K8S 二进制安装文档（ k8s 1.17.3 docker 19.03.4）之四-kube-apiserver安装配置

4.2 安装api-server

4.2.1 下载二进制包

wget https://dl.k8s.io/v1.17.4/kubernetes-server-linux-amd64.tar.gz

tar kubernetes-server-linux-amd64.tar.gz

cp ./kubernetes/bin/kube-apiserver /opt/kubernetes/bin

4.2.2  创建api-server证书签名要求

cat > kubernetes-csr.json <

[root@k8smaster01 ssl]# ll kubernetes*.pem

-rw------- 1 root root 1679 Mar 16 04:26 kubernetes-key.pem

-rw-r--r-- 1 root root 1606 Mar 16 04:26 kubernetes.pem

scp ./kubernetes*.pem k8smaster02://opt/kubernetes/ssl/

scp ./kubernetes*.pem k8smaster03://opt/kubernetes/ssl/

4.2.3  生产加密文件

head -c 32 /dev/urandom | base64

r9X8Te9pCyDaR4KGBqgxOQnmu34oOQQMWUcyDGHYyQc=

建立一个yaml文件

cat  >encryption-config.yaml <

 

 或者直接生产一个token.csv文件

cat > token.csv <

同步加密文件到k8smaster02和k8smaster03

scp encryption-config.yaml k8smaster02://opt/kubernetes/ssl/

scp encryption-config.yaml k8smaster03://opt/kubernetes/ssl/

scp token.csv k8smaster02://opt/kubernetes/comfig/

scp token.csv k8smaster03://opt/kubernetes/config/

 4.2.4  建立kube-apiserver.service

使用token.csv

cat  > /usr/lib/systemd/system/kube-apiserver.service <

使用encryption-config.yaml

cat  > /usr/lib/systemd/system//kube-apiserver.service <

同步kube-apiserver.service到k8smaster02和k8smaster03

​​​​​​​scp /usr/lib/systemd/system/kube-apiserver.service k8smaster02://usr/lib/systemd/system/

scp /usr/lib/systemd/system/kube-apiserver.service k8smaster03://usr/lib/systemd/system/

4.2.5 运行kube-apiserver

​​​​​​​#systemctl daemon-reload

#systemctl enable kube-apiserver.service

#systemctl start kube-apiserver.service

#systemctl status kube-apiserver.service

4.2.6 运行状态查看

​​​​​​​#netstat -an  | grep -i 6443

#netstat -lnpt|grep kube

tcp   0      0 10.111.69.240:6443      0.0.0.0:*  LISTEN  18682/kube-apiserve

    6443: 接收 https 请求的安全端口，对所有请求做认证和授权；由于关闭了非安全端口，故没有监听 8080；

 输出kube-apiserver 写入 etcd 的数据

ETCDCTL_API=3 etcdctl --endpoints="https://10.111.69.240:2379,https://10.111.83.165:2379,https://10.111.127.129:2379" --cacert=/opt/kubernetes/ssl/ca.pem --cert=/opt/kubernetes/ssl/etcd.pem --key=/opt/kubernetes/ssl/etcd-key.pem get /registry/ --prefix --keys-only

通过haproxy VIP 访问 http://10.111.104.172:10080/status ​​​​​​​

4.2.7 运行错误排查

主要是配置文件语法或者信息输入错误

journalctl -fu kube-apiserver >error.log 然后在grep 出error提示

tail –f /var/log/messages