kubernetes v1.12.0集群部署(二进制方式+基于CA签名双向数字证书认证方式)

kubernetes 最简单的方式是通过yum install kubernetes 直接安装,但是默认安装的是v5版本的kubernetes,所以不推荐使用,还有一种是在v1.4版本开始引入了的kubeadm工具一键部署,但是如果 没有访问gcr.io的网络环境的话部署过程会报错。所以我这边推荐使用二进制的方式部署

 

源码包下载地址:

https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1120

 

需要下载服务端:kubernetes-server-linux-amd64.tar.gz

以及客户端:kubernetes-node-linux-amd64.tar.gz

1、两台CentOS7 主机:

10.1.31.205 docker1 Master

10.1.1.206 docker2 Node

初始化:

设置hosts地址解析 关闭selinuc 关闭防火墙firewalld

 

Master上部署:

  • etcd
  • kube-apiserver
  • kube-controller-manager
  • kube-scheduler

Node上部署:

  • Docker
  • kubelet
  • kube-proxy

 

1、etcd

etcd服务是Kubernetes集群的核心数据库,在安装各个服务之前需要先安装启动。这里演示的是部署etcd单节点,当然也可以配置3节点的集群。如果想配置更加简单,推荐直接使用yum方式安装。

# wget https://github.com/coreos/etcd/releases/download/v3.2.20/etcd-v3.2.20-linux-amd64.tar.gz # tar xf etcd-v3.2.20-linux-amd64.tar.gz # cd etcd-v3.2.20-linux-amd64 # cp etcd etcdctl /usr/bin/ # mkdir /var/lib/etcd # mkdir /etc/etcd

编辑systemd管理文件:

vim /usr/lib/systemd/system/etcd.service

[Unit] Description=Etcd Server After=network.target [Service] Type=simple WorkingDirectory=/var/lib/etcd/ EnvironmentFile=-/etc/etcd/etcd.conf ExecStart=/usr/bin/etcd [Install] WantedBy=multi-user.target

启动服务:

systemctl daemon-reload systemctl start etcd systemctl status etcd.service

查看服务状态:

 

 

说明: etcd 会启用两个端口,其中2380 是集群的通信端口,2379是服务端口。如果是配置etcd集群,则要修改配置文件,设置监听IP和端口。

etcdctl cluster-health 验证etcd是否正常启动

 

下载到master: kubernetes-server-linux-amd64.tar.gz 到/usr/local/

#tar xf kubernetes-server-linux-amd64.tar.gz -c /usr/local

#cd kubernetes/server/bin

#cp `ls|egrep -v "*.tar|*_tag"` /usr/bin/

 

将以下文件拷贝到/usr/bin下

 

配置kube-apiserver:

1、编辑systemd的启动文件:

vim /usr/lib/systemd/system/kube-apiserver.service

[Unit] Description=Kubernetes API Server Documentation=https://kubernetes.io/docs/concepts/overview After=network.target After=etcd.service [Service] EnvironmentFile=/etc/kubernetes/apiserver ExecStart=/usr/bin/kube-apiserver $KUBE_API_ARGS Restart=on-failure Type=notify LimitNOFILE=65536 [Install] WantedBy=multi-user.target

 

2、配置参数文件(需要先创建配置目录):

cat /etc/kubernetes/apiserver |grep -v ^$ | grep -v ^#

KUBE_API_ARGS="--storage-backend=etcd3 \

--etcd-servers=http://127.0.0.1:2379 \

--bind-address=0.0.0.0 \

--secure-port=6443 \

--service-cluster-ip-range=10.222.0.0/16 \

--service-node-port-range=1-65535 \

--client-ca-file=/etc/kubernetes/ssl/ca.crt \

--tls-private-key-file=/etc/kubernetes/ssl/server.key \

--tls-cert-file=/etc/kubernetes/ssl/server.crt \

--enable-admission-plugins=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultStorageClass,ResourceQuota \

--logtostderr=false \

--log-dir=/var/log/kubernetes \

--v=2"

 

  • service-cluster-ip-range是servcies的虚拟IP的IP范围,这里可以自己定义,不能当前的宿主机网段重叠。
  • bind-addres 指定的apiserver监听地址,对应的监听端口是6443,使用的https的方式。
  • client-ca-file 这是认证的相关文件,这预先定义,后面会创建证书文件,并放置到对应的路径。

 

3、创建日志目录和证书目录,如果没有配文件目录也需要创建:

 

mkdir /var/log/kubernetes

mkdir /etc/kubernetes

mkdir /etc/kubernetes/ssl

 

3、kube-controller-manager

1、配置systemd的启动文件:

cat /usr/lib/systemd/system/kube-controller-manager.service

 

[Unit]

Description=Kubernetes Controller Manager

Documentation=https//github.com/GoogleCloudPlatform/kubernetes

After=kube-apiserver.service

Requires=kube-apiserver.service

 

[Service]

EnvironmentFile=/etc/kubernetes/controller-manager

ExecStart=/usr/bin/kube-controller-manager $KUBE_CONTROLLER_MANAGER_ARGS

Restart=on-failure

LimitNOFILE=65536

 

[Install]

WantedBy=multi-user.target

 

2、配置启动参数文件:

cat /etc/kubernetes/controller-manager

KUBE_CONTROLLER_MANAGER_ARGS="--master=https://10.1.31.205:6443 --service-account-private-key-file=/etc/kubernetes/ssl/server.key --logtostderr=true --log-dir=/app/kubernets/log --v=2 --root-ca-file=/etc/kubernetes/ssl/ca.crt --kubeconfig=/etc/kubernetes/kubeconfig"

4、kube-scheduler

1、配置systemd启动文件:

# cat /etc/kubernetes/controller-manager

KUBE_CONTROLLER_MANAGER_ARGS="--master=https://10.1.31.205:6443 --service-account-private-key-file=/etc/kubernetes/ssl/server.key --logtostderr=true --log-dir=/app/kubernets/log --v=2 --root-ca-file=/etc/kubernetes/ssl/ca.crt --kubeconfig=/etc/kubernetes/kubeconfig"

[root@docker1 bin]# cat /usr/lib/systemd/system/kube-scheduler.service

[Unit]

Description=Kubernetes Controller Manager

Documentation=https://github.com/GoogleCloudPlatform/kubernetes

After=kube-apiserver.service

Requires=kube-apiserver.service

 

[Service]

EnvironmentFile=/etc/kubernetes/scheduler

ExecStart=/usr/bin/kube-scheduler $KUBE_SCHEDULER_ARGS

Restart=on-failure

LimitNOFILE=65536

 

[Install]

WantedBy=multi-user.target

 

2、配置参数文件:

cat /etc/kubernetes/scheduler

KUBE_SCHEDULER_ARGS="--master=https://10.1.31.205:6443 --logtostderr=false --log-dir=/app/kubernets/log --kubeconfig=/etc/kubernetes/kubeconfig --v=2"

 

 

5、创建kubeconfig文件

cat /etc/kubernetes/kubeconfig

apiVersion: v1

kind: Config

users:

- name: controllermanager

user:

client-certificate: /etc/kubernetes/ssl/cs_client.crt

client-key: /etc/kubernetes/ssl/cs_client.key

clusters:

- name: local

cluster:

certificate-authority: /etc/kubernetes/ssl/ca.crt

contexts:

- context:

cluster: local

user: controllermanager

name: my-context

current-context: my-context

 

6、创建CA证书

1、配置kube-apiserver的CA证书和私钥文件:

openssl genrsa -out ca.key 2048

openssl req -x509 -new -nodes -key ca.key -subj "/CN=10.1.31.205" -days 5000 -out ca.crt #CN填的是master ip地址

openssl genrsa -out server.key 2048

2、创建master_ssl.cnf文件:

cat ../master_ssl.cnf

[req]

req_extensions = v3_req

distinguished_name = req_distinguished_name

[req_distinguished_name]

[ v3_req ]

basicConstraints = CA:FALSE

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

subjectAltName = @alt_names

[alt_names]

DNS.1 = kubernetes

DNS.2 = kubernetes.default

DNS.3 = kubernetes.default.svc

DNS.4 = kubernetes.default.svc.cluster.local

DNS.5 = k8s_master

IP.1 = 10.222.0.1 # ClusterIP 地址

IP.2 = 10.1.31.205 # master IP地址

 

 

3、基于上述文件,创建server.csr和 server.crt文件,执行如下命令:

openssl req -new -key server.key -subj "/CN=docker1" -config ../master_ssl.cnf -out server.csr #CN是master hostname

 

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 5000 -extensions v3_req -extfile ../master_ssl.cnf -out server.crt

 

openssl genrsa -out cs_client.key 2048

 

4、设置kube-controller-manager相关证书:

 

cd /etc/kubernetes/ssl/

openssl genrsa -out cs_client.key 2048

openssl req -new -key cs_client.key -subj "/CN=docker1" -out cs_client.csr

openssl x509 -req -in cs_client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out cs_client.crt -days 5000

 

确保/etc/kubernetes/ssl/ 目录下有如下文件:

 

7、启动服务:

1、启动kube-apiserver:

# systemctl daemon-reload

# systemctl enable kube-apiserver

# systemctl start kube-apiserver

说明:kube-apiserver 默认会启动两个端口(8080和6443),其中,8080是各个组件之间通信的端口,在新的版本中已经很少使用,kube-apiserver所在的主机一般称为Master, 另一个端口6443是为HTTPS提供身份验证和授权的端口。

 

2、启动kube-controller-manager:

# systemctl daemon-reload # systemctl enable kube-controller-manager # systemctl start kube-controller-manager

说明:此服务会启动一个10252的端口

 

3、启动kube-scheduler

# systemctl daemon-reload # systemctl enable kube-scheduler # systemctl start kube-scheduler

说明: 此服务会启动一个10251的端口

 

NODE节点部署:

Node节点上部署的服务非常简单,只需要部署 docker、kubelet和kube-proxy服务即可。

上传Kubernetes的Node节点二进制包(kubernetes-node-linux-amd64.tar.gz),解压后执行如下命令:

tar xf kubernetes-node-linux-amd64.tar.gz

cd /kubernetes/node/bin

cp kubectl kubelet kube-proxy /usr/bin/

1.创建kubelet证书

 

每台Node节点上都需要配置kubelet的客户端证书。

 

复制Master上的ca.crt,ca.key到Node节点上的ssl目录,执行如下命令生成kubelet_client.crt和kubelet_client.csr文件:

#openssl genrsa -out kubelet_client.key 2048

#openssl req -new -key kubelet_client.key -subj "/CN=10.1.1.206" -out kubelet_client.csr #cn是node自己的ip地址

#openssl x509 -req -in kubelet_client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out kubelet_client.crt -days 5000

 

3、kubelet

1、配置启动文件:

cat /usr/lib/systemd/system/kubelet.service

[Unit]

Description=Kubernetes API Server

Documentation=https://kubernetes.io/doc

After=docker.service

Requires=docker.service

 

[Service]

WorkingDirectory=/var/lib/kubelet

ExecStart=/usr/bin/kubelet --kubeconfig=/etc/kubernetes/kubeconfig.yaml --logtostderr=false --log-dir=/var/log/kubernetes --v=2

Restart=on-failure

 

[Install]

WantedBy=multi-user.target

2、配置文件:

cat /etc/kubernetes/kubeconfig.yaml

apiVersion: v1

kind: Config

users:

- name: kubelet

user:

client-certificate: /etc/kubernetes/ssl/kubelet_client.crt

client-key: /etc/kubernetes/ssl/kubelet_client.key

clusters:

- name: local

cluster:

certificate-authority: /etc/kubernetes/ssl/ca.crt

server: https://10.1.31.205:6443 #MASTER apiserver

contexts:

- context:

cluster: local

user: kubelet

name: my-context

current-context: my-context

 

3、启动服务:

# systemctl daemon-reload # systemctl start kubelet # systemctl enable kubelet

 

 

4、在master上验证:

说明:kubelet充当了一个agent的角色,安装好kubelet就可以在master上查看到节点信息。kubelet的配置文件是一个yaml格式文件,对master的指定需要在配置文件中说明。默认监听10248、10250、10255、4194端口。

 

4、 kube-proxy

#cat /usr/lib/systemd/system/kube-proxy.service

[Unit]

Description=Kubernetes Kube-Proxy Server

Documentation=https://github.com/GoogleCloudPlatform/kubernetes

After=network.service

Requires=network.service

 

[Service]

EnvironmentFile=/etc/kubernetes/proxy

ExecStart=/usr/bin/kube-proxy $KUBE_PROXY_ARGS

Restart=on-failure

LimitNOFILE=65536

 

[Install]

WantedBy=multi-user.target

 

2、创建参数文件:

# cat /etc/kubernetes/proxy

KUBE_PROXY_ARGS="--master=https://10.1.31.205:6443 --kubeconfig=/etc/kubernetes/kubeconfig.yaml"

 

3、启动服务:

# systemctl daemon-reload

# systemctl start kube-proxy

# systemctl enable kube-proxy

说明:启动服务后默认监听10249,10256.

 

 

 

 

 

 

 

没有更多推荐了,返回首页

私密
私密原因:
请选择设置私密原因
  • 广告
  • 抄袭
  • 版权
  • 政治
  • 色情
  • 无意义
  • 其他
其他原因:
120
出错啦
系统繁忙,请稍后再试