一：前言
1.Kubernetes版本1.8.5；node ip 10.116.82.28; 對於kuberentes1.8叢集，必須關閉swap，否則kubelet啟動將失敗；修改 /etc/fstab 將，swap系統註釋掉。
2.kubelet 啟動時向 kube-apiserver 傳送 TLS bootstrapping 請求，需要先將 bootstrap token ?件中的 kubelet-bootstrap ?戶賦予 system:nodebootstrappercluster ??(role)，然後 kubelet 才能有許可權建立認證請求(certificate signing requests)：

在master節點執行：

點選(此處)摺疊或開啟

cd /etc/kubernetes
kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

3. 1.8版本之前.開啟rbac後,apiserver預設繫結system:nodes組到system:node的clusterrole。v1.8之後,此繫結預設不存在,需要手工繫結,否則kubelet啟動後會報認證錯誤，使用kubectl get nodes檢視無法成為Ready狀態

點選(此處)摺疊或開啟

kubectl create clusterrolebinding kubelet-node-clusterbinding --clusterrole=system:node --user=system:node:10.116.82.28
kubectl describe clusterrolebindings kubelet-node-clusterbinding

多個node節點的話：
kubectl create clusterrolebinding kubelet-node-clusterbinding --clusterrole=system:node --group=system:nodes
二：安裝Kubelet

service檔案：/usr/lib/systemd/system/kubelet.service. 負責master節點中的config檔案到/etc/kubernetes/config

點選(此處)摺疊或開啟

[Unit]
Description=Kubernetes Kubelet Server
Documentation=http://kubernetes.io/docs/admin/kubelet/
After=docker.service
Requires=docker.service
[Service]
WorkingDirectory=/var/lib/kubelet
EnvironmentFile=-/etc/kubernetes/config
EnvironmentFile=-/etc/kubernetes/kubelet
ExecStart=/usr/bin/kubelet \
$KUBE_LOGTOSTDERR \
$KUBE_LOG_LEVEL \
$KUBELET_API_SERVER \
$KUBELET_ADDRESS \
$KUBELET_PORT \
$KUBELET_HOSTNAME \
$KUBE_ALLOW_PRIV \
$KUBELET_POD_INFRA_CONTAINER \
$KUBELET_ARGS
Restart=on-failure
[Install]
WantedBy=multi-user.target

kubelet配置檔案

點選(此處)摺疊或開啟

## kubelet (minion) config
#
## The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces)
KUBELET_ADDRESS="--address=10.116.82.28"
#
## The port for the info server to serve on
#KUBELET_PORT="--port=10250"
#
## You may leave this blank to use the actual hostname
KUBELET_HOSTNAME="--hostname-override=10.116.82.28"
#
## location of the api-server
#KUBELET_API_SERVER="--api-servers="
#
## pod infrastructure container
#KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=sz-pg-oam-docker-hub-001.tendcloud.com/library/pod-infrastructure:rhel7"
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure"
#
## Add your own!
KUBELET_ARGS="--cgroup-driver=systemd --cluster-dns=10.254.0.2 --experimental-bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig --kubeconfig=/etc/kubernetes/kubelet.kubeconfig --require-kubeconfig --cert-dir=/etc/kubernetes/ssl --cluster-domain=cluster.local. --hairpin-mode promiscuous-bridge --serialize-image-pulls=false --runtime-cgroups=/systemd/system.slice --kubelet-cgroups=/systemd/system.slice"

啟動kubelet
systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet
systemctl status kubelet

透過 kublet 的 TLS 證書請求
kubelet ?次啟動時向 kube-apiserver 傳送證書籤名請求，必須透過後kubernetes 系統才會將該 Node 加?到叢集。檢視未授權的 CSR 請求.

透過 CSR 請求

kubectl certificate approve node-csr-nRoS_Xp89eNuqMmIQyE1SgllqjieGyYo5uMPtmhkfJ4

三：安裝Kube-proxy

1.yum install conntrack-tools

2.service檔案 vi /usr/lib/systemd/system/kube-proxy.service

點選(此處)摺疊或開啟

[Unit]
Description=Kubernetes Kube-Proxy Server
Documentation=http://kubernetes.io/docs/admin/kube-proxy/
After=network.target
[Service]
EnvironmentFile=-/etc/kubernetes/config
EnvironmentFile=-/etc/kubernetes/proxy
ExecStart=/usr/bin/kube-proxy \
$KUBE_LOGTOSTDERR \
$KUBE_LOG_LEVEL \
$KUBE_MASTER \
$KUBE_PROXY_ARGS
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target

3.配置檔案 vi /etc/kubernetes/proxy

點選(此處)摺疊或開啟

KUBE_PROXY_ARGS="--bind-address=10.116.82.28 --hostname-override=10.116.82.28 --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig --cluster-cidr=10.254.0.0/16"

4.啟動

systemctl daemon-reload
systemctl enable kube-proxy
systemctl start kube-proxy
systemctl status kube-proxy

kubernetes實踐之五：Node節點安裝

相關文章