kubernetes實踐之三十四: Master節點安裝與配置
一:簡介
1.kubernetes master節點包含以下元件:kube-apiserver,kube-scheduler和kube-controller-manager。 這三個元件需要部署在同一臺機器上。 同時只能有一個kube-scheduler,kube-controller-manager程式處於工作狀態,如果執行多個,則需要透過選舉產生一個leader.
2.在/etc/kubernetes/ssl目錄下,準備好可能用到的證書檔案。
admin-key.pem admin.pem ca-key.pem ca.pem kube-proxy-key.pem,kube-proxy.pem kubernetes-key.pem kubernetes.pem
3.下載安裝檔案 wget
tar -xzvf kubernetes-server-linux-amd64.tar.gz
cd kubernetes
tar -xzvf kubernetes-src.tar.gz
複製二進位制檔案到指定目錄
cp -r server/bin/{kube-apiserver,kube-controller-manager,kube-scheduler,kubectl,kube-proxy,kubelet} /usrbin/
二:配置和啟動 kube-apiserver
1.service配置檔案 /usr/lib/systemd/system/kube-apiserver.service
2.配置檔案/etc/kubernetes/config
該配置檔案同時被kube-apiserver、kube-controller-manager、kubescheduler、kubelet、kube-proxy使用。
3.配置檔案 /etc/kubernetes/apiserver
a. --authorization-mode=RBAC 指定在安全埠使用 RBAC 授權模式,拒絕未透過授權的請求;
b. kube-scheduler、kube-controller-manager 一般和 kube-apiserver 部署在同一臺機器上,它們使非安全埠和 kube-apiserver通訊;
kubelet、kube-proxy、kubectl 部署在其它 Node 節點上,如果透過安全端?訪問 kube-apiserver,則必須先透過 TLS 證書認證,再透過
RBAC 授權;
c. kube-proxy、kubectl 透過在使?的證書?指定相關的 User、Group來達到透過 RBAC 授權的?的;
d. 如果使用了 kubelet TLS Boostrap 機制,則不能再指定 --kubeletcertificate-authority 、 --kubelet-client-certificate 和 --kubelet-client-key 選項,否則後續 kube-apiserver 校驗 kubelet 證
書時出現 ”x509: certificate signed by unknown authority“ 錯誤;
e. --admission-control 值必須包含 ServiceAccount ;
f. --bind-address 不能為 127.0.0.1 ;
g. runtime-config 配置為 rbac.authorization.k8s.io/v1beta1 ,表示執行時的apiVersion;
h. --service-cluster-ip-range 指定 Service Cluster IP 地址段,該地址段不能路由可達;
i. 預設情況下 kubernetes 物件儲存在 etcd /registry 路徑下,可以透過 --etcd-prefix 引數進行調整;
4.啟動kube-apiserver
systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver
三:配置和啟動 kube-controller-manager
1. 服務檔案/usr/lib/systemd/system/kube-controller-manager.service
2.配置檔案 /etc/kubernetes/controller-manager
a. --service-cluster-ip-range 引數指定 Cluster 中 Service 的CIDR範圍,該?絡在各 Node 間必須路由不可達,必須和 kube-apiserver中的引數一致;
b. --cluster-signing-* 指定的證書和私鑰檔案用來簽名為 TLSBootStrap 建立的證書和私鑰;
c. --root-ca-file 用來對 kube-apiserver 證書進行校驗,指定該引數後,才會在Pod 容器的 ServiceAccount 中放置該 CA 證書檔案;
d. --address 值必須為 127.0.0.1 ,因為當前 kube-apiserver 期望scheduler 和 controller-manager 在同一臺機器
3.啟動 kube-controller-manager
systemctl daemon-reload
systemctl enable kube-controller-manager
systemctl start kube-controller-manager
四:配置和啟動 kube-scheduler
1. 服務檔案/usr/lib/systemd/system/kube-scheduler.service
2. 配置檔案/etc/kubernetes/scheduler
3.啟動 kube-scheduler
systemctl daemon-reload
systemctl enable kube-scheduler
systemctl start kube-scheduler
五:驗證 master 節點功能
1.kubernetes master節點包含以下元件:kube-apiserver,kube-scheduler和kube-controller-manager。 這三個元件需要部署在同一臺機器上。 同時只能有一個kube-scheduler,kube-controller-manager程式處於工作狀態,如果執行多個,則需要透過選舉產生一個leader.
2.在/etc/kubernetes/ssl目錄下,準備好可能用到的證書檔案。
admin-key.pem admin.pem ca-key.pem ca.pem kube-proxy-key.pem,kube-proxy.pem kubernetes-key.pem kubernetes.pem
3.下載安裝檔案 wget
tar -xzvf kubernetes-server-linux-amd64.tar.gz
cd kubernetes
tar -xzvf kubernetes-src.tar.gz
複製二進位制檔案到指定目錄
cp -r server/bin/{kube-apiserver,kube-controller-manager,kube-scheduler,kubectl,kube-proxy,kubelet} /usrbin/
二:配置和啟動 kube-apiserver
1.service配置檔案 /usr/lib/systemd/system/kube-apiserver.service
點選(此處)摺疊或開啟
-
[Unit]
-
Description=Kubernetes API Service
-
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
-
After=network.target
-
After=etcd.service
-
-
[Service]
-
EnvironmentFile=-/etc/kubernetes/config
-
EnvironmentFile=-/etc/kubernetes/apiserver
-
ExecStart=/usr/bin/kube-apiserver \
-
$KUBE_LOGTOSTDERR \
-
$KUBE_LOG_LEVEL \
-
$KUBE_ETCD_SERVERS \
-
$KUBE_API_ADDRESS \
-
$KUBE_API_PORT \
-
$KUBELET_PORT \
-
$KUBE_ALLOW_PRIV \
-
$KUBE_SERVICE_ADDRESSES \
-
$KUBE_ADMISSION_CONTROL \
-
$KUBE_API_ARGS
-
Restart=on-failure
-
Type=notify
-
LimitNOFILE=65536
-
-
[Install]
- WantedBy=multi-user.target
點選(此處)摺疊或開啟
-
###
-
# kubernetes system config
-
#
-
# The following values are used to configure various aspects of all
-
# kubernetes services, including
-
#
-
# kube-apiserver.service
-
# kube-controller-manager.service
-
# kube-scheduler.service
-
# kubelet.service
-
# kube-proxy.service
-
-
# logging to stderr means we get it in the systemd journal
-
KUBE_LOGTOSTDERR="--logtostderr=true"
-
-
# journal message level, 0 is debug
-
KUBE_LOG_LEVEL="--v=0"
-
-
# Should this cluster be allowed to run privileged docker containers
-
KUBE_ALLOW_PRIV="--allow-privileged=true"
-
-
# How the controller-manager, scheduler, and proxy find the apiserver
- KUBE_MASTER="--master="
3.配置檔案 /etc/kubernetes/apiserver
點選(此處)摺疊或開啟
-
###
-
## kubernetes system config
-
##
-
## The following values are used to configure the kube-apiserver
-
##
-
#
-
## The address on the local server to listen to.
-
KUBE_API_ADDRESS="--advertise-address=10.116.137.196 --bind-address=10.116.137.196 --insecure-bind-address=10.116.137.196"
-
#
-
## The port on the local server to listen on.
-
#KUBE_API_PORT="--port=8080"
-
#
-
## Port minions listen on
-
#KUBELET_PORT="--kubelet-port=10250"
-
#
-
## Comma separated list of nodes in the etcd cluster
-
KUBE_ETCD_SERVERS="--etcd-servers="
-
#
-
## Address range to use for services
-
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
-
#
-
## default admission control policies
-
KUBE_ADMISSION_CONTROL="--admission-control=ServiceAccount,NamespaceLifecycle,NamespaceExists,LimitRanger,ResourceQuota"
-
#
-
## Add your own!
- KUBE_API_ARGS="--authorization-mode=RBAC --runtime-config=rbac.authorization.k8s.io/v1beta1 --kubelet-https=true --experimental-bootstrap-token-auth --token-auth-file=/etc/kubernetes/token.csv --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kubernetes.pem --tls-private-key-file=/etc/kubernetes/ssl/kubernetes-key.pem --client-ca-file=/etc/kubernetes/ssl/ca.pem --service-account-key-file=/etc/kubernetes/ssl/ca-key.pem --etcd-cafile=/etc/kubernetes/ssl/ca.pem --etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem --etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem --enable-swagger-ui=true --apiserver-count=1 --audit-log-maxage=30 --audit-log-maxbackup=3 --audit-log-maxsize=100 --audit-log-path=/var/lib/audit.log --event-ttl=1h"
b. kube-scheduler、kube-controller-manager 一般和 kube-apiserver 部署在同一臺機器上,它們使非安全埠和 kube-apiserver通訊;
kubelet、kube-proxy、kubectl 部署在其它 Node 節點上,如果透過安全端?訪問 kube-apiserver,則必須先透過 TLS 證書認證,再透過
RBAC 授權;
c. kube-proxy、kubectl 透過在使?的證書?指定相關的 User、Group來達到透過 RBAC 授權的?的;
d. 如果使用了 kubelet TLS Boostrap 機制,則不能再指定 --kubeletcertificate-authority 、 --kubelet-client-certificate 和 --kubelet-client-key 選項,否則後續 kube-apiserver 校驗 kubelet 證
書時出現 ”x509: certificate signed by unknown authority“ 錯誤;
e. --admission-control 值必須包含 ServiceAccount ;
f. --bind-address 不能為 127.0.0.1 ;
g. runtime-config 配置為 rbac.authorization.k8s.io/v1beta1 ,表示執行時的apiVersion;
h. --service-cluster-ip-range 指定 Service Cluster IP 地址段,該地址段不能路由可達;
i. 預設情況下 kubernetes 物件儲存在 etcd /registry 路徑下,可以透過 --etcd-prefix 引數進行調整;
4.啟動kube-apiserver
systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver
三:配置和啟動 kube-controller-manager
1. 服務檔案/usr/lib/systemd/system/kube-controller-manager.service
點選(此處)摺疊或開啟
-
[Unit]
-
Description=Kubernetes Controller Manager
-
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
-
-
[Service]
-
EnvironmentFile=-/etc/kubernetes/config
-
EnvironmentFile=-/etc/kubernetes/controller-manager
-
ExecStart=/usr/bin/kube-controller-manager \
-
$KUBE_LOGTOSTDERR \
-
$KUBE_LOG_LEVEL \
-
$KUBE_MASTER \
-
$KUBE_CONTROLLER_MANAGER_ARGS
-
Restart=on-failure
-
LimitNOFILE=65536
-
[Install]
- WantedBy=multi-user.target
點選(此處)摺疊或開啟
-
###
-
# The following values are used to configure the kubernetes controller-manager
-
# defaults from config and apiserver should be adequate
-
# Add your own!
- KUBE_CONTROLLER_MANAGER_ARGS="--address=127.0.0.1 --service-cluster-ip-range=10.254.0.0/16 --cluster-name=kubernetes --cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem --cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem --service-account-private-key-file=/etc/kubernetes/ssl/ca-key.pem --root-ca-file=/etc/kubernetes/ssl/ca.pem --leader-elect=true"
b. --cluster-signing-* 指定的證書和私鑰檔案用來簽名為 TLSBootStrap 建立的證書和私鑰;
c. --root-ca-file 用來對 kube-apiserver 證書進行校驗,指定該引數後,才會在Pod 容器的 ServiceAccount 中放置該 CA 證書檔案;
d. --address 值必須為 127.0.0.1 ,因為當前 kube-apiserver 期望scheduler 和 controller-manager 在同一臺機器
3.啟動 kube-controller-manager
systemctl daemon-reload
systemctl enable kube-controller-manager
systemctl start kube-controller-manager
四:配置和啟動 kube-scheduler
1. 服務檔案/usr/lib/systemd/system/kube-scheduler.service
點選(此處)摺疊或開啟
-
[Unit]
-
Description=Kubernetes Scheduler Plugin
-
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
-
-
[Service]
-
EnvironmentFile=-/etc/kubernetes/config
-
EnvironmentFile=-/etc/kubernetes/scheduler
-
ExecStart=/usr/bin/kube-scheduler \
-
$KUBE_LOGTOSTDERR \
-
$KUBE_LOG_LEVEL \
-
$KUBE_MASTER \
-
$KUBE_SCHEDULER_ARGS
-
Restart=on-failure
-
LimitNOFILE=65536
-
-
[Install]
- WantedBy=multi-user.target
點選(此處)摺疊或開啟
-
###
-
# kubernetes scheduler config
-
# default config should be adequate
-
# Add your own!
- KUBE_SCHEDULER_ARGS="--leader-elect=true --address=127.0.0.1"
systemctl daemon-reload
systemctl enable kube-scheduler
systemctl start kube-scheduler
五:驗證 master 節點功能
來自 “ ITPUB部落格 ” ,連結:http://blog.itpub.net/28624388/viewspace-2154257/,如需轉載,請註明出處,否則將追究法律責任。
相關文章
- 二、安裝並配置Kubernetes Master節點AST
- kubernetes實踐之五:Node節點安裝
- 三、安裝並配置Kubernetes Node節點
- Kubernetes安裝之八:配置master之schedulerAST
- Kubernetes安裝之九:配置node節點之kubelet
- kubernetes實踐之十四:Service Account與Secret
- Kubernetes安裝之三:etcd叢集的配置
- Kubernetes安裝之六:配置master之api-serverASTAPIServer
- Kubernetes安裝之十:配置node節點之kube-proxy
- kubernetes實踐之三十一:kubectl
- kubernetes實踐之三十五:Pod配置管理ConfigMap
- Kubernetes安裝之七:配置master之controller-managerASTController
- kubernetes實踐之三:ETCD TLS證書叢集安裝TLS
- kubernetes實踐之六十四:CoreDNSDNS
- kubernetes實踐之二十四:Service
- [實踐]wireguard安裝和配置
- kubernetes實踐之三十: SonarQube和SonarQube Runner
- kubernetes實踐之三十八:Pod排程
- kubernetes實踐之三十三:基本概念
- 【PY】Jupyter Notebook 安裝與配置 實踐教程
- GitOps實踐之kubernetes安裝argocdGitGo
- kubernetes實踐之三十七:Pod健康檢查
- kubernetes實踐之五十四:垃圾回收機制
- CoreOS實踐(2)—在coreos上安裝Kubernetes
- kubernetes實踐之三十二:Jenkins和SonarQube整合Jenkins
- Windows 11.2.0.4 RAC安裝配置以及RAC新增節點Windows
- Oceanbase 4.0 三節點叢集x86平臺安裝實踐
- kubernetes實踐之四十四:Ingress詳解
- 本地windows搭建spark環境,安裝與詳細配置(jdk安裝與配置,scala安裝與配置,hadoop安裝與配置,spark安裝與配置)WindowsSparkJDKHadoop
- 多節點ipfs安裝
- greenplum單節點安裝
- 2節點RAC安裝
- MySQ 資料庫主從同步安裝與配置詳解(Master/Slave)資料庫主從同步AST
- kubernetes安裝配置使用vGPUGPU
- 【K8S】基於單Master節點安裝K8S叢集K8SAST
- Kubernetes – 節點
- windows下安裝Jenkins以及配置分散式agent節點WindowsJenkins分散式
- kubernetes實踐之四:Flannel網路外掛安裝