K8S-kube-proxy部署

一、签发证书

在172.16.1.55证书服务器上签发证书，kube-proxy使用的用户是kube-proxy，不能使用client证书，必须要重新签发自己的证书

[root@hdss1-55 certs]# pwd
/opt/certs
[root@hdss1-55 certs]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json  -profile=client kube-proxy-csr.json |cfssl-json -bare kube-proxy-client
2020/11/01 14:30:26 [INFO] generate received request
2020/11/01 14:30:26 [INFO] received CSR
2020/11/01 14:30:26 [INFO] generating key: rsa-2048
2020/11/01 14:30:27 [INFO] encoded CSR
2020/11/01 14:30:27 [INFO] signed certificate with serial number 344546744694132201411655906972161047625818051099
2020/11/01 14:30:27 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
[root@hdss1-55 certs]# ls kube-proxy-c* -l
-rw-r--r-- 1 root root 1005 Nov  1 14:30 kube-proxy-client.csr
-rw------- 1 root root 1679 Nov  1 14:30 kube-proxy-client-key.pem
-rw-r--r-- 1 root root 1375 Nov  1 14:30 kube-proxy-client.pem
-rw-r--r-- 1 root root  267 Nov  1 14:24 kube-proxy-csr.json

二、证书分发

生成的proxy-client-key.pem和proxy-client.pem分发到172.16.1.53和172.16.1.54上

[root@hdss1-53 cert]# pwd
/opt/kubernetes/server/bin/cert
[root@hdss1-53 cert]# scp -P22 172.16.1.55:/opt/certs/kube-proxy-client.pem .
[root@hdss1-53 cert]# scp -P22 172.16.1.55:/opt/certs/kube-proxy-client-key.pem .
[root@hdss1-53 cert]# ll |grep kube-proxy
-rw------- 1 root root 1679 Nov  1 14:44 kube-proxy-client-key.pem
-rw-r--r-- 1 root root 1375 Nov  1 14:43 kube-proxy-client.pem
[root@hdss1-54 cert]#  scp -P22 172.16.1.55:/opt/certs/kube-proxy-client.pem .
[root@hdss1-54 cert]#  scp -P22 172.16.1.55:/opt/certs/kube-proxy-client-key.pem .
[root@hdss1-54 cert]# ll |grep proxy
-rw------- 1 root root 1679 Nov  1 14:46 kube-proxy-client-key.pem
-rw-r--r-- 1 root root 1375 Nov  1 14:46 kube-proxy-client.pem

三、创建kube-proxy配置

在所有node节点创建，涉及服务器：172.16.1.53和172.16.1.54

[root@hdss1-53 conf]# kubectl config set-cluster myk8s \
--certificate-authority=/opt/kubernetes/server/bin/cert/ca.pem \
--embed-certs=true \
--server=https://172.16.1.60:7443 \
--kubeconfig=kube-proxy.kubeconfig
[root@hdss1-53 conf]# kubectl config set-credentials kube-proxy \
> --client-certificate=/opt/kubernetes/server/bin/cert/kube-proxy-client.pem \
> --client-key=/opt/kubernetes/server/bin/cert/kube-proxy-client-key.pem \
> --embed-certs=tru