二进制部署kubernetes1.17集群

时间：2020-03-26 21:31:30 阅读：68 评论：0 收藏：0 [点我收藏+]

1.前提etcd集群部署完成,flannel部署完成

2.部署kube-apiserver

1.下载kubernetes-server二进制包
wget https://dl.k8s.io/v1.17.4/kubernetes-server-linux-amd64.tar.gz
２.将解压目录下的server/bin 下的kube-apiserver  kube-controller-manager  kube-scheduler,移动到/opt/kubernetes/bin目录下
3.生成token.csv文件
export BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ‘ ‘)
cat > token.csv <<EOF
${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,"system:kubelet-bootstrap"
EOF
4.将生成的token.csv文件复制到/opt/kubernetes/cfg目录下
5.执行下面脚本生成证书文件

cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
      	    "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

#-----------------------

cat > server-csr.json <<EOF
{
    "CN": "kubernetes",
    "hosts": [
      "10.0.0.1",
      "127.0.0.1",
      "192.168.100.120",
      "192.168.100.121",
      "192.168.100.122",
      "192.168.100.123",
      "192.168.100.124",
      "192.168.100.125",
      "192.168.100.126",
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

#-----------------------

cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

#-----------------------

cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

6.将证书文件ca.pem ca-key.pem server.pem server-key.pem 文件拷贝到/opt/kubernetes/ssl文件夹下

7.编辑kube-apiserver.sh文件
#!/bin/bash

MASTER_ADDRESS=$1
ETCD_SERVERS=$2

cat <<EOF >/opt/kubernetes/cfg/kube-apiserver

KUBE_APISERVER_OPTS="--logtostderr=false\--log-dir=/opt/kubernetes/logs \--v=4 \--etcd-servers=${ETCD_SERVERS} \--bind-address=${MASTER_ADDRESS} \--secure-port=6443 \--advertise-address=${MASTER_ADDRESS} \--allow-privileged=true \--service-cluster-ip-range=10.0.0.0/24 \--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,NodeRestriction --authorization-mode=RBAC,Node \--kubelet-https=true \--enable-bootstrap-token-auth \--token-auth-file=/opt/kubernetes/cfg/token.csv \--service-node-port-range=30000-50000 \--tls-cert-file=/opt/kubernetes/ssl/server.pem  \--tls-private-key-file=/opt/kubernetes/ssl/server-key.pem \--client-ca-file=/opt/kubernetes/ssl/ca.pem \--service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \--etcd-cafile=/opt/etcd/ssl/ca.pem \--etcd-certfile=/opt/etcd/ssl/server.pem \--etcd-keyfile=/opt/etcd/ssl/server-key.pem"

EOF

cat <<EOF >/usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver
ExecStart=/opt/kubernetes/bin/kube-apiserver \$KUBE_APISERVER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kube-apiserver
systemctl restart kube-apiserver

8.mkdir /opt/kubernetes/logs
9.  ./kube-apiserver.sh 192.168.100.121 https://192.168.100.121:2379,https://192.168.100.122:2379,https://192.168.100.123:2379
#此时kube-apiserver部署完成

3.部署kube-controller-manager

1.编写部署脚本

#!/bin/bash

MASTER_ADDRESS=$1
cat <<EOF >/opt/kubernetes/cfg/kube-controller-manager


KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=false \--log-dir=/opt/kubernetes/logs/kube-controller \--v=4 \--master=${MASTER_ADDRESS}:8080 \--leader-elect=true \--address=127.0.0.1 \--service-cluster-ip-range=10.0.0.0/24 \--cluster-name=kubernetes \--cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \--cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem  \--service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \--root-ca-file=/opt/kubernetes/ssl/ca.pem \--experimental-cluster-signing-duration=87600h0m0s"

EOF

cat <<EOF >/usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-controller-manager
ExecStart=/opt/kubernetes/bin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kube-controller-manager
systemctl restart kube-controller-manager

2.执行脚本

./kube-controller-manager.sh 127.0.0.1

4.部署kube-scheduler

1.编写脚本kube-scheduler.sh

KUBE_SCHEDULER_OPTS="--logtostderr=false --log-dir=/opt/kubernetes/logs/kube-scheduler --v=4 --master=127.0.0.1:8080 --leader-elect=true"

2.执行脚本

./kube-scheduler.sh

5.将kubelet-bootstrap用户绑定到系统集群角色

kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=-system:nodebootstrapper --user=kubelet-bootstrap
如果是删除用户的话:
kubectl delete clusterrolebinding kubelet-bootstrap

6.创建kubeconfig文件

kubeconfig作用是，存放连接apiserver认证信息

1.编辑kubeconfig.sh

APISERVER=$1
SSL_DIR=$2
BOOTSTRAP_TOKEN=d64cf3024aee41b0584253dc7e88c3b9

# 创建kubelet bootstrapping kubeconfig 
export KUBE_APISERVER="https://$APISERVER:6443"

# 设置集群参数
kubectl config set-cluster kubernetes   --certificate-authority=$SSL_DIR/ca.pem   --embed-certs=true   --server=${KUBE_APISERVER}   --kubeconfig=bootstrap.kubeconfig

# 设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap   --token=${BOOTSTRAP_TOKEN}   --kubeconfig=bootstrap.kubeconfig

# 设置上下文参数
kubectl config set-context default   --cluster=kubernetes   --user=kubelet-bootstrap   --kubeconfig=bootstrap.kubeconfig

# 设置默认上下文
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig

#----------------------

# 创建kube-proxy kubeconfig文件

kubectl config set-cluster kubernetes   --certificate-authority=$SSL_DIR/ca.pem   --embed-certs=true   --server=${KUBE_APISERVER}   --kubeconfig=kube-proxy.kubeconfig

kubectl config set-credentials kube-proxy   --client-certificate=$SSL_DIR/kube-proxy.pem   --client-key=$SSL_DIR/kube-proxy-key.pem   --embed-certs=true   --kubeconfig=kube-proxy.kubeconfig

kubectl config set-context default   --cluster=kubernetes   --user=kube-proxy   --kubeconfig=kube-proxy.kubeconfig

kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

2.执行脚本生成bootstrap.kubeconfig和kube-proxy.kubeconfig文件

cp k8s/k8s-cert/kube-proxy-key.pem kube-proxy.pem /opt/kubernetes/ssl/
./kubeconfig.sh 192.168.100.121 /opt/kubernetes/ssl

3.将生成的文件拷贝的node节点

scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.100.122:/opt/kubernetes/cfg/
scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.100.123:/opt/kubernetes/cfg/

7.部署kubelet

1.部署kubelet脚本

#!/bin/bash

NODE_ADDRESS=$1
DNS_SERVER_IP=${2:-"10.0.0.2"}

cat <<EOF >/opt/kubernetes/cfg/kubelet

KUBELET_OPTS="--logtostderr=false \--v=4 \--log-dir=/opt/kubernetes/logs/kubelet \--address=${NODE_ADDRESS} \--hostname-override=${NODE_ADDRESS} \--kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \--experimental-bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \--cert-dir=/opt/kubernetes/ssl \--cluster-dns=${DNS_SERVER_IP} \--cluster-domain=cluster.local \--fail-swap-on=false \--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"

EOF

cat <<EOF >/usr/lib/systemd/system/kubelet.service
[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kubelet
ExecStart=/opt/kubernetes/bin/kubelet \$KUBELET_OPTS
Restart=on-failure
KillMode=process

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kubelet
systemctl restart kubelet

2.拷贝二进制文件和证书

拷贝二进制kubelet文件到/opt/kubernetes/bin/
拷贝证书文件到/opt/kubernetes/ssl

3.执行kubelet脚本

node1:
./kubelet.sh 192.168.100.122
node2:
./kubelet.sh 192.168.100.123

8.将节点认证到集群

1.执行kubectl get csr 获取认证节点信息

node-csr-97GyBWrjF23A9k3sR7spkSmFIiIpNfsS9X-ej7pcXYQ   2d23h   kubelet-bootstrap   Pending
node-csr-mV4OJBfkXM19jsKi98UE7m6_aXW321bVJIXcbdzyiPA   2d23h   kubelet-bootstrap   Pending

2.执行认证

kubectl certificate approve node-csr-97GyBWrjF23A9k3sR7spkSmFIiIpNfsS9X-ej7pcXYQ
kubectl certificate approve node-csr-mV4OJBfkXM19jsKi98UE7m6_aXW321bVJIXcbdzyiPA

3.执行kubectl get node获取节点状态信息

NAME              STATUS   ROLES    AGE   VERSION
192.168.100.122   Ready    <none>   37m   v1.17.4
192.168.100.123   Ready    <none>   38m   v1.17.4

9.部署kube-proxy

1.编辑脚本kube-proxy.sh

#!/bin/bash

NODE_ADDRESS=$1

cat <<EOF >/opt/kubernetes/cfg/kube-proxy

KUBE_PROXY_OPTS="--logtostderr=false \--log-dir=/opt/kubernetes/logs/kube-proxy \--v=4 \--hostname-override=${NODE_ADDRESS} \--cluster-cidr=10.0.0.0/24 \--proxy-mode=ipvs \--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig"

EOF

cat <<EOF >/usr/lib/systemd/system/kube-proxy.service
[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy \$KUBE_PROXY_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kube-proxy
systemctl restart kube-proxy

2.在各节点执行脚本

./kube-proxy 192.168.100.122
./kube-proxy 192.168.100.123

10.部署完成

注意: 此文档仅供自己备忘参考，并没有特别详细教程

二进制部署kubernetes1.17集群

原文：https://www.cnblogs.com/limengchun/p/12577407.html

踩

(0)

评论一句话评论（0）

分享档案

更多>

2021年09月23日 (328)
2021年09月24日 (313)
2021年09月17日 (191)
2021年09月15日 (369)
2021年09月16日 (411)
2021年09月13日 (439)
2021年09月11日 (398)
2021年09月12日 (393)
2021年09月10日 (160)
2021年09月08日 (222)