手动安装K8s第七节：node节点部署-kube-proxy

部署Kubernetes Proxy

vim CentOS-Base.repo

[base]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-7-11.noarch.rpm

rpm -ivh epel-release-7-11.noarch.rpm

1.配置kube-proxy使用LVS
[root@k8snode1 ~]# yum install -y ipvsadm ipset conntrack

[root@k8smaster opt]# cd /usr/local/src/ssl/
[root@k8smaster ssl]# vim kube-proxy-csr.json

{
"CN": "system:kube-proxy",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}

3.生成证书
[root@k8smaster ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
-ca-key=/opt/kubernetes/ssl/ca-key.pem \
-config=/opt/kubernetes/ssl/ca-config.json \
-profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

4.分发证书到所有节点
[root@k8smaster ssl]# cp kube-proxy.pem /opt/kubernetes/ssl/
[root@k8smaster ssl]# scp kube-proxy.pem k8snode1:/opt/kubernetes/ssl/
[root@k8smaster ssl]# scp kube-proxy*.pem k8snode2:/opt/kubernetes/ssl/

5.创建kube-proxy配置文件
[root@k8smaster ssl]# kubectl config set-cluster kubernetes \
--certificate-authority=/opt/kubernetes/ssl/ca.pem \
--embed-certs=true \
--server=https://192.168.137.171:6443 \
--kubeconfig=kube-proxy.kubeconfig

[root@k8smaster ssl]# kubectl config set-credentials kube-proxy \
--client-certificate=/opt/kubernetes/ssl/kube-proxy.pem \
--client-key=/opt/kubernetes/ssl/kube-proxy-key.pem \
--embed-certs=true \
--kubeconfig=kube-proxy.kubeconfig
User "kube-proxy" set.

[root@k8smaster ssl]# kubectl config set-context default \
--cluster=kubernetes \
--user=kube-proxy \
--kubeconfig=kube-proxy.kubeconfig
Context "default" created.

[root@k8smaster ssl]# kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
Switched to context "default".

6.分发kubeconfig配置文件
[root@k8smaster ssl]# cp kube-proxy.kubeconfig /opt/kubernetes/cfg/
[root@k8smaster ssl]# scp kube-proxy.kubeconfig k8snode1:/opt/kubernetes/cfg/
[root@k8smaster ssl]# scp kube-proxy.kubeconfig k8snode2:/opt/kubernetes/cfg/

7.创建kube-proxy服务配置（node节点）
[root@k8snode1 ~]# mkdir /var/lib/kube-proxy
[root@k8snode1 ~]# vim /usr/lib/systemd/system/kube-proxy.service

[Unit]
Description=Kubernetes Kube-Proxy Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
WorkingDirectory=/var/lib/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy \
--bind-address=192.168.137.201 \
--hostname-override=192.168.137.201 \
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig \
--masquerade-all \
--feature-gates=SupportIPVSProxyMode=true \
--proxy-mode=ipvs \
--ipvs-min-sync-period=5s \
--ipvs-sync-period=5s \
--ipvs-scheduler=rr \
--logtostderr=true \
--v=2 \
--logtostderr=false \
--log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

9.查看服务状态 查看kube-proxy服务状态
[root@k8snode1 ~]# systemctl daemon-reload
[root@k8snode1 ~]# systemctl enable kube-proxy
[root@k8snode1 ~]# systemctl start kube-proxy
[root@k8snode1 ~]# systemctl status kube-proxy

在node节点查看LVS状态
[root@k8snode1 ~]# ipvsadm -L -n
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.137.201:33246 rr
TCP 192.168.137.215:33246 rr
TCP 10.1.0.1:443 rr persistent 10800
-> 192.168.137.171:6443 Masq 1 0 0
TCP 10.1.0.2:53 rr
TCP 10.1.72.67:443 rr
TCP 10.1.233.95:80 rr
TCP 127.0.0.1:33246 rr
TCP 172.17.0.1:33246 rr
UDP 10.1.0.2:53 rr

master节点查看 node状态
[root@k8smaster ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8snode1 Ready <none> 1h v1.10.1
k8snode2 Ready <none> 1h v1.10.1

转载于:https://blog.51cto.com/andyliu/2129075