二進制安裝k8s - 0.6 master安裝 kube-apiserver、kubu-controller-manager 、kube-scheduler

二進制安裝k8s - 0.6 master安裝 kube-apiserver 、kubu-controller-manager 、kube-scheduler

---

創建 kubernetes 證書籤名請求

vim /data/k8s/cert/kubernetes-csr.json

{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "{{ host }}",
    "10.44.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "k8s",
      "OU": "Lswzw"
    }
  ]
}

注：
hosts 字段指定授權使用該證書的 IP 或域名列表，vip 地址、apiserver節點 IP、kubernetes 服務 IP 和域名、等須要訪問api的地址；
10.44.0.1 爲 svc 地址段
我這隻有1個matser host 就替換爲 192.168.100.59

創建 kubernetes 證書和私鑰

cd /data/k8s/cert

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes

創建aggregator proxy相關證書

vim /data/k8s/cert/aggregator-proxy-csr.json

{
  "CN": "aggregator",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "k8s",
      "OU": "Lswzw"
    }
  ]
}

創建 aggregator-proxy證書和私鑰

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes aggregator-proxy-csr.json | cfssljson -bare aggregator-proxy

創建 master 服務的 systemd 文件

文件放 /etc/systemd/system/

• kube-apiserver.service

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target

[Service]
ExecStart=/data/k8s/bin/kube-apiserver \
  --advertise-address=192.168.100.59 \
  --allow-privileged=true \
  --anonymous-auth=false \
  --authorization-mode=Node,RBAC \
  --bind-address=192.168.100.59 \
  --client-ca-file=/data/k8s/cert/ca.pem \
  --endpoint-reconciler-type=lease \
  --etcd-cafile=/data/k8s/cert/ca.pem \
  --etcd-certfile=/data/k8s/cert/kubernetes.pem \
  --etcd-keyfile=/data/k8s/cert/kubernetes-key.pem \
  --etcd-servers=https://192.168.100.59:2379 \
  --kubelet-certificate-authority=/data/k8s/cert/ca.pem \
  --kubelet-client-certificate=/data/k8s/cert/admin.pem \
  --kubelet-client-key=/data/k8s/cert/admin-key.pem \
  --kubelet-https=true \
  --service-account-key-file=/data/k8s/cert/ca.pem \
  --service-cluster-ip-range=10.44.0.0/16 \
  --service-node-port-range=1000-65535 \
  --tls-cert-file=/data/k8s/cert/kubernetes.pem \
  --tls-private-key-file=/data/k8s/cert/kubernetes-key.pem \
  --requestheader-client-ca-file=/data/k8s/cert/ca.pem \
  --requestheader-allowed-names= \
  --requestheader-extra-headers-prefix=X-Remote-Extra- \
  --requestheader-group-headers=X-Remote-Group \
  --requestheader-username-headers=X-Remote-User \
  --proxy-client-cert-file=/data/k8s/cert/aggregator-proxy.pem \
  --proxy-client-key-file=/data/k8s/cert/aggregator-proxy-key.pem \
  --enable-aggregator-routing=true \
  --v=2
Restart=always
RestartSec=5
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

• kube-controller-manager.service

[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/data/k8s/bin/kube-controller-manager \
  --address=127.0.0.1 \
  --allocate-node-cidrs=true \
  --cluster-cidr=10.244.0.0/16 \
  --cluster-name=kubernetes \
  --cluster-signing-cert-file=/data/k8s/cert/ca.pem \
  --cluster-signing-key-file=/data/k8s/cert/ca-key.pem \
  --kubeconfig=/data/k8s/conf/kube-controller-manager.kubeconfig \
  --leader-elect=true \
  --node-cidr-mask-size=24 \
  --root-ca-file=/data/k8s/cert/ca.pem \
  --service-account-private-key-file=/data/k8s/cert/ca-key.pem \
  --service-cluster-ip-range=10.44.0.0/16 \
  --use-service-account-credentials=true \
  --v=2
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

• kube-scheduler.service

[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/data/k8s/bin/kube-scheduler \
  --address=127.0.0.1 \
  --kubeconfig=/data/k8s/conf/kube-scheduler.kubeconfig \
  --leader-elect=true \
  --v=2
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

注：
須要修改上面啓動裏的ip 信息

啓動 master 服務

systemctl daemon-reload
systemctl restart kube-apiserver
systemctl restart kube-controller-manager
systemctl restart kube-scheduler

配置、創建 admin用戶rbac權限

• basic-auth-rbac.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: basic-auth-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: admin

# 拷貝admin認證文件
cp /data/k8s/conf/kubectl.kubeconfig ~/.kube/config

kubectl apply -f basic-auth-rbac.yaml

查看master狀態

[root@master conf]# kubectl get cs
NAME                 STATUS    MESSAGE             ERROR
scheduler            Healthy   ok                  
controller-manager   Healthy   ok                  
etcd-0               Healthy   {"health":"true"}   

所有都是顯示OK! master搭建完成。