二进制安装k8s集群(8)-安装kube-apiserver
在上一篇文章里我们主要介绍harbor的安装以及简单使用，这里我们主要介绍安装kube-apiserver。这里我们采用下载二进制binary制作linux systemd的方式安装，并开启kube-apiserver的ssl。这里在github下载kubernetes(1.15.1版本)。同时请提前制作好kuber-apiserver的ssl证书，可以参考以前文章中制作docker的cert。
下载kubernetes：
# download client binary
wget https://dl.k8s.io/v1.15.1/kubernetes-client-linux-amd64.tar.gz
# download server binary
wget https://dl.k8s.io/v1.15.1/kubernetes-server-linux-amd64.tar.gz
# download node binary
wget https://dl.k8s.io/v1.15.1/kubernetes-node-linux-amd64.tar.gz
tar -xzvf kubernetes-client-linux-amd64.tar.gz
tar -xzvf kubernetes-server-linux-amd64.tar.gz
tar -xzvf kubernetes-node-linux-amd64.tar.gz
copy binary文件：
cp /opt/sw/kubernetes/install/kubernetes/server/bin/kube-apiserver /usr/bin/
whereis kube-apiserver
copy 证书文件：
因为kube-apiserver需要和etcd通讯，需要和kubeltet通讯，本身还提供api服务，这些通讯都我们开启ssl认证，所以请提前制作好相应的证书并copy到配置目录(可以参考以前文章中制作docker的cert)。
mkdir -p /etc/kubernetes/apiserver
mkdir -p /etc/kubernetes/apiserver/cert/etcd
mkdir -p /etc/kubernetes/apiserver/cert/kubelet
mkdir -p /etc/kubernetes/apiserver/cert/server
创建basic-auth和static-token-auth文件：
这里提供一下kube-apiserver的basic auth和静态token访问配置文件
touch /etc/kubernetes/apiserver/k8s-auth-static-token.csv
cat > /etc/kubernetes/apiserver/k8s-auth-static-token.csv <<EOF
token,user,uid
abc123_,rodney,rodney
EOF
touch /etc/kubernetes/apiserver/k8s-auth-static-password.csv
cat > /etc/kubernetes/apiserver/k8s-auth-static-password.csv <<EOF
password,user,uid
abc123_,rodney,rodney
EOF
创建kube-apiserver配置文件：
这里的配置非常多，就不逐一介绍了，感兴趣的同学请查阅kube-apiserver的配置文档或者参考kube-apiserver binary的help命令。
touch /etc/kubernetes/apiserver/k8s-apiserver.conf
cat > /etc/kubernetes/apiserver/k8s-apiserver.conf <<EOF
KUBE_ADDRESS="--advertise-address=172.20.11.41 --bind-address=172.20.11.41 --insecure-bind-address=127.0.0.1"
KUBE_API_PORT="--port=8080 --secure-port=6443"
KUBE_ETCD_SERVERS="--storage-backend=etcd3 --etcd-servers=https://172.20.11.41:2379,https://172.20.11.42:2379,https://172.20.11.43:2379 \
--etcd-cafile=/etc/kubernetes/apiserver/cert/etcd/ca.crt \
--etcd-certfile=/etc/kubernetes/apiserver/cert/etcd/etcd-client.crt \
--etcd-keyfile=/etc/kubernetes/apiserver/cert/etcd/etcd-client.key"
KUBE_KUBELET="--kubelet-port=10250 \
--kubelet-https=true \
--kubelet-certificate-authority=/etc/kubernetes/apiserver/cert/kubelet/ca.crt \
--kubelet-client-certificate=/etc/kubernetes/apiserver/cert/kubelet/k8skubelet-client.crt \
--kubelet-client-key=/etc/kubernetes/apiserver/cert/kubelet/k8skubelet-client.key"
KUBE_ADMISSION_CONTROL="--admission-control=ServiceAccount,NamespaceLifecycle,NamespaceExists,LimitRanger,ResourceQuota"
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
KUBE_NODE_PORT="--service-node-port-range=80-30000"
KUBE_API_TLS="--tls-cert-file=/etc/kubernetes/apiserver/cert/server/k8sapiserver-server.crt \
--tls-private-key-file=/etc/kubernetes/apiserver/cert/server/k8sapiserver-server.key \
--client-ca-file=/etc/kubernetes/apiserver/cert/server/ca.crt"
KUBE_API_ARGS="--service-account-key-file=/etc/kubernetes/apiserver/cert/server/k8sapiserver-server.key \
--basic-auth-file=/etc/kubernetes/apiserver/k8s-auth-static-password.csv \
--token-auth-file=/etc/kubernetes/apiserver/k8s-auth-static-token.csv"
# logging to stderr means can get in systemd journal
KUBE_LOGTOSTDERR="--logtostderr=true"
# journal message level, 0 is debug
KUBE_LOG_LEVEL="--v=0"
# Should this cluster be allowed to run privileged docker containers
KUBE_ALLOW_PRIV="--allow-privileged=true"
EOF
source /etc/kubernetes/apiserver/k8s-apiserver.conf
创建kube-apiserver systemd unit文件：
touch /usr/lib/systemd/system/kube-apiserver.service
cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF
[Unit]
Description=Kubernetes API Service
After=network.target network-online.target
Wants=network-online.target
[Service]
Type=simple
EnvironmentFile=/etc/kubernetes/apiserver/k8s-apiserver.conf
ExecStartPre=source /etc/kubernetes/apiserver/k8s-apiserver.conf
ExecStart=/usr/bin/kube-apiserver \
${KUBE_API_ADDRESS} \
$KUBE_API_PORT \
$KUBE_ETCD_SERVERS \
$KUBE_KUBELET \
$KUBE_ADMISSION_CONTROL \
$KUBE_SERVICE_ADDRESSES \
$KUBE_NODE_PORT \
$KUBE_API_TLS \
$KUBE_API_ARGS \
$KUBE_LOGTOSTDERR \
$KUBE_LOG_LEVEL \
$KUBE_ALLOW_PRIV
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF
reload并且设置开机服务启动：
systemctl daemon-reload
systemctl enable kube-apiserver
打开kube-apiserver防火墙访问端口：这里配置是6443
firewall-cmd --list-all
firewall-cmd --permanent --zone=public --add-port=6443/tcp
firewall-cmd --reload
firewall-cmd --list-all
启动服务查看状态：
systemctl start kube-apiserver
systemctl status kube-apiserver
目前先写到这里，下一篇文章里我们继续介绍k8s组件kubectl的安装。
本文参与 腾讯云自媒体分享计划，分享自微信公众号。
原始发表：2019-10-09，如有侵权请联系 cloudcommunity@tencent.com 删除
评论
登录后参与评论
推荐阅读