08-高可用Kubernetes集群(测试环境)-部署node组件

1. 将kubelet-bootstrap用户绑定到系统集群角色

kubectl create clusterrolebinding kubelet-bootstrap \
--clusterrole=system:node-bootstrapper \
--user=kubelet-bootstrap

2. 创建kubeconfig文件

kubeconfig.sh脚本

BOOTSTRAP_TOKEN=0fb61c46f8991b718eb38d27b605b008
APISERVER=$1
SSL_DIR=$2

# 创建kubelet bootstrapping kubeconfig 
export KUBE_APISERVER="https://$APISERVER:6443"

# 设置集群参数
kubectl config set-cluster kubernetes \
  --certificate-authority=$SSL_DIR/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=bootstrap.kubeconfig

# 设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
  --token=${BOOTSTRAP_TOKEN} \
  --kubeconfig=bootstrap.kubeconfig

# 设置上下文参数
kubectl config set-context default \
  --cluster=kubernetes \
  --user=kubelet-bootstrap \
  --kubeconfig=bootstrap.kubeconfig

# 设置默认上下文
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig

#----------------------

# 创建kube-proxy kubeconfig文件

kubectl config set-cluster kubernetes \
  --certificate-authority=$SSL_DIR/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config set-credentials kube-proxy \
  --client-certificate=$SSL_DIR/kube-proxy.pem \
  --client-key=$SSL_DIR/kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config set-context default \
  --cluster=kubernetes \
  --user=kube-proxy \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

执行kubeconfig.sh脚本，带两个参数master ip和ssl证书路径

bash kubeconfig.sh 192.168.1.72 ~/k8s/k8s-cert/

生成两个文件bootstrap.kubeconfig和kube-proxy.kubeconfig，将两个文件拷贝至两个node节点

scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.1.95:/opt/kubernetes/cfg/ 
scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.1.88:/opt/kubernetes/cfg/ 

3. 部署kubelet组件

从master01的kubernetes-server解压包目录中拷贝kubelet kube-proxy 至两个node节点

#进入kubernetes-server解压包目录
cd soft/kubernetes/server/bin/
#拷贝文件
scp kubelet kube-proxy root@192.168.1.88:/opt/kubernetes/bin/
scp kubelet kube-proxy root@192.168.1.95:/opt/kubernetes/bin/

kubelet组件安装脚本kubelet.sh

#!/bin/bash

NODE_ADDRESS=$1
DNS_SERVER_IP=${2:-"10.0.0.2"}

cat <<EOF >/opt/kubernetes/cfg/kubelet

KUBELET_OPTS="--logtostderr=true \\
--v=4 \\
--address=${NODE_ADDRESS} \\
--hostname-override=${NODE_ADDRESS} \\
--kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \\
--experimental-bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \\
--config=/opt/kubernetes/cfg/kubelet.config \\
--cert-dir=/opt/kubernetes/ssl \\
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"

EOF

cat <<EOF >/opt/kubernetes/cfg/kubelet.config

kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: ${NODE_ADDRESS}
port: 10250
cgroupDriver: cgroupfs
clusterDNS:
- ${DNS_SERVER_IP} 
clusterDomain: cluster.local.
failSwapOn: false

EOF

cat <<EOF >/usr/lib/systemd/system/kubelet.service
[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=/opt/kubernetes/cfg/kubelet
ExecStart=/opt/kubernetes/bin/kubelet \$KUBELET_OPTS
Restart=on-failure
KillMode=process

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kubelet
systemctl restart kubelet

该脚本两个参数: NODE_IP和DNS_SERVER_IP, 其中DNS_SERVER_IP有默认值,若不传则为默认值,node02执行该脚本

bash kubelet.sh 192.168.1.88

此时node02节点会向master01节点发送csr验证,此时在master01节点查看csr请求,并接受请求

#查看
kubectl get csr 

#放行
kubectl certificate approve node-csr-jQqt1lhITpuzv0Ro_k3SbY-rRKvfKR59G_o8C06lhjs

#查看节点
kubectl get node

4. 部署kube-proxy组件

kubelet组件安装脚本proxy.sh

#!/bin/bash

NODE_ADDRESS=$1

cat <<EOF >/opt/kubernetes/cfg/kube-proxy

KUBE_PROXY_OPTS="--logtostderr=true \\
--v=4 \\
--hostname-override=${NODE_ADDRESS} \\
--cluster-cidr=10.0.0.0/24 \\
--proxy-mode=ipvs \\
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig"

EOF

cat <<EOF >/usr/lib/systemd/system/kube-proxy.service
[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy \$KUBE_PROXY_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kube-proxy
systemctl restart kube-proxy

该脚本一个参数: NODE_IP, node02执行该脚本

bash proxy.sh 192.168.1.88

5. 部署node01

从node02上拷贝组件文件

scp -r /opt/kubernetes/ root@192.168.1.95:/opt/ 
scp /usr/lib/systemd/system/{kubelet,kube-proxy}.service  root@192.168.1.95:/usr/lib/systemd/system/ 

node01修改配置文件

#删除为node02颁发的证书
cd /opt/kubernetes/ssl/
rm -f * 

#配置node01节点的ip
cd /opt/kubernetes/cfg/
grep 88 * 

将红框中的ip改为本机ip,启动kubelet和kube-proxy

systemctl restart kubelet 
systemctl restart kube-proxy 

systemctl enable kubelet 
systemctl enable kube-proxy 

查看是否启动

ps -ef |grep kube

启动正常,接下来在master01上查看是否有新的csr请求,并放行处理

#查看
kubectl get csr 

#放行
kubectl certificate approve node-csr-G6zgtk8hN_nSI-doYS1TGmBZd49lDvzvPoEwHXkpOwA
#查看节点
kubectl get node

至此,一个master和两个node已经准备就绪.