kubelet組件部署

目錄

• 前言
• 創建 kubelet bootstrap kubeconfig 文件
• 查看kubeadm為各個節點創建的token
• 查看各 token 關聯的 Secret
• 創建和分發kubelet參數配置
• 創建和分發kubelet啟動文件
• 創建user和group的CSR權限，不創建kubelet會啟動失敗
• 啟動 kubelet 服務
• 查看kubelet
• 手動approve server cert csr

前言

kubelet運行在每個worker節點上，接收kube-apiserver發送的請求，管理Pod容器，執行交互命令

kubelet啟動時自動向kube-apiserver注冊節點信息，內置的cAdivsor統計和監控節點的資源使用資源情況。為確保安全，部署時關閉了kubelet的非安全http端口，對請求進行認證和授權，拒絕未授權的訪問

創建 kubelet bootstrap kubeconfig 文件

cd /opt/k8s/work
source /opt/k8s/bin/environment.sh
for node_name in ${NODE_NAMES[@]}
  do
    echo ">>> ${node_name}"
    # 創建 token
    export BOOTSTRAP_TOKEN=$(kubeadm token create \
      --description kubelet-bootstrap-token \
      --groups system:bootstrappers:${node_name} \
      --kubeconfig ~/.kube/config)
    # 設置集群參數
    kubectl config set-cluster kubernetes \
      --certificate-authority=/etc/kubernetes/cert/ca.pem \
      --embed-certs=true \
      --server=${KUBE_APISERVER} \
      --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
    # 設置客戶端認證參數
    kubectl config set-credentials kubelet-bootstrap \
      --token=${BOOTSTRAP_TOKEN} \
      --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
    # 設置上下文參數
    kubectl config set-context default \
      --cluster=kubernetes \
      --user=kubelet-bootstrap \
      --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
    # 設置默認上下文
    kubectl config use-context default --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  done

分發 bootstrap kubeconfig 文件到所有 worker 節點

cd /opt/k8s/work
source /opt/k8s/bin/environment.sh
for node_name in ${NODE_NAMES[@]}
  do
    echo ">>> ${node_name}"
    scp kubelet-bootstrap-${node_name}.kubeconfig root@${node_name}:/etc/kubernetes/kubelet-bootstrap.kubeconfig
  done

• 向kubeconfig寫入的是token，bootstrap結束后kube-controller-manager為kubelet創建client和server證書

查看kubeadm為各個節點創建的token

[root@node01 work]# kubeadm token list --kubeconfig ~/.kube/config
TOKEN                     TTL       EXPIRES                     USAGES                   DESCRIPTION               EXTRA GROUPS
cu4q2e.ogvim78s3p252ysg   23h       2019-12-06T17:44:24+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:node03
nrypmb.35fyygbwr9failr5   23h       2019-12-06T17:44:23+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:node01
r5luwb.6x6c5lnit5utyotz   23h       2019-12-06T17:44:23+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:node02
sx8n4m.vlltkkv8m23ogxg9   23h       2019-12-06T17:44:24+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:node04

• token有效期為1天，超期后將不能被用來bootstrap kubelet，且會被kube-controller-manager的token cleaner清理
• kube-apiserver接收kubelet的bootstrap token后，將請求的user設置為system:bootstrap; group設置為system:bootstrappers，后續將為這個group設置ClusterRoleBinding

查看各 token 關聯的 Secret

[root@node01 work]# kubectl get secrets  -n kube-system|grep bootstrap-token
bootstrap-token-cu4q2e                           bootstrap.kubernetes.io/token         7      33s
bootstrap-token-nrypmb                           bootstrap.kubernetes.io/token         7      34s
bootstrap-token-r5luwb                           bootstrap.kubernetes.io/token         7      34s
bootstrap-token-sx8n4m                           bootstrap.kubernetes.io/token         7      33s

創建和分發kubelet參數配置

cd /opt/k8s/work
source /opt/k8s/bin/environment.sh
cat > kubelet-config.yaml.template <<EOF
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: "##NODE_IP##"
staticPodPath: ""
syncFrequency: 1m
fileCheckFrequency: 20s
httpCheckFrequency: 20s
staticPodURL: ""
port: 10250
readOnlyPort: 0
rotateCertificates: true
serverTLSBootstrap: true
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
  x509:
    clientCAFile: "/etc/kubernetes/cert/ca.pem"
authorization:
  mode: Webhook
registryPullQPS: 0
registryBurst: 20
eventRecordQPS: 0
eventBurst: 20
enableDebuggingHandlers: true
enableContentionProfiling: true
healthzPort: 10248
healthzBindAddress: "##NODE_IP##"
clusterDomain: "${CLUSTER_DNS_DOMAIN}"
clusterDNS:
  - "${CLUSTER_DNS_SVC_IP}"
nodeStatusUpdateFrequency: 10s
nodeStatusReportFrequency: 1m
imageMinimumGCAge: 2m
imageGCHighThresholdPercent: 85
imageGCLowThresholdPercent: 80
volumeStatsAggPeriod: 1m
kubeletCgroups: ""
systemCgroups: ""
cgroupRoot: ""
cgroupsPerQOS: true
cgroupDriver: systemd
runtimeRequestTimeout: 10m
hairpinMode: promiscuous-bridge
maxPods: 220
podCIDR: "${CLUSTER_CIDR}"
podPidsLimit: -1
resolvConf: /etc/resolv.conf
maxOpenFiles: 1000000
kubeAPIQPS: 1000
kubeAPIBurst: 2000
serializeImagePulls: false
evictionHard:
  memory.available:  "100Mi"
nodefs.available:  "10%"
nodefs.inodesFree: "5%"
imagefs.available: "15%"
evictionSoft: {}
enableControllerAttachDetach: true
failSwapOn: true
containerLogMaxSize: 20Mi
containerLogMaxFiles: 10
systemReserved: {}
kubeReserved: {}
systemReservedCgroup: ""
kubeReservedCgroup: ""
enforceNodeAllocatable: ["pods"]
EOF

• address：kubelet 安全端口（https，10250）監聽的地址，不能為 127.0.0.1，否則 kube-apiserver、heapster 等不能調用 kubelet 的 API；
• readOnlyPort=0：關閉只讀端口(默認 10255)，等效為未指定；
• authentication.anonymous.enabled：設置為 false，不允許匿名訪問 10250 端口；
• authentication.x509.clientCAFile：指定簽名客戶端證書的 CA 證書，開啟 HTTP 證書認證；
• authentication.webhook.enabled=true：開啟 HTTPs bearer token 認證；
• 對於未通過 x509 證書和 webhook 認證的請求(kube-apiserver 或其他客戶端)，將被拒絕，提示 Unauthorized；
• authroization.mode=Webhook：kubelet 使用 SubjectAccessReview API 查詢 kube-apiserver 某 user、group 是否具有操作資源的權限(RBAC)；
• featureGates.RotateKubeletClientCertificate、featureGates.RotateKubeletServerCertificate：自動 rotate 證書，證書的有效期取決於 kube-controller-manager 的 –experimental-cluster-signing-duration 參數；
• 需要 root 賬戶運行；

為各個節點創建和分發kubelet配置文件

cd /opt/k8s/work
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
  do 
    echo ">>> ${node_ip}"
    sed -e "s/##NODE_IP##/${node_ip}/" kubelet-config.yaml.template > kubelet-config-${node_ip}.yaml.template
    scp kubelet-config-${node_ip}.yaml.template root@${node_ip}:/etc/kubernetes/kubelet-config.yaml
  done

創建和分發kubelet啟動文件

cd /opt/k8s/work
source /opt/k8s/bin/environment.sh
cat > kubelet.service.template <<EOF
[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service
Requires=docker.service
[Service]
WorkingDirectory=${K8S_DIR}/kubelet
ExecStart=/opt/k8s/bin/kubelet \\
  --bootstrap-kubeconfig=/etc/kubernetes/kubelet-bootstrap.kubeconfig \\
  --cert-dir=/etc/kubernetes/cert \\
  --cni-conf-dir=/etc/cni/net.d \\
  --container-runtime=docker \\
  --container-runtime-endpoint=unix:///var/run/dockershim.sock \\
  --root-dir=${K8S_DIR}/kubelet \\
  --kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\
  --config=/etc/kubernetes/kubelet-config.yaml \\
  --hostname-override=##NODE_NAME## \\
  --pod-infra-container-image=gcr.azk8s.cn/google_containers/pause-amd64:3.1 \\
  --image-pull-progress-deadline=15m \\
  --volume-plugin-dir=${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/ \\
  --logtostderr=true \\
  --v=2
Restart=always
RestartSec=5
StartLimitInterval=0
[Install]
WantedBy=multi-user.target
EOF

• 如果設置了 –hostname-override 選項，則 kube-proxy 也需要設置該選項，否則會出現找不到 Node 的情況；
• –bootstrap-kubeconfig：指向 bootstrap kubeconfig 文件，kubelet 使用該文件中的用戶名和 token 向 kube-apiserver 發送 TLS Bootstrapping 請求；
• K8S approve kubelet 的 csr 請求后，在 –cert-dir 目錄創建證書和私鑰文件，然后寫入 –kubeconfig 文件；
• –pod-infra-container-image 不使用 redhat 的 pod-infrastructure:latest 鏡像，它不能回收容器的僵屍；

分發啟動文件

d /opt/k8s/work
source /opt/k8s/bin/environment.sh
for node_name in ${NODE_NAMES[@]}
  do 
    echo ">>> ${node_name}"
    sed -e "s/##NODE_NAME##/${node_name}/" kubelet.service.template > kubelet-${node_name}.service
    scp kubelet-${node_name}.service root@${node_name}:/etc/systemd/system/kubelet.service
  done

Bootstrap Token Auth 和授予權限 kubelet 啟動時查找 --kubeletconfig
參數對應的文件是否存在，如果不存在則使用 --bootstrap-kubeconfig 指定的 kubeconfig 文件向
kube-apiserver 發送證書簽名請求 (CSR)。 kube-apiserver 收到 CSR 請求后，對其中的 Token
進行認證，認證通過后將請求的 user 設置為 system:bootstrap:，group 設置為
system:bootstrappers，這一過程稱為 Bootstrap Token Auth。

創建user和group的CSR權限，不創建kubelet會啟動失敗

kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --group=system:bootstrappers

啟動 kubelet 服務

source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
  do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p ${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/"
    ssh root@${node_ip} "/usr/sbin/swapoff -a"
    ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kubelet && systemctl restart kubelet"
  done

關閉 swap 分區，否則 kubelet 會啟動失敗；

kubelet 啟動后使用 –bootstrap-kubeconfig 向 kube-apiserver 發送 CSR 請求，當這個

CSR 被 approve 后，kube-controller-manager 為 kubelet 創建 TLS 客戶端證書、私鑰和

–kubeletconfig 文件。 注意：kube-controller-manager 需要配置 –cluster-signing-cert-file 和 –cluster-signing-key-file 參數，才會為 TLS Bootstrap 創建證書和私鑰。

[root@node01 work]# kubectl get csr
NAME        AGE    REQUESTOR                 CONDITION
csr-5ttvq   2m6s   system:bootstrap:r5luwb   Pending
csr-gmt4v   2m5s   system:bootstrap:cu4q2e   Pending
csr-hhfw4   2m6s   system:bootstrap:nrypmb   Pending
csr-qpfp8   11s    system:bootstrap:sx8n4m   Pending

這里4個節點均處於pending(等待)狀態

自動approve CSR請求

創建三個ClusterRoleBinding，分別用於自動approve client、renew client、renew server證書

cd /opt/k8s/work
cat > csr-crb.yaml <<EOF
 # Approve all CSRs for the group "system:bootstrappers"
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: auto-approve-csrs-for-group
 subjects:
 - kind: Group
   name: system:bootstrappers
   apiGroup: rbac.authorization.k8s.io
 roleRef:
   kind: ClusterRole
   name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
   apiGroup: rbac.authorization.k8s.io
---
 # To let a node of the group "system:nodes" renew its own credentials
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: node-client-cert-renewal
 subjects:
 - kind: Group
   name: system:nodes
   apiGroup: rbac.authorization.k8s.io
 roleRef:
   kind: ClusterRole
   name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
   apiGroup: rbac.authorization.k8s.io
---
# A ClusterRole which instructs the CSR approver to approve a node requesting a
# serving cert matching its client cert.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: approve-node-server-renewal-csr
rules:
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests/selfnodeserver"]
  verbs: ["create"]
---
 # To let a node of the group "system:nodes" renew its own server credentials
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: node-server-cert-renewal
 subjects:
 - kind: Group
   name: system:nodes
   apiGroup: rbac.authorization.k8s.io
 roleRef:
   kind: ClusterRole
   name: approve-node-server-renewal-csr
   apiGroup: rbac.authorization.k8s.io
EOF

kubectl apply -f csr-crb.yaml

• auto-approve-csrs-for-group 自動approve node的第一次CSR，注意第一次CSR時，請求的Group為system:bootstrappers
• node-client-cert-renewal 自動approve node后續過期的client證書，自動生成的證書Group為system:nodes
• node-server-cert-renewal 自動approve node后續過期的server證書，自動生成的證書Group

查看kubelet

等待1-10分鍾，3個節點的CSR都會自動approved

[root@node01 work]# kubectl get csr
NAME        AGE     REQUESTOR                 CONDITION
csr-5ttvq   3m33s   system:bootstrap:r5luwb   Approved,Issued
csr-gmt4v   3m32s   system:bootstrap:cu4q2e   Approved,Issued
csr-hhfw4   3m33s   system:bootstrap:nrypmb   Approved,Issued
csr-lktrc   1s      system:node:node01        Pending
csr-qpfp8   98s     system:bootstrap:sx8n4m   Approved,Issued
csr-s4q5h   102s    system:bootstrap:sx8n4m   Approved,Issued
csr-s7fds   1s      system:node:node02        Pending
csr-wszxt   34s     system:node:node04        Pending

Pending的CSR用於創建kubelet serve證書，需要手動approve (后面步驟)

目前所有節點均為ready狀態

[root@node01 work]# kubectl get nodes
NAME     STATUS   ROLES    AGE   VERSION
node01   Ready    <none>   26s   v1.15.6
node02   Ready    <none>   26s   v1.15.6
node03   Ready    <none>   25s   v1.15.6
node04   Ready    <none>   59s   v1.15.6

手動approve server cert csr

基於安全考慮，CSR approving controllers不會自動approve kubelet server證書簽名請求，需要手動approve

kubectl get csr | grep Pending | awk '{print $1}' | xargs kubectl certificate approve

kubelet啟動后監聽多個端口，用於接受kube-apiserver或其他客戶端發送的請求

[root@node01 work]# netstat -lntup|grep kubelet
tcp        0      0 127.0.0.1:36615         0.0.0.0:*               LISTEN      10549/kubelet       
tcp        0      0 10.0.20.11:10248        0.0.0.0:*               LISTEN      10549/kubelet       
tcp        0      0 10.0.20.11:10250        0.0.0.0:*               LISTEN      10549/kubelet

• 10248: healthz http 服務；
• 10250: https 服務，訪問該端口時需要認證和授權（即使訪問 /healthz 也需要）；
• 未開啟只讀端口 10255；
• 從 K8S v1.10 開始，去除了 –cadvisor-port 參數（默認 4194 端口），不支持訪問 cAdvisor UI & API