1.参考文档
https://v1-12.docs.kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#bootstrap-tokens
https://kubernetes.io/zh/docs/setup/independent/create-cluster-kubeadm/
https://www.kubernetes.org.cn/5025.html
2.基础环境 (服务器IP：172.17.0.51,52,53)
a.系统版本 CentOS Linux release 7.6.1810 (Core)
b.kubernetes版本
kubernetes-server-linux-amd64(v1.13.1)
kubernetes-node-linux-amd64(v1.13.1)
kubernetes-client-linux-amd64(v1.13.1)
c.修改主机名 hostnamectl --static set-hostname node51,修改 /etc/hosts
3.安装kubernetes node
Kubernetes node运行组件：
kube-proxy,kubelet
a. 复制执行文件
tar -zxvf kubernetes-node-linux-amd64.tar.gz && cd kubernetes/node/bin/
cp kubelet kube-proxy kubectl /bin
b. 复制证书到节点
ca-key.pem ca.pem kube-proxy-key.pem kube-proxy.pem metrics-server-key.pem metrics-server.pem server-key.pem server.pem
c.创建配置文件
创建kubelet bootstrap kubeconfig文件，vim environment.sh,并执行
#!/bin/bash
#创建kubelet bootstrapping kubeconfig
BOOTSTRAP_TOKEN=938752325e746f9d52be37a3705184f3
KUBE_APISERVER="https://172.17.0.51:6443"
#设置集群参数
kubectl config set-cluster kubernetes \
--certificate-authority=/etc/kubernetes/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=bootstrap.kubeconfig
#设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
--token=${BOOTSTRAP_TOKEN} \
--kubeconfig=bootstrap.kubeconfig
# 设置上下文参数
kubectl config set-context default \
--cluster=kubernetes \
--user=kubelet-bootstrap \
--kubeconfig=bootstrap.kubeconfig
# 设置默认上下文
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
#----------------------
# 创建kube-proxy kubeconfig文件
kubectl config set-cluster kubernetes \
--certificate-authority=/etc/kubernetes/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-credentials kube-proxy \
--client-certificate=/etc/kubernetes/ssl/kube-proxy.pem \
--client-key=/etc/kubernetes/ssl/kube-proxy-key.pem \
--embed-certs=true \
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-context default \
--cluster=kubernetes \
--user=kube-proxy \
--kubeconfig=kube-proxy.kubeconfig
kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
创建kubelet参数配置模板
vim /etc/kubernetes/conf/kubelet.config
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 172.17.0.52
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS: ["10.254.0.200"]
clusterDomain: cluster.local.
failSwapOn: false
authentication:
anonymous:
enabled: true
创建kubelet配置文件
vim /etc/kubernetes/conf/kubelet
KUBELET_ARGS="--logtostderr=true \
--v=2 \
--hostname-override=node4052 \
--kubeconfig=/etc/kubernetes/conf/kubelet.kubeconfig \
--bootstrap-kubeconfig=/etc/kubernetes/conf/bootstrap.kubeconfig \
--config=/etc/kubernetes/conf/kubelet.config \
--cert-dir=/etc/kubernetes/ssl \
--pod-infra-container-image=172.17.0.52:5000:pause:3.0"
创建kubelet systemd文件
vim /usr/lib/systemd/system/kubelet.service
[Unit]
Description=Kubernetes Kubelet Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service
Requires=docker.service
[Service]
EnvironmentFile=-/etc/kubernetes/conf/kubelet
ExecStart=/usr/bin/kubelet $KUBELET_ARGS
Restart=on-failure
KillMode=process
[Install]
WantedBy=multi-user.target
添加完kubelet.service配置
将kubelet-bootstrap用户绑定到系统集群角色(在master执行)
kubectl create clusterrolebinding kubelet-bootstrap \
--clusterrole=system:node-bootstrapper \
--user=kubelet-bootstrap
创建kube-proxy配置文件
vim /etc/kubernetes/conf/kube-proxy
KUBE_PROXY_ARGS="--logtostderr=true \
--v=2 \
--hostname-override=node52 \
--bind-address=172.17.0.52 \
--masquerade-all \
--cluster-cidr=10.254.0.0/16 \
--proxy-mode=ipvs \
--ipvs-min-sync-period=5s \
--ipvs-sync-period=5s \
--kubeconfig=/etc/kubernetes/conf/kube-proxy.kubeconfig"
创建kube-proxy systemd文件
vim /usr/lib/systemd/system/kube-proxy.service
[Unit]
Description=Kubernetes Kube-Proxy Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target
[Service]
EnvironmentFile=-/etc/kubernetes/conf/proxy
ExecStart=/usr/bin/kube-proxy $KUBE_PROXY_ARGS
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
3.启动配置
systemctl daemon-reload
systemctl enable kubelet
systemctl enable kube-proxy
systemctl start kubelet
systemctl start kube-proxy
4.激活节点
[root@node51 ~]# kubectl get csr
NAME AGE REQUESTOR CONDITION
node-csr-ij3py9j-yi-eoa8sOHMDs7VeTQtMv0N3Efj3ByZLMdc 102s kubelet-bootstrap Pending
接受node
Kubectl certificate approve node-csr-ij3py9j-yi-eoa8sOHMDs7VeTQtMv0N3Efj3ByZLMdc
[root@node4051 ~]# kubectl get csr
NAME AGE REQUESTOR CONDITION
node-csr-VArU3IVs1Dwrt4PCznVvxxhhJRu802xy2uD-d9GBtN8 70m kubelet-bootstrap Approved,Issued
node-csr-kBydHCiJsqA1OCU0PwAElBRi4xHQQDSsZzFMfBXOzH8 5m12s kubelet-bootstrap Approved,Issued
5.验证节点
systemctl status {kube-proxy,kubelet}
kubectl get cs,nodes