本次实验主机说明

kubelet部署在 k8s-5-138 和 k8s-5-139 服务器上


  1. 签发证书 (k8s-5-141) ```bash ~]# cd /opt/certs/kube-cert kube-cert]# vim kubelet-csr.json # 将所有可能的kubelet机器IP添加到hosts中 { “CN”: “k8s-kubelet”, “hosts”: [ “127.0.0.1”, “192.168.5.137”, “192.168.5.138”, “192.168.5.139”, “192.168.5.140”, “192.168.5.141” ], “key”: {
    1.  "algo": "rsa",
    2.  "size": 2048
    }, “names”: [
    1.  {
    2.       "O": "batar",
    3.       "OU": "batar-zhonggu",
    4.       "L": "ShenZhen",
    5.       "ST": "GuangDong",
    6.      "C": "CN"
    7.  }
    ] } kube-cert]# cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../etcd-ca/ca-config.json -profile=server kubelet-csr.json | cfssl-json -bare kubelet 2020/01/06 23:10:56 [INFO] generate received request 2020/01/06 23:10:56 [INFO] received CSR 2020/01/06 23:10:56 [INFO] generating key: rsa-2048 2020/01/06 23:10:56 [INFO] encoded CSR 2020/01/06 23:10:56 [INFO] signed certificate with serial number 61221942784856969738771370531559555767101820379 2020/01/06 23:10:56 [WARNING] This certificate lacks a “hosts” field. This makes it unsuitable for websites. For more information see the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org); specifically, section 10.2.3 (“Information Requirements”). [root@k8s-5-141 kube-cert]# ll kubelet* -l -rw-r—r— 1 root root 1106 Mar 26 09:06 kubelet.csr -rw-r—r— 1 root root 406 Mar 26 09:04 kubelet-csr.json -rw———- 1 root root 1679 Mar 26 09:06 kubelet-key.pem -rw-r—r— 1 root root 1476 Mar 26 09:06 kubelet.pem

下发证书

certs]# scp kubelet.pem kubelet-key.pem k8s-5-138.host.com:/opt/kubernetes/server/bin/certs/ certs]# scp kubelet.pem kubelet-key.pem k8s-5-139.host.com:/opt/kubernetes/server/bin/certs/

  2. 2. 创建kubectl 配置 (在 k8s-5-138上操作, 然后把配置文件同步到 k8s-5-139服务器)<br />
  4. set-cluster  # 创建需要连接的集群信息，可以创建多个k8s集群信息
  5. ```bash
  6.  ~]# kubectl config set-cluster myk8s \
  7. --certificate-authority=/opt/kubernetes/server/bin/certs/ca.pem \
  8. --embed-certs=true \
  9. --server=https://192.168.5.137:7443 \
  10. --kubeconfig=/opt/kubernetes/conf/kubelet.kubeconfig

set-credentials # 创建用户账号，即用户登陆使用的客户端私有和证书，可以创建多个证书

  1. ~]# kubectl config set-credentials k8s-node \
  2. --client-certificate=/opt/kubernetes/server/bin/certs/client.pem \
  3. --client-key=/opt/kubernetes/server/bin/certs/client-key.pem \
  4. --embed-certs=true \
  5. --kubeconfig=/opt/kubernetes/conf/kubelet.kubeconfig

set-context # 设置context，即确定账号和集群对应关系

  1.  ~]# kubectl config set-context myk8s-context \
  2. --cluster=myk8s \
  3. --user=k8s-node \
  4. --kubeconfig=/opt/kubernetes/conf/kubelet.kubeconfig

use-context # 设置当前使用哪个context

  1. ~]# kubectl config use-context myk8s-context --kubeconfig=/opt/kubernetes/conf/kubelet.kubeconfig

将配置文件发送到 k8s-5-139服务器,就不用做以上四步.

  1. scp /opt/kubernetes/conf/kubelet.kubeconfig k8s-5-139.host.com:/opt/kubernetes/conf/

授权k8s-node用户

此步骤只需要在一台master节点执行 授权 k8s-node 用户绑定集群角色 system:node ，让 k8s-node 成为具备运算节点的权限。

  1.  ~]# vim k8s-node.yaml
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. kind: ClusterRoleBinding
  4. metadata:
  5.   name: k8s-node
  6. roleRef:
  7.   apiGroup: rbac.authorization.k8s.io
  8.   kind: ClusterRole
  9.   name: system:node
  10. subjects:
  11. - apiGroup: rbac.authorization.k8s.io
  12.   kind: User
  13.   name: k8s-node
  14.  ~]# kubectl create -f k8s-node.yaml 
  15. clusterrolebinding.rbac.authorization.k8s.io/k8s-node created
  16.  ~]# kubectl get clusterrolebinding k8s-node
  17. NAME       AGE
  18. k8s-node   36s

装备pause镜像

将pause镜像放入到harbor私有仓库中，仅在 hdss7-200 操作：

  1.  ~]# docker image pull kubernetes/pause
  3.  ~]# docker image tag kubernetes/pause:latest harbor.od.com/public/pause:latest
  5.  ~]# docker login -u admin harbor.od.com
  7.  ~]# docker image push harbor.od.com/public/pause:latest

创建启动脚本

在node节点创建脚本并启动kubelet，涉及服务器：k8s-5-138 k8s-5-139

  1.  ~]# vim /etc/systemd/system/kubeletd.service
  5. [Unit]
  6. Description=kubelet node
  7. Documentation=https://github.com/kubernetes
  8. Conflicts=kubeletd
  10. [Service]
  11. Type=notify
  12. Restart=always
  13. RestartSec=5s
  14. LimitNOFILE=40000
  15. TimeoutStartSec=0
  17. ExecStart=/opt/kubernetes/server/bin/kubelet \
  18.     --anonymous-auth=false \
  19.     --cgroup-driver systemd \
  20.     --cluster-dns 192.168.0.2 \
  21.     --cluster-domain cluster.local \
  22.     --runtime-cgroups=/systemd/system.slice \
  23.     --kubelet-cgroups=/systemd/system.slice \
  24.     --fail-swap-on=false \
  25.     --client-ca-file /opt/kubernetes/server/bin/certs/ca.pem \
  26.     --tls-cert-file /opt/kubernetes/server/bin/certs/kubelet.pem \
  27.     --tls-private-key-file /opt/kubernetes/server/bin/certs/kubelet-key.pem \
  28.     --hostname-override k8s-5-138.host.com \
  29.     --image-gc-high-threshold 20 \
  30.     --image-gc-low-threshold 10 \
  31.     --kubeconfig /opt/kubernetes/conf/kubelet.kubeconfig \
  32.     --log-dir /data/logs/kubernetes/kube-kubelet \
  33.     --pod-infra-container-image harbor.od.com/public/pause:latest \
  34.     --root-dir /data/kubelet
  36. [Install]
  37. WantedBy=multi-user.target
  39. # 创建需要用到的目录
  40. ~]# mkdir /data/logs/kubernetes/kube-kubelet
  41. ~]# mkdir /data/kubelet
  43. # 添加服务并设置自动启动
  44. ~]# systemctl daemon-reload
  45. ~]# systemctl cat kubeletd
  46. ~]# systemctl enable kubeletd
  47. ~]# systemctl start kubeletd
  49. # 查看是否已启动
  50. [root@k8s-5-139 /]# netstat -unltp |grep kubelet
  51. tcp        0      0 127.0.0.1:10248         0.0.0.0:*               LISTEN      23733/kubelet       
  52. tcp        0      0 127.0.0.1:44044         0.0.0.0:*               LISTEN      23733/kubelet       
  53. tcp6       0      0 :::10250                :::*                    LISTEN      23733/kubelet       
  54. tcp6       0      0 :::10255                :::*                    LISTEN      23733/kubelet 
  56. # 查看当前的运算节点
  57. [root@k8s-5-139 /]# kubectl get nodes
  58. NAME                 STATUS   ROLES    AGE     VERSION
  59. k8s-5-138.host.com   Ready    <none>   6m46s   v1.18.8
  60. k8s-5-139.host.com   Ready    <none>   3m46s   v1.18.8

修改节点角色(在任意一台安装了apiserver的服务器上执行都行)

  1. # 当前的各个节点是没有role信息的
  2. [root@k8s-5-139 ~]# kubectl get nodes
  3. NAME                 STATUS   ROLES    AGE   VERSION
  4. k8s-5-138.host.com   Ready    <none>   63m   v1.18.8
  5. k8s-5-139.host.com   Ready    <none>   60m   v1.18.8
  7. # 设置k8s-5-138服务器node的role label
  8. [root@k8s-5-139 ~]# kubectl label node k8s-5-138.host.com node-role.kubernetes.io/node=
  9. node/k8s-5-138.host.com labeled
  10. [root@k8s-5-139 ~]# kubectl label node k8s-5-138.host.com node-role.kubernetes.io/master=
  11. node/k8s-5-138.host.com labeled
  13. # 设置k8s-5-139服务器node的role label
  14. [root@k8s-5-139 ~]# kubectl label node k8s-5-139.host.com node-role.kubernetes.io/node=
  15. node/k8s-5-139.host.com labeled
  16. [root@k8s-5-139 ~]# kubectl label node k8s-5-139.host.com node-role.kubernetes.io/master=
  17. node/k8s-5-139.host.com labeled
  19. # 修改完成之后再次查看节点信息即可看到role label
  20. [root@k8s-5-139 ~]# kubectl get nodes
  21. NAME                 STATUS   ROLES         AGE   VERSION
  22. k8s-5-138.host.com   Ready    master,node   74m   v1.18.8
  23. k8s-5-139.host.com   Ready    master,node   71m   v1.18.8