Kubernetes 1.8.4 手动安装教程-安装Node（四）

2019独角兽企业重金招聘Python工程师标准>>>

       Node 是主要执行容器实例的节点，可视为工作节点。在这步骤我们会下载 Kubernetes binary 文件，并创建 node 的 certificate 来提供给节点注册认证用。Kubernetes 使用Node Authorizer来提供Authorization mode，这种授权模式会替 Kubelet 生成 API request。

• 在开始前，我们先在master将需要的 ca 与 cert 复制到 Node 节点上

  for NODE in node163 node164; do
      ssh ${NODE} "mkdir -p /etc/kubernetes/pki/"
      ssh ${NODE} "mkdir -p /etc/etcd/ssl"
      # Etcd ca and cert
      for FILE in etcd-ca.pem etcd.pem etcd-key.pem; do
        scp /etc/etcd/ssl/${FILE} ${NODE}:/etc/etcd/ssl/${FILE}
      done
      # Kubernetes ca and cert
      for FILE in pki/ca.pem pki/ca-key.pem bootstrap.conf; do
        scp /etc/kubernetes/${FILE} ${NODE}:/etc/kubernetes/${FILE}
      done
    done

   

• 下载所有需要的执行文件

  # Download Kubernetes
  export KUBE_URL="https://storage.googleapis.com/kubernetes-release/release/v1.8.4/bin/linux/amd64"
  wget "${KUBE_URL}/kubelet" -O /usr/local/bin/kubelet
  chmod +x /usr/local/bin/kubelet
  
  # Download CNI
  mkdir -p /opt/cni/bin && cd /opt/cni/bin
  export CNI_URL="https://github.com/containernetworking/plugins/releases/download"
  wget -qO- "${CNI_URL}/v0.6.0/cni-plugins-amd64-v0.6.0.tgz" | tar -zx

  注意：需要翻墙，后续我上传到百度网盘
• 生成Kubernetes 相关文件，包含 drop-in file、systemd service 等
  创建文件夹

  mkdir -p /etc/systemd/system/kubelet.service.d

  生成kubelet.service

  cat <<EOF > /lib/systemd/system/kubelet.service
  [Unit]
  Description=kubelet: The Kubernetes Node Agent
  Documentation=http://kubernetes.io/docs/
  
  [Service]
  ExecStart=/usr/local/bin/kubelet
  Restart=on-failure
  StartLimitInterval=0
  RestartSec=10
  
  [Install]
  WantedBy=multi-user.target
  EOF

  生成10-kubelet.conf

  cat <<EOF > /etc/systemd/system/kubelet.service.d/10-kubelet.conf
  [Service]
  Environment="KUBELET_KUBECONFIG_ARGS=--address=0.0.0.0 --port=10250 --kubeconfig=/etc/kubernetes/kubelet.conf"
  Environment="KUBE_LOGTOSTDERR=--logtostderr=true --v=0"
  Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true --anonymous-auth=false"
  Environment="KUBELET_POD_CONTAINER=--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google_containers/pause-amd64:3.0"
  Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin"
  Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local"
  Environment="KUBELET_AUTHZ_ARGS=--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.pem"
  Environment="KUBELET_CADVISOR_ARGS=--cadvisor-port=0"
  Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki"
  Environment="KUBELET_EXTRA_ARGS=--fail-swap-on=false --serialize-image-pulls=false"
  Environment="KUBE_NODE_LABEL=--node-labels=node-role.kubernetes.io/master=true"
  ExecStart=
  ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBE_LOGTOSTDERR $KUBELET_POD_CONTAINER $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_AUTHZ_ARGS $KUBELET_EXTRA_ARGS $KUBE_NODE_LABEL
  EOF

   

• 创建 var 存放信息，然后启动 kubelet 服务

  mkdir -p /var/lib/kubelet /var/log/kubernetes && systemctl enable kubelet.service && systemctl start kubelet.service

  P.S. 重复一样动作来完成其他节点。

• 授权 Kubernetes Node，当所有节点都完成后，在master节点，因为我们采用 TLS Bootstrapping
  创建一个 ClusterRoleBinding

  kubectl create clusterrolebinding kubelet-bootstrap \
      --clusterrole=system:node-bootstrapper \
      --user=kubelet-bootstrap

  在master通过简单指令验证，会看到节点处于pending

  kubectl get csr

  通过 kubectl 来允许节点加入集群

  kubectl get csr | awk '/Pending/ {print $1}' | xargs kubectl certificate approve
  kubectl get csr
  kubectl get node

转载于:https://my.oschina.net/ytqvip/blog/1603911