部署k8s Node

部署k8s Node

1.移动kubelet bin文件

cp kubelet /opt/kubernetes/bin
scp kubelet root@192.168.201.129:/opt/kubernetes/bin
scp kubelet root@192.168.201.130:/opt/kubernetes/bin

2.创建kubelet kubeconfig文件

kubectl config set-cluster kubernetes --certificate-authority=/opt/kubernetes/ssl/ca.pem --embed-certs=true --server=https://192.168.201.128:6443 --kubeconfig=kubelet-bootstrap.kubeconfig

# token 为 token.csv文件中的token
kubectl config set-credentials kubelet-bootstrap --token=7170af4e8962c07460b5dfbbeab0b7fc --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl config set-context default --cluster=kubernetes --user=kubelet-bootstrap --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl config use-context default --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

scp kubelet-bootstrap.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg
scp kubelet-bootstrap.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg

3.创建kubelet配置文件

vi kubelet.json

# # 如果docker的驱动为systemd(通过docker info查看)，cgroupDriver处修改为systemd。此处设置很重要，否则后面node节点无法加入到集群
{
  "kind": "KubeletConfiguration",
  "apiVersion": "kubelet.config.k8s.io/v1beta1",
  "authentication": {
    "x509": {
      "clientCAFile": "/opt/kubernetes/ssl/ca.pem"
    },
    "webhook": {
      "enabled": true,
      "cacheTTL": "2m0s"
    },
    "anonymous": {
      "enabled": false
    }
  },
  "authorization": {
    "mode": "Webhook",
    "webhook": {
      "cacheAuthorizedTTL": "5m0s",
      "cacheUnauthorizedTTL": "30s"
    }
  },
  "address": "192.168.201.128",
  "port": 10250,
  "readOnlyPort": 10255,
  "cgroupDriver": "cgroupfs",                     
  "hairpinMode": "promiscuous-bridge",
  "serializeImagePulls": false,
  "featureGates": {
    "RotateKubeletClientCertificate": true,
    "RotateKubeletServerCertificate": true
  },
  "clusterDomain": "cluster.local.",
  "clusterDNS": ["10.255.0.2"]
}

scp kubelet.json root@192.168.201.129:/opt/kubernetes/cfg
scp kubelet.json root@192.168.201.130:/opt/kubernetes/cfg

4.创建kubelet启动文件

vi /usr/lib/systemd/system/kubelet.service

[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/kubernetes/kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/opt/kubernetes/bin/kubelet \
  --bootstrap-kubeconfig=/opt/kubernetes/cfg/kubelet-bootstrap.kubeconfig \
  --cert-dir=/opt/kubernetes/ssl \
  --kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \
  --config=/opt/kubernetes/cfg/kubelet.json \
  --cni-bin-dir=/opt/cni/bin \
  --cni-conf-dir=/opt/cni/net.d \
  --network-plugin=cni \
  --pod-infra-container-image=k8s.gcr.io/pause:3.2 \
  --alsologtostderr=true \
  --logtostderr=false \
  --log-dir=/var/log/kubernetes \
  --v=2
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

–hostname-override：显示名称，集群中唯一
–network-plugin：启用CNI
–kubeconfig：空路径，会自动生成，后面用于连接apiserver
–bootstrap-kubeconfig：首次启动向apiserver申请证书
–config：配置参数文件
–cert-dir：kubelet证书生成目录
–pod-infra-container-image：管理Pod网络容器的镜像

scp /usr/lib/systemd/system/kubelet.service root@192.168.201.129:/usr/lib/systemd/system
scp /usr/lib/systemd/system/kubelet.service root@192.168.201.130:/usr/lib/systemd/system

# 将证书拷贝到kubelet节点
scp ca* root@192.168.87.134:/opt/kubernetes/ssl

5.配置docker

# 配置镜像源
vi /etc/docker/daemon.json

{
    "exec-opts": ["native.cgroupdriver=systemd"],
    "registry-mirrors": [
        "https://1nj0zren.mirror.aliyuncs.com",
        "https://kfwkfulq.mirror.aliyuncs.com",
        "https://2lqq34jg.mirror.aliyuncs.com",
        "https://pee6w651.mirror.aliyuncs.com",
        "http://hub-mirror.c.163.com",
        "https://docker.mirrors.ustc.edu.cn",
        "http://f1361db2.m.daocloud.io",
        "https://registry.docker-cn.com"
    ]
}

systemctl restart docker

# 根据结果修改kubelet.json中的cgroupDriver字段
docker info | grep "Cgroup Driver"

# 配置依赖镜像
docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2 k8s.gcr.io/pause:3.2
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2

docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0 k8s.gcr.io/coredns:1.7.0
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0

6.启动kubelet

swapoff -a

systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet
systemctl status kubelet

7.node节点申请证书及处理

kubectl get csr

# 同意node节点申请
kubectl certificate approve node-csr-5HUR2owmeLoopO_z2dFoQuax7ZkHeyEpB4_ZQI9xKg4

kubectl certificate approve node-csr-8hOsOouGK0elW7U9cc9AKF3iHDu0XJDQrqKeg_b6ftw

kubectl certificate approve node-csr-i3f0Zblr-c9Fn--OoRBTxZt_4W6y9CrL-UjKWDqo71k

8.创建kube-proxy csr请求文件

cd ~/cfssl

vi kube-proxy-csr.json

{
  "CN": "system:kube-proxy",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "ChongQing",
      "L": "ChongQing",
      "O": "k8s",
      "OU": "system"
    }
  ]
}

cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem -ca-key=/opt/kubernetes/ssl/ca-key.pem -config=../ca-config.json -profile=kubernetes ../kube-proxy-csr.json | cfssljson -bare kube-proxy

cp kube-proxy*.pem /opt/kubernetes/ssl

8.创建kube-proxy kubeconfig请求文件

kubectl config set-cluster kubernetes --certificate-authority=/opt/kubernetes/ssl/ca.pem --embed-certs=true --server=https://192.168.201.128:6443 --kubeconfig=kube-proxy.kubeconfig

kubectl config set-credentials kube-proxy --client-certificate=/opt/kubernetes/ssl/kube-proxy.pem --client-key=/opt/kubernetes/ssl/kube-proxy-key.pem --embed-certs=true --kubeconfig=kube-proxy.kubeconfig

kubectl config set-context default --cluster=kubernetes --user=kube-proxy --kubeconfig=kube-proxy.kubeconfig

kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

scp kube-proxy.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg
scp kube-proxy.kubeconfig root@192.168.201.130:/opt/kubernetes/cfg

9.创建kube-proxy yaml配置文件

vi kube-proxy.yaml

apiVersion: kubeproxy.config.k8s.io/v1alpha1
bindAddress: 192.168.201.128
clientConnection:
  kubeconfig: /opt/kubernetes/cfg/kube-proxy.kubeconfig
clusterCIDR: 10.244.0.0/16                           # 此处网段必须与网络组件网段保持一致，否则部署网络组件时会报错
healthzBindAddress: 192.168.201.128:10256
kind: KubeProxyConfiguration
metricsBindAddress: 192.168.201.128:10249
mode: "ipvs"

scp kube-proxy.yaml root@192.168.201.129:/opt/kubernetes/cfg
scp kube-proxy.yaml root@192.168.201.130:/opt/kubernetes/cfg

10.创建kube-proxy启动文件

# 拷贝kube-proxy文件
scp kube-proxy root@192.168.87.134:/opt/kubernetes/bin

# 创建kube-proxy启动文件
vi /usr/lib/systemd/system/kube-proxy.service

[Unit]
Description=Kubernetes Kube-Proxy Server
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]
ExecStart=/opt/kubernetes/bin/kube-proxy \
  --config=/opt/kubernetes/cfg/kube-proxy.yaml \
  --alsologtostderr=true \
  --logtostderr=false \
  --log-dir=/opt/kubernetes/logs \
  --v=2
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

scp /usr/lib/systemd/system/kube-proxy.service root@192.168.201.129:/usr/lib/systemd/system
scp /usr/lib/systemd/system/kube-proxy.service root@192.168.201.130:/usr/lib/systemd/system

systemctl daemon-reload
systemctl enable kube-proxy
systemctl start kube-proxy

11.安装CNI网络插件

mkdir -p /opt/cni/{bin,net.d}
wget https://github.com/containernetworking/plugins/releases/download/v0.8.6/cni-plugins-linux-amd64-v0.8.6.tgz
tar -zxvf cni-plugins-linux-amd64-v0.8.6.tgz -C /opt/cni/bin

cd /opt/cni/net.d
vi 10-flannel.conflist

{
  "name": "cni0",
  "cniVersion": "0.3.1",
  "subnetFile": "/run/flannel/subnet.env",
  "plugins": [
    {
      "type": "flannel",
      "delegate": {
        "hairpinMode": true,
        "isDefaultGateway": true
      }
    },
    {
      "type": "portmap",
      "capabilities": {
        "portMappings": true
      }
    }
  ]
}

scp -r /opt/cni root@192.168.201.129:/opt
scp -r /opt/cni root@192.168.201.130:/opt

11.查看节点状态

kubectl get nodes