Kubernetes集群部署（单节点二进制）

一.实验准备

主机	IP地址	安装组件
master	192.168.159.128	kube-apiserver、kube-controller-manager、kube-scheduler、etcd
node1	192.168.159.129	kuber、kuber-proxy、docker、flannel、etcd
node2	192.168.159.130	kubelet、kube-proxy、docker、flannel、etcd

二.环境部署

官方地址
链接: link.

三.节点部署

1.master（192.168.159.128）

mkdir k8s
cd k8s
mkdir etcd-cert
mv etcd-cert.sh etcd-cert

##下载证书制作工具##

vim cfssl.sh
curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl
curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson
curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo

##下载cfssl官方包##

bash cfssl.sh
ls /usr/local/bin/

##定义ca证书##

cd etcd-cert
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "www": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"     
        ]  
      } 
    }         
  }
}
EOF

##实现证书签名##

cat > ca-csr.json <<EOF 
{   
  "CN": "etcd CA",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF

##生产证书##

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

##指定etcd三个节点之间的通信验证##

cat > server-csr.json <<EOF
{
    "CN": "etcd",
    "hosts": [
    "192.168.159.128",
    "192.168.159.129",
    "192.168.159.130"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing"
                    }
    ]
}
EOF

##生成ETCD证书##

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

##ETCD 二进制包地址##
链接: link.

##找到这三个压缩包下载下来##

cd /root/k8s
rz                                            #拖入压缩包
tar zxvf etcd-v3.3.10-linux-amd64.tar.gz
ls etcd-v3.3.10-linux-amd64
mkdir /opt/etcd/{cfg,bin,ssl} -p             #配置文件，命令文件，证书
mv etcd-v3.3.10-linux-amd64/etcd etcd-v3.3.10-linux-amd64/etcdctl /opt/etcd/bin/
cp etcd-cert/*.pem /opt/etcd/ssl/            #证书拷贝
bash etcd.sh etcd01 192.168.159.128 etcd02=https://192.168.159.129:2380,etcd03=https://192.168.159.130:2380

##使用另外一个会话打开，会发现etcd进程已经开启##

ps -ef | grep etcd

##拷贝证书去其他节点##

scp -r /opt/etcd/ root@192.168.159.129:/opt
scp -r /opt/etcd/ root@192.168.159.130:/opt

##启动脚本拷贝其他节点##

scp /usr/lib/systemd/system/etcd.service root@192.168.159.129:/usr/lib/systemd/system/
scp /usr/lib/systemd/system/etcd.service root@192.168.159.130:/usr/lib/systemd/system/

2.node1（192.168.159.129）

vim /opt/etcd/cfg/etcd
#[Member]
ETCD_NAME="etcd02"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.159.129:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.159.129:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.159.129:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.159.129:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.159.128:2380,etcd02=https://192.168.159.129:2380,etcd03=https://192.168.159.130:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

systemctl start etcd          #启动
systemctl status etcd         #查看运行状态

3.node2（192.168.159.130）

vim /opt/etcd/cfg/etcd
#[Member]
ETCD_NAME="etcd03"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.159.130:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.159.130:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.159.130:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.159.130:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.159.128:2380,etcd02=https://192.168.159.129:2380,etcd03=https://192.168.159.130:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

systemctl start etcd           #启动
systemctl status etcd          #查看运行状态

##master检查群集状态##

cd /root/k8s/etcd-cert/
/opt/etcd/bin/etcdctl --ca-file=ca.pem --cert-file=server.pem --key-file=server-key.pem --endpoints="https://192.168.159.128:2379,https://192.168.159.129:2379,https://192.168.159.130:2379" cluster-health