Kubernetes安裝之七：配置master之controller-manager

dessler發表於2019-02-14
ASTController

都是3個master伺服器都需要操作的

1.生成證書

cat > /etc/ssl/kube-controller-manager/kube-controller-manager-csr.json <<EOF{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
      "127.0.0.1",
      "192.168.1.40",
      "192.168.1.41",
      "192.168.1.42" 
    ],
    "names": [
      {
        "C": "CN",
        "ST": "ChengDu",
        "L": "ChengDu",
        "O": "system:kube-controller-manager",
        "OU": "dessler"
      }
    ]
}
EOF複製程式碼

cfssl gencert -ca=/etc/ssl/ca.pem \
  -ca-key=/etc/ssl/ca-key.pem \
  -config=/etc/ssl/ca-config.json \
  -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager複製程式碼

2.建立kubeconfig 檔案

kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/ssl/ca.pem \
  --embed-certs=true \
  --server=https://192.168.1.43:8443 \
  --kubeconfig=kube-controller-manager.kubeconfig
Cluster "kubernetes" set.

複製程式碼

kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=/etc/ssl/kube-controller-manager/kube-controller-manager.pem \
  --client-key=/etc/ssl/kube-controller-manager/kube-controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-controller-manager.kubeconfig
User "system:kube-controller-manager" set.
複製程式碼

 kubectl config set-context system:kube-controller-manager \
   --cluster=kubernetes \
   --user=system:kube-controller-manager \
   --kubeconfig=kube-controller-manager.kubeconfig
Context "system:kube-controller-manager" created.
複製程式碼

kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig
Switched to context "system:kube-controller-manager".
複製程式碼

3.分發配置檔案證書二進位制檔案

#分發路徑,為了後面的服務呼叫
/opt/kubernetes/cfg/複製程式碼

4.配置kube-controller-manager服務

cat > /usr/lib/systemd/system/kube-controller-manager.service <<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-controller-manager \\
  --port=0 \\
  --secure-port=10252 \\
  --bind-address=127.0.0.1 \\
  --kubeconfig=/opt/kubernetes/cfg/kube-controller-manager.kubeconfig \\
  --service-cluster-ip-range=10.254.0.0/16 \\
  --cluster-name=kubernetes \\
  --cluster-signing-cert-file=/etc/ssl/ca.pem \\
  --cluster-signing-key-file=/etc/ssl/ca-key.pem \\
  --experimental-cluster-signing-duration=8760h \\
  --root-ca-file=/etc/ssl/ca.pem \\
  --service-account-private-key-file=/etc/ssl/ca-key.pem \\
  --leader-elect=true \\
  --feature-gates=RotateKubeletServerCertificate=true \\
  --controllers=*,bootstrapsigner,tokencleaner \\
  --horizontal-pod-autoscaler-use-rest-clients=true \\
  --horizontal-pod-autoscaler-sync-period=10s \\
  --tls-cert-file=/etc/ssl/kube-controller-manager/kube-controller-manager.pem \\
  --tls-private-key-file=/etc/ssl/kube-controller-manager/kube-controller-manager-key.pem \\
  --use-service-account-credentials=true \\
  --alsologtostderr=true \\
  --logtostderr=false \\
  --log-dir=/var/log/kubernetes \\
  --v=2
Restart=on
Restart=on-failure
RestartSec=5
#User=k8s

[Install]
WantedBy=multi-user.target
EOF
複製程式碼

  • 說明：
  • --port=0：關閉監聽 http /metrics 的請求，同時--address 引數無效，--bind-address 引數有效；
  • --secure-port=10252、--bind-address=0.0.0.0: 在所有網路介面監聽 10252 埠的 https /metrics 請求
  • --kubeconfig：指定 kubeconfig 檔案路徑，kube-controller-manager 使用它連線和驗證 kube-apiserver
  • --cluster-signing-*-file：簽名 TLS Bootstrap 建立的證書
  • --experimental-cluster-signing-duration：指定 TLS Bootstrap 證書的有效期
  • --root-ca-file：放置到容器 ServiceAccount 中的 CA 證書，用來對 kube-apiserver 的證書進行校驗
  • --service-account-private-key-file：簽名 ServiceAccount 中 Token 的私鑰檔案，必須和 kube-apiserver 的--service-account-key-file 指定的公鑰檔案配對使用
  • --service-cluster-ip-range ：指定 Service Cluster IP 網段，必須和 kube-apiserver 中的同名引數一致
  • --leader-elect=true：叢集執行模式，啟用選舉功能；被選為 leader 的節點負責處理工作，其它節點為阻塞狀態
  • --feature-gates=RotateKubeletServerCertificate=true：開啟 kublet server 證書的自動更新特性
  • --controllers=*,bootstrapsigner,tokencleaner：啟用的控制器列表，tokencleaner 用於自動清理過期的 Bootstrap token
  • --horizontal-pod-autoscaler-*：custom metrics 相關引數，支援 autoscaling/v2alpha1
  • --tls-cert-file、--tls-private-key-file：使用 https 輸出 metrics 時使用的 Server 證書和祕鑰
  • --use-service-account-credentials=true:
  • User=k8s：使用 k8s 賬戶執行
  • kube-controller-manager 不對請求 https metrics 的 Client 證書進行校驗，故不需要指定--tls-ca-file 引數，而且該引數已被淘汰

5.啟動服務

ystemctl daemon-reload
systemctl enable kube-controller-manager
systemctl restart kube-controller-manager
systemctl status kube-controller-manager
複製程式碼

6.檢查服務狀態

 kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"host40_ad80b214-301e-11e9-9e4e-525400a2fd4d","leaseDurationSeconds":15,"acquireTime":"2019-02-14T06:06:32Z","renewTime":"2019-02-14T06:10:11Z","leaderTransitions":0}'
  creationTimestamp: "2019-02-14T06:06:32Z"
  name: kube-controller-manager
  namespace: kube-system
  resourceVersion: "931"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-controller-manager
  uid: ad841617-301e-11e9-9b82-5254006b7ed6

複製程式碼

curl -s --cacert /etc/ssl/ca.pem https://127.0.0.1:10252/metrics
複製程式碼


相關文章