kubernetes（k8s）单节点部署

一、master节点部署

[root@master1 ~]# cd k8s/
[root@master1 ~/k8s]# mkdir k8s-cert
[root@master1 ~/k8s]# cd k8s-cert/
[root@master1 ~/k8s/k8s-cert]# vim k8s-cert.sh

cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
      	    "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

#-----------------------

cat > server-csr.json <<EOF
{
    "CN": "kubernetes",
    "hosts": [
      "10.0.0.1",
      "127.0.0.1",
      "192.168.153.10",           #master1IP
      "192.168.153.20",           #master2IP
      "192.168.153.188",          #虚拟IP，nginx主机做keepalived使用
      "192.168.153.50",           #nginx1IP
      "192.168.153.60",           #nginx2IP
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

#-----------------------

cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

#-----------------------

cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

[root@master1 ~/k8s/k8s-cert]# bash k8s-cert.sh

[root@master1 ~/k8s/k8s-cert]# ls *.pem

[root@master1 ~/k8s/k8s-cert]# cp ca*pem server*pem /opt/kubernetes/ssl/
[root@master1 ~/k8s/k8s-cert]# cd ..
#拉入软件包kubernetes-server-linux-amd64.tar.gz
[root@master1 ~/k8s]# tar zxvf kubernetes-server-linux-amd64.tar.gz
[root@master1 ~/k8s]# chmod +x controller-manager.sh
[root@master1 ~/k8s]# cd kubernetes/server/bin/
[root@master1 ~/k8s/kubernetes/server/bin]# cp kube-apiserver kubectl kube-controller-manager kube-scheduler /opt/kubernetes/bin/
[root@master1 ~/k8s/kubernetes/server/bin]# cd ~/k8s/
[root@master1 ~/k8s]<