Kubernetes部署（六）：Master节点部署

相关内容：

Kubernetes部署（一）：架构及功能说明
Kubernetes部署（二）：系统环境初始化
Kubernetes部署（三）：CA证书制作
Kubernetes部署（四）：ETCD集群部署
Kubernetes部署（五）：Haproxy、Keppalived部署
Kubernetes部署（六）：Master节点部署
Kubernetes部署（七）：Node节点部署
Kubernetes部署（八）：Flannel网络部署
Kubernetes部署（九）：CoreDNS、Dashboard、Ingress部署
Kubernetes部署（十）：储存之glusterfs和heketi部署
Kubernetes部署（十一）：管理之Helm和Rancher部署
Kubernetes部署（十二）：helm部署harbor企业级镜像仓库

1.部署Kubernetes API服务部署

0.准备软件包

[root@node-01 ~]# cd /usr/local/src/kubernetes
[root@node-01 kubernetes]# cp server/bin/kube-apiserver /data/kubernetes/bin/
[root@node-01 kubernetes]# cp server/bin/kube-controller-manager /data/kubernetes/bin/
[root@node-01 kubernetes]# cp server/bin/kube-scheduler /data/kubernetes/bin/
[root@node-01 kubernetes]# scp server/bin/kube-apiserver 10.31.90.202:/data/kubernetes/bin/
[root@node-01 kubernetes]# scp server/bin/kube-apiserver 10.31.90.203:/data/kubernetes/bin/
[root@node-01 kubernetes]# scp server/bin/kube-controller-manager 10.31.90.202:/data/kubernetes/bin/
[root@node-01 kubernetes]# scp server/bin/kube-controller-manager 10.31.90.203:/data/kubernetes/bin/
[root@node-01 kubernetes]# scp server/bin/kube-scheduler 10.31.90.202:/data/kubernetes/bin
[root@node-01 kubernetes]# scp server/bin/kube-scheduler 10.31.90.203:/data/kubernetes/bin/

1.创建生成CSR的 JSON 配置文件

[root@node-01 src]# vim kubernetes-csr.json
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "10.31.90.200",
    "10.31.90.201",
    "10.31.90.202",
    "10.31.90.203",
    "10.1.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

2.生成 kubernetes 证书和私钥

 [root@node-01 src]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem \
   -ca-key=/data/kubernetes/ssl/ca-key.pem \
   -config=/data/kubernetes/ssl/ca-config.json \
   -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
[root@node-01 ssl]# cp kubernetes*.pem /data/kubernetes/ssl/
[root@node-01 ssl]# scp kubernetes*.pem 10.31.90.202:/data/kubernetes/ssl/
[root@node-01 ssl]# scp kubernetes*.pem 10.31.90.203:/data/kubernetes/ssl/

3.创建 kube-apiserver 使用的客户端 token 文件

[root@node-01 ssl]# head -c 16 /dev/urandom | od -An -t x | tr -d ' '
cf25becebf64e3fffd7f3890a60ac16d
[root@node-01 ssl]# vim /data/kubernetes/ssl/bootstrap-token.csv
cf25becebf64e3fffd7f3890a60ac16d,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
[root@node-01 ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.202:/data/kubernetes/ssl/
[root@node-01 ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.203:/data/kubernetes/ssl/

4.创建基础用户名/密码认证配置

[root@node-01 ssl]# vim /data/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2
[root@node-01 ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.202:/data/kubernetes/ssl/
[root@node-01 ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.203:/data/kubernetes/ssl/

5.部署Kubernetes API Server

三个master节点都需要部署

[root@node-01 ~]# vim /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target

[Service]
ExecStart=/data/kubernetes/bin/kube-apiserver \
  --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
  --bind-address=10.31.90.201 \
  --insecure-bind-address=10.31.90.201 \
  --authorization-mode=Node,RBAC \
  --runtime-config=rbac.authorization.k8s.io/v1 \
  --kubelet-https=true \
  --anonymous-auth=false \
  --basic-auth-file=/data/kubernetes/ssl/basic-auth.csv \
  --enable-bootstrap-token-auth \
  --token-auth-file=/data/kubernetes/ssl/bootstrap-token.csv \
  --service-cluster-ip-range=10.1.0.0/16 \
  --service-node-port-range=20000-40000 \
  --tls-cert-file=/data/kubernetes/ssl/kubernetes.pem \
  --tls-private-key-file=/data/kubernetes/ssl/kubernetes-key.pem \
  --client-ca-file=/data/kubernetes/ssl/ca.pem \
  --service-account-key-file=/data/kubernetes/ssl/ca-key.pem \
  --etcd-cafile=/data/kubernetes/ssl/ca.pem \
  --etcd-certfile=/data/kubernetes/ssl/kubernetes.pem \
  --etcd-keyfile=/data/kubernetes/ssl/kubernetes-key.pem \
  --etcd-servers=https://10.31.90.201:2379,https://10.31.90.202:2379,https://10.31.90.203:2379 \
  --enable-swagger-ui=true \
  --allow-privileged=true \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=3 \
  --audit-log-maxsize=100 \
  --audit-log-path=/data/kubernetes/log/api-audit.log \
  --event-ttl=1h \
  --v=2 \
  --logtostderr=false \
  --log-dir=/data/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

6.启动API Server服务

[root@node-01 ~]# systemctl daemon-reload
[root@node-01 ~]# systemctl enable kube-apiserver
[root@node-01 ~]# systemctl start kube-apiserver

查看API Server服务状态

[root@node-01 ~]# systemctl status kube-apiserver

部署Controller Manager服务

三个master节点都需要部署

[root@node-01 ~]# vim /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/data/kubernetes/bin/kube-controller-manager \
  --address=127.0.0.1 \
  --master=http://10.31.90.200:8080 \
  --allocate-node-cidrs=true \
  --service-cluster-ip-range=10.1.0.0/16 \
  --cluster-cidr=10.2.0.0/16 \
  --cluster-name=kubernetes \
  --cluster-signing-cert-file=/data/kubernetes/ssl/ca.pem \
  --cluster-signing-key-file=/data/kubernetes/ssl/ca-key.pem \
  --service-account-private-key-file=/data/kubernetes/ssl/ca-key.pem \
  --root-ca-file=/data/kubernetes/ssl/ca.pem \
  --leader-elect=true \
  --v=2 \
  --logtostderr=false \
  --log-dir=/data/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

3.启动Controller Manager

[root@node-01 ~]# systemctl daemon-reload
[root@node-01 scripts]# systemctl enable kube-controller-manager
[root@node-01 scripts]# systemctl start kube-controller-manager

4.查看服务状态

[root@node-01 scripts]# systemctl status kube-controller-manager

部署Kubernetes Scheduler

三个master节点都需要部署

[root@node-01 ~]# vim /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/data/kubernetes/bin/kube-scheduler \
  --address=127.0.0.1 \
  --master=http://10.31.90.200:8080 \
  --leader-elect=true \
  --v=2 \
  --logtostderr=false \
  --log-dir=/data/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

2.部署服务

[root@node-01 ~]# systemctl daemon-reload
[root@node-01 ~]# systemctl enable kube-scheduler
[root@node-01 ~]# systemctl start kube-scheduler
[root@node-01 ~]# systemctl status kube-scheduler

部署kubectl 命令行工具

这只需在其中一台部署即可，用来管理k8s集群。

1.准备二进制命令包

[root@node-01 ~]# cd /usr/local/src/kubernetes/client/bin
[root@node-01 bin]# cp kubectl /opt/kubernetes/bin/

2.创建 admin 证书签名请求

[root@node-01 ~]# cd /usr/local/src/ssl/
[root@node-01 ssl]# vim admin-csr.json
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}

3.生成 admin 证书和私钥：

[root@node-01 ssl]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem \
   -ca-key=/data/kubernetes/ssl/ca-key.pem \
   -config=/data/kubernetes/ssl/ca-config.json \
   -profile=kubernetes admin-csr.json | cfssljson -bare admin
[root@node-01 ssl]# ls -l admin*
[root@node-01 ssl]# ls -l admin*
-rw-r--r-- 1 root root 1009 Dec 25 11:26 admin.csr
-rw-r--r-- 1 root root  229 Dec 25 11:24 admin-csr.json
-rw------- 1 root root 1679 Dec 25 11:26 admin-key.pem
-rw-r--r-- 1 root root 1399 Dec 25 11:26 admin.pem
[root@node-01 ssl]# cp admin*.pem /data/kubernetes/ssl/

4.设置集群参数

[root@node-01 src]# kubectl config set-cluster kubernetes \
   --certificate-authority=/data/kubernetes/ssl/ca.pem \
   --embed-certs=true \
   --server=https://10.31.90.200:6443
Cluster "kubernetes" set.

5.设置客户端认证参数

[root@node-01 ssl]# kubectl config set-credentials admin \
   --client-certificate=/data/kubernetes/ssl/admin.pem \
   --embed-certs=true \
   --client-key=/data/kubernetes/ssl/admin-key.pem
User "admin" set.

6.设置上下文参数

[root@node-01 ssl]# kubectl config set-context kubernetes \
   --cluster=kubernetes \
   --user=admin
Context "kubernetes" created.

7.设置默认上下文

[root@node-01 src]# kubectl config use-context kubernetes
Switched to context "kubernetes".

8.使用kubectl工具

[root@node-01 ssl]# kubectl get cs
NAME                 STATUS    MESSAGE              ERROR
scheduler            Healthy   ok                   
controller-manager   Healthy   ok                   
etcd-1               Healthy   {"health": "true"}   
etcd-0               Healthy   {"health": "true"}   
etcd-2               Healthy   {"health": "true"}   

后续会陆续更新所有的安装文档，如果你觉得我写的不错，希望大家多多关注点赞，非常感谢！

转载于:https://blog.51cto.com/billy98/2335161