Node 是主要执行容器实例的节点,可视为工作节点。在这步骤我们会下载 Kubernetes binary 文件,并创建 node 的 certificate 来提供给节点注册认证用。Kubernetes 使用Node Authorizer来提供Authorization mode,这种授权模式会替 Kubelet 生成 API request。
- 在开始前,我们先在master将需要的 ca 与 cert 复制到 Node 节点上
for NODE in node163 node164; do ssh ${NODE} "mkdir -p /etc/kubernetes/pki/" ssh ${NODE} "mkdir -p /etc/etcd/ssl" # Etcd ca and cert for FILE in etcd-ca.pem etcd.pem etcd-key.pem; do scp /etc/etcd/ssl/${FILE} ${NODE}:/etc/etcd/ssl/${FILE} done # Kubernetes ca and cert for FILE in pki/ca.pem pki/ca-key.pem bootstrap.conf; do scp /etc/kubernetes/${FILE} ${NODE}:/etc/kubernetes/${FILE} done done
-
下载所有需要的执行文件
注意:需要翻墙,后续我上传到百度网盘# Download Kubernetes export KUBE_URL="https://storage.googleapis.com/kubernetes-release/release/v1.8.4/bin/linux/amd64" wget "${KUBE_URL}/kubelet" -O /usr/local/bin/kubelet chmod +x /usr/local/bin/kubelet # Download CNI mkdir -p /opt/cni/bin && cd /opt/cni/bin export CNI_URL="https://github.com/containernetworking/plugins/releases/download" wget -qO- "${CNI_URL}/v0.6.0/cni-plugins-amd64-v0.6.0.tgz" | tar -zx
- 生成Kubernetes 相关文件,包含 drop-in file、systemd service 等
创建文件夹
生成kubelet.servicemkdir -p /etc/systemd/system/kubelet.service.d
生成10-kubelet.confcat <<EOF > /lib/systemd/system/kubelet.service [Unit] Description=kubelet: The Kubernetes Node Agent Documentation=http://kubernetes.io/docs/ [Service] ExecStart=/usr/local/bin/kubelet Restart=on-failure StartLimitInterval=0 RestartSec=10 [Install] WantedBy=multi-user.target EOF
cat <<EOF > /etc/systemd/system/kubelet.service.d/10-kubelet.conf [Service] Environment="KUBELET_KUBECONFIG_ARGS=--address=0.0.0.0 --port=10250 --kubeconfig=/etc/kubernetes/kubelet.conf" Environment="KUBE_LOGTOSTDERR=--logtostderr=true --v=0" Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true --anonymous-auth=false" Environment="KUBELET_POD_CONTAINER=--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google_containers/pause-amd64:3.0" Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin" Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local" Environment="KUBELET_AUTHZ_ARGS=--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.pem" Environment="KUBELET_CADVISOR_ARGS=--cadvisor-port=0" Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki" Environment="KUBELET_EXTRA_ARGS=--fail-swap-on=false --serialize-image-pulls=false" Environment="KUBE_NODE_LABEL=--node-labels=node-role.kubernetes.io/master=true" ExecStart= ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBE_LOGTOSTDERR $KUBELET_POD_CONTAINER $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_AUTHZ_ARGS $KUBELET_EXTRA_ARGS $KUBE_NODE_LABEL EOF
-
创建 var 存放信息,然后启动 kubelet 服务
mkdir -p /var/lib/kubelet /var/log/kubernetes && systemctl enable kubelet.service && systemctl start kubelet.service
P.S. 重复一样动作来完成其他节点。
-
授权 Kubernetes Node,当所有节点都完成后,在master节点,因为我们采用 TLS Bootstrapping
创建一个 ClusterRoleBindingkubectl create clusterrolebinding kubelet-bootstrap \ --clusterrole=system:node-bootstrapper \ --user=kubelet-bootstrap
在master通过简单指令验证,会看到节点处于pending
kubectl get csr
通过 kubectl 来允许节点加入集群
kubectl get csr | awk '/Pending/ {print $1}' | xargs kubectl certificate approve kubectl get csr kubectl get node