- master单节点添加master节点
- apiServer添加域名更新证书
- 更新kubenertes证书有效期
环境
kubernetes v1.22.12
使用kubeadm安装的集群
#添加节点
#生成节点添加token(在master运行)
#创建join token. Create join token
kubeadm token create --print-join-command
#kubeadm join IP:6443 --token xxx --discovery-token-ca-cert-hash sha256:xxx
#创建用于添加master节点的证书. Create certificate-key for add master node
kubeadm init phase upload-certs --upload-certs
#添加节点(在添加节点运行)
#安装kubelet
export Ver=1.22.12 #与master版本一致
curl -s http://elvin.vip/ks/k8s/kubelet.sh |bash
#查看往期快速创建k8s文章 https://www.cnblogs.com/elvi/p/8976305.html
#添加node节点
#添加node节点,运行上面生成的
kubeadm join IP:6443 --token xxx --discovery-token-ca-cert-hash sha256:xxx
#添加master节点
#添加master节点,添加上面创建的certificate-key
kubeadm join IP:6443 --token xxx --discovery-token-ca-cert-hash sha256:xxx \
--control-plane --certificate-key xxx
#master节点配置kubectl凭证
mkdir -p $HOME/.kube
ln -fs /etc/kubernetes/admin.conf $HOME/.kube/config
#node lable
kubectl label node $(hostname) node-role.kubernetes.io/master=
#view nodes
kubectl get nodes
#添加Endpoint
若添加master节点报错且有如下提示,则需要添加Endpoint
Please ensure that:
* The cluster has a stable controlPlaneEndpoint address.
* The certificates that must be shared among control plane instances are provided.
master单节点添加master节点报错提示没controlPlaneEndpoint
Endpoint地址需要添加到apiServer证书认证地址里
为保证Endpoint能被新节点能访问,可使用7层代理
、DNS轮询
或添加到hosts解析
单节点添加master节点后保证Endpoint高可用, 即达到master节点高可用
#echo "masterIP myk8s.api.io" >>/etc/hosts
#查看kubeadm-config
kubectl -n kube-system get cm kubeadm-config -o yaml
#修改kubeadm-config,添加如 controlPlaneEndpoint: myk8s.api.io:6443
kubectl edit cm kubeadm-config -n kube-system
#添加位置,与版本号缩进一致
controlPlaneEndpoint: myk8s.api.io:6443
kubernetesVersion: v1.22.12
#添加域名更新apiServer证书
添加Endpoint使用域名或IP后,需要更新证书
域名或IP添加到certSANs部分,如下
apiVersion: v1
data:
ClusterConfiguration: |
apiServer:
certSANs:
- myk8s.api.io
certificatesDir: /etc/kubernetes/pki
controlPlaneEndpoint: myk8s.api.io:6443
kubernetesVersion: v1.22.12
#导出kubeadm配置
kubectl -n kube-system get configmap kubeadm-config \
-o jsonpath='{.data.ClusterConfiguration}' > kubeadm-init.yaml
#查看配置
cat kubeadm-init.yaml
#创建新的apiServer证书
#移除apiserver证书
mv /etc/kubernetes/pki/apiserver.{crt,key} /tmp/
#创建新的apiserver证书
kubeadm init phase certs apiserver --config kubeadm-init.yaml
#查看证书包含的域名和IP
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text |grep DNS
#重启apiserver生效
docker ps |awk '/kube-apiserver/{print $1}' |xargs docker restart
#更新kubenertes证书有效期
#查看有效期
kubeadm certs check-expiration
#更新有效期
kubeadm certs renew all
#重启服务生效
docker ps |awk '/k8s_kube-|etcd/{print $1}' |xargs docker restart