3.1 复制二进制文件
tar xf kubernetes-server-linux-amd64.tar.gz
cd /root/kubernetes/server/bin
cp kube-apiserver kube-controller-manager kube-scheduler /app/kubernetes/bin/
3.2 部署kube-apiserver
3.2.1、 创建生成CSR的 JSON 配置文件
vim kubernetes-csr.json
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
### 需要将IP改为自己master的IP,并将注释删除
"192.168.189.139",
"10.1.0.1",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
3.2.2、 生成 kubernetes 证书和私钥
cfssl gencert -ca=/app/kubernetes/ssl/ca.pem \
-ca-key=/app/kubernetes/ssl/ca-key.pem \
-config=/app/kubernetes/ssl/ca-config.json \
-profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
cp kubernetes*.pem /app/kubernetes/ssl/
scp kubernetes*.pem k8s-node-1:/app/kubernetes/ssl/
scp kubernetes*.pem k8s-node-2:/app/kubernetes/ssl/
3.2.3、 创建 kube-apiserver 使用的客户端 token 文件
### 下面这个命令会产生一串字符串
head -c 16 /dev/urandom | od -An -t x | tr -d ' '
#### 创建这个文件
vim /app/kubernetes/ssl/bootstrap-token.csv
### 用生成的字符串替换下面的 “8fa448.... ”这一串数字
8fa4488b7751e2ba9f58555a8cb0cef4,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
3.2.4、 创建基础用户名/密码认证配置
vim /app/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2
3.2.5、 配置kubernetes apiserver 启动服务
vim /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target
[Service]
ExecStart=/app/kubernetes/bin/kube-apiserver \
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
--bind-address=192.168.189.139 \
--insecure-bind-address=127.0.0.1 \
--authorization-mode=Node,RBAC \
--runtime-config=rbac.authorization.k8s.io/v1 \
--kubelet-https=true \
--anonymous-auth=false \
--basic-auth-file=/app/kubernetes/ssl/basic-auth.csv \
--enable-bootstrap-token-auth \
--token-auth-file=/app/kubernetes/ssl/bootstrap-token.csv \
--service-cluster-ip-range=10.1.0.0/16 \
--service-node-port-range=9000-40000 \
--tls-cert-file=/app/kubernetes/ssl/kubernetes.pem \
--tls-private-key-file=/app/kubernetes/ssl/kubernetes-key.pem \
--client-ca-file=/app/kubernetes/ssl/ca.pem \
--service-account-key-file=/app/kubernetes/ssl/ca-key.pem \
--etcd-cafile=/app/kubernetes/ssl/ca.pem \
--etcd-certfile=/app/kubernetes/ssl/kubernetes.pem \
--etcd-keyfile=/app/kubernetes/ssl/kubernetes-key.pem \
--etcd-servers=https://192.168.189.139:2379,https://192.168.189.131:2379,https://192.168.189.132:2379 \
--enable-swagger-ui=true \
--allow-privileged=true \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path=/app/kubernetes/log/api-audit.log \
--event-ttl=1h \
--v=2 \
--logtostderr=false \
--log-dir=/app/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
注意::
--bind-address=192.168.189.139 将其换成自己的master节点IP
--etcd-servers=https: 后面的IP分别换成自己的master和node节点的IP
3.2.6、 启动服务
systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver
3.3 部署controller manager服务
3.3.1、创建kube-controller-manager.service
vim /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/app/kubernetes/bin/kube-controller-manager \
--address=127.0.0.1 \
--master=http://127.0.0.1:8080 \
--allocate-node-cidrs=true \
--service-cluster-ip-range=10.1.0.0/16 \
--cluster-cidr=10.2.0.0/16 \
--cluster-name=kubernetes \
--cluster-signing-cert-file=/app/kubernetes/ssl/ca.pem \
--cluster-signing-key-file=/app/kubernetes/ssl/ca-key.pem \
--service-account-private-key-file=/app/kubernetes/ssl/ca-key.pem \
--root-ca-file=/app/kubernetes/ssl/ca.pem \
--leader-elect=true \
--v=2 \
--logtostderr=false \
--log-dir=/app/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
3.3.2、启动kube-controller-manager
systemctl daemon-reload
systemctl enable kube-controller-manager && systemctl start kube-controller-manager
systemctl status kube-controller-manager
3.4 部署kube-scheduler服务
创建kube-scheduler.service
vim /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/app/kubernetes/bin/kube-scheduler \
--address=127.0.0.1 \
--master=http://127.0.0.1:8080 \
--leader-elect=true \
--v=2 \
--logtostderr=false \
--log-dir=/app/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
启动kube-scheduler.service
systemctl daemon-reload
systemctl enable kube-scheduler && systemctl start kube-scheduler
systemctl status kube-scheduler
3.5 部署kubectl 命令行工具
3.5.1 复制二进制包
cd kubernetes/server/bin/
cp kubectl /app/kubernetes/bin/
3.5.2 创建 admin 证书签名请求
vim admin-csr.json
{
"CN": "admin",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:masters",
"OU": "System"
}
]
}
3.5.3 生成 admin 证书和私钥
cfssl gencert -ca=/app/kubernetes/ssl/ca.pem \
-ca-key=/app/kubernetes/ssl/ca-key.pem \
-config=/app/kubernetes/ssl/ca-config.json \
-profile=kubernetes admin-csr.json | cfssljson -bare admin
# 把生成好的密钥放入到kubernetes下的ssl中
cp admin*.pem /app/kubernetes/ssl/
3.5.4 设置集群参数
将kubectl可执行文件复制到 /usr/local/bin下 文件在解压包中
kubectl config set-cluster kubernetes \
--certificate-authority=/app/kubernetes/ssl/ca.pem \
--embed-certs=true \
--server=https://192.168.189.139:6443
#### 注意将IP换为自己的master节点IP
3.5.5 设置客户端认证参数
kubectl config set-credentials admin \
--client-certificate=/app/kubernetes/ssl/admin.pem \
--embed-certs=true \
--client-key=/app/kubernetes/ssl/admin-key.pem
3.5.6 设置上下文参数
kubectl config set-context kubernetes \
--cluster=kubernetes \
--user=admin
3.5.7 设置默认上下文
kubectl config use-context kubernetes
3.5.8 查看服务是否正常
kubectl get cs
正常则为:
[root@k8s-master bin]# kubectl get cs
NAME STATUS MESSAGE ERROR
scheduler Healthy ok
controller-manager Healthy ok
etcd-0 Healthy {"health":"true"}
etcd-2 Healthy {"health":"true"}
etcd-1 Healthy {"health":"true"}
====================================================
Kubernetes-1.14.2的源码包+kernel-ml-4.18.9.tar.gz 有百度云盘资源,链接:https://pan.baidu.com/s/1NZW2DV64DkybD6QI42lw7Q ; 提取码:t5bv
探讨更多技术,欢迎关注微信公众号:Leorizon
====================================================
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。