes-key.pem \
  --client-ca-file=/app/kubernetes/ssl/ca.pem \
  --service-account-key-file=/app/kubernetes/ssl/ca-key.pem \
  --etcd-cafile=/app/kubernetes/ssl/ca.pem \
  --etcd-certfile=/app/kubernetes/ssl/kubernetes.pem \
  --etcd-keyfile=/app/kubernetes/ssl/kubernetes-key.pem \
  --etcd-servers=https://192.168.189.139:2379,https://192.168.189.131:2379,https://192.168.189.132:2379 \
  --enable-swagger-ui=true \
  --allow-privileged=true \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=3 \
  --audit-log-maxsize=100 \
  --audit-log-path=/app/kubernetes/log/api-audit.log \
  --event-ttl=1h \
  --v=2 \
  --logtostderr=false \
  --log-dir=/app/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536
 
[Install]
WantedBy=multi-user.target

注意：：

--bind-address=192.168.189.139   将其换成自己的master节点IP
--etcd-servers=https：            后面的IP分别换成自己的master和node节点的IP

3.2.6、启动服务

systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver

3.3 部署controller manager服务

3.3.1、创建kube-controller-manager.service

vim /usr/lib/systemd/system/kube-controller-manager.service

[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 
[Service]
ExecStart=/app/kubernetes/bin/kube-controller-manager \
  --address=127.0.0.1 \
  --master=http://127.0.0.1:8080 \
  --allocate-node-cidrs=true \
  --service-cluster-ip-range=10.1.0.0/16 \
  --cluster-cidr=10.2.0.0/16 \
  --cluster-name=kubernetes \
  --cluster-signing-cert-file=/app/kubernetes/ssl/ca.pem \
  --cluster-signing-key-file=/app/kubernetes/ssl/ca-key.pem \
  --service-account-private-key-file=/app/kubernetes/ssl/ca-key.pem \
  --root-ca-file=/app/kubernetes/ssl/ca.pem \
  --leader-elect=true \
  --v=2 \
  --logtostderr=false \
  --log-dir=/app/kubernetes/log
 
Restart=on-failure
RestartSec=5
 
[Install]
WantedBy=multi-user.target

3.3.2、启动kube-controller-manager

systemctl daemon-reload
systemctl enable kube-controller-manager && systemctl start kube-controller-manager
systemctl status kube-controller-manager

3.4 部署kube-scheduler服务

创建kube-scheduler.service

vim /usr/lib/systemd/system/kube-scheduler.service

[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 
[Service]
ExecStart=/app/kubernetes/bin/kube-scheduler \
  --address=127.0.0.1 \
  --master=http://127.0.0.1:8080 \
  --leader-elect=true \
  --v=2 \
  --logtostderr=false \
  --log-dir=/app/kubernetes/log
 
Restart=on-failure
RestartSec=5
 
[Install]
WantedBy=multi-user.target

启动kube-scheduler.service

systemctl daemon-reload
systemctl enable kube-scheduler && systemctl start kube-scheduler
systemctl status kube-scheduler

3.5 部署kubectl 命令行工具

3.5.1 复制二进制包

cd kubernetes/server/bin/
cp kubectl /app/kubernetes/bin/

3.5.2 创建 admin 证书签名请求

vim admin-csr.json

{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}

3.5.3 生成 admin 证书和私钥

cfssl gencert -ca=/app/kubernetes/ssl/ca.pem \
   -ca-key=/app/kubernetes/ssl/ca-key.pem \
   -config=/app/kubernetes/ssl/ca-config.json \
   -profile=kubernetes admin-csr.json | cfssljson -bare admin

# 把生成好的密钥放入到kubernetes下的ssl中
cp admin*.pem /app/kubernetes/ssl/

3.5.4 设置集群参数

将kubectl可执行文件复制到 /usr/local/bin下文件在解压包中

kubectl config set-cluster kubernetes \
   --certificate-authority=/app/kubernetes/ssl/ca.pem \
   --embed-certs=true \
   --server=https://192.168.189.139:6443

#### 注意将IP换为自己的master节点IP

3.5.5 设置客户端认证参数

kubectl config set-credentials admin \
   --client-certificate=/app/kubernetes/ssl/admin.pem \
   --embed-certs=true \
   --client-key=/app/kubernetes/ssl/admin-key.pem

3.5.6 设置上下文参数

kubectl config set-context kubernetes \
   --cluster=kubernetes \
   --user=admin

3.5.7 设置默认上下文

kubectl config use-context kubernetes

3.5.8 查看服务是否正常

kubectl get cs

正常则为：

[root@k8s-master bin]# kubectl get cs
NAME                 STATUS    MESSAGE             ERROR
scheduler            Healthy   ok                  
controller-manager   Healthy   ok                  
etcd-0               Healthy   {"health":"true"}   
etcd-2               Healthy   {"health":"true"}   
etcd-1               Healthy   {"health":"true"}

====================================================

Kubernetes-1.14.2的源码包+kernel-ml-4.18.9.tar.gz 有百度云盘资源,链接：https://pan.baidu.com/s/1NZW2DV64DkybD6QI42lw7Q ; 提取码：t5bv

探讨更多技术，欢迎关注微信公众号：Leorizon

====================================================

原创声明：本文系作者授权腾讯云开发者社区发表，未经许可，不得转载。

如有侵权，请联系 cloudcommunity@tencent.com 删除。

https