一、部署kubelet組件
獲取最新更新以及文章用到的軟件包，請移步點擊：查看更新
1、創建安裝目錄
mkdir -p /opt/kubernetes/{bin,cfg,ssl,logs}
2、拷貝二進制文件
cd kubernetes/server/bin cp kubelet kube-proxy /opt/kubernetes/bin #本地拷貝 scp kubelet kube-proxy root@192.168.112.111:/opt/kubernetes/bin scp kubelet kube-proxy root@192.168.112.112:/opt/kubernetes/bin scp kubelet kube-proxy root@192.168.112.113:/opt/kubernetes/bin scp kubelet kube-proxy root@192.168.112.114:/opt/kubernetes/bin scp kubelet kube-proxy root@192.168.112.115:/opt/kubernetes/bin
3、創建配置文件
cat > /opt/kubernetes/cfg/kubelet.conf << EOF KUBELET_OPTS="--logtostderr=false \\ --v=4 \\ --log-dir=/opt/kubernetes/logs \\ --hostname-override=k8s-master2 \\ --network-plugin=cni \\ --kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \\ --bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \\ --config=/opt/kubernetes/cfg/kubelet-config.yml \\ --cert-dir=/opt/kubernetes/ssl \\ --pod-infra-container-image=lizhenliang/pause-amd64:3.0" EOF
–hostname-override：顯示名稱，集群中唯一
–network-plugin：啟用CNI
–kubeconfig：空路徑，會自動生成，后面用於連接apiserver
–bootstrap-kubeconfig：首次啟動向apiserver申請證書
–config：配置參數文件
–cert-dir：kubelet證書生成目錄
–pod-infra-container-image：管理Pod網絡容器的鏡像
4、配置參數文件
cat > /opt/kubernetes/cfg/kubelet-config.yml << EOF kind: KubeletConfiguration apiVersion: kubelet.config.k8s.io/v1beta1 address: 0.0.0.0 port: 10250 readOnlyPort: 10255 cgroupDriver: cgroupfs clusterDNS: - 10.0.0.2 clusterDomain: cluster.local failSwapOn: false authentication: anonymous: enabled: false webhook: cacheTTL: 2m0s enabled: true x509: clientCAFile: /opt/kubernetes/ssl/ca.pem authorization: mode: Webhook webhook: cacheAuthorizedTTL: 5m0s cacheUnauthorizedTTL: 30s evictionHard: imagefs.available: 15% memory.available: 100Mi nodefs.available: 10% nodefs.inodesFree: 5% maxOpenFiles: 1000000 maxPods: 110 EOF
5、生成bootstrap.kubeconfig文件
KUBE_APISERVER="https://192.168.112.120:7443" # apiserver IP:PORT TOKEN="c47ffb939f5ca36231d9e3121a252940" # 與token.csv里保持一致 # 生成 kubelet bootstrap kubeconfig 配置文件 kubectl config set-cluster kubernetes \ --certificate-authority=/opt/kubernetes/ssl/ca.pem \ --embed-certs=true \ --server=${KUBE_APISERVER} \ --kubeconfig=bootstrap.kubeconfig kubectl config set-credentials "kubelet-bootstrap" \ --token=${TOKEN} \ --kubeconfig=bootstrap.kubeconfig kubectl config set-context default \ --cluster=kubernetes \ --user="kubelet-bootstrap" \ --kubeconfig=bootstrap.kubeconfig kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
拷貝到配置文件路徑：
cp bootstrap.kubeconfig /opt/kubernetes/cfg
6、systemd管理kubelet
cat > /usr/lib/systemd/system/kubelet.service << EOF [Unit] Description=Kubernetes Kubelet After=docker.service [Service] EnvironmentFile=/opt/kubernetes/cfg/kubelet.conf ExecStart=/opt/kubernetes/bin/kubelet \$KUBELET_OPTS Restart=on-failure LimitNOFILE=65536 [Install] WantedBy=multi-user.target EOF
7、啟動並設置開機啟動
systemctl daemon-reload
systemctl start kubelet
systemctl enable kubelet
8、批准kubelet證書申請並加入集群
# 查看kubelet證書請求 kubectl get csr NAME AGE SIGNERNAME REQUESTOR CONDITION node-csr-uCEGPOIiDdlLODKts8J658HrFq9CZ--K6M4G7bjhk8A 6m3s kubernetes.io/kube-apiserver-client-kubelet kubelet-bootstrap Pending # 批准申請 kubectl certificate approve node-csr-uCEGPOIiDdlLODKts8J658HrFq9CZ--K6M4G7bjhk8A # 查看節點 kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master NotReady <none> 7s v1.20.4
注：由於網絡插件還沒有部署，節點會沒有准備就緒 NotReady
二、部署kube-proxy組件
1、創建配置文件
cat > /opt/kubernetes/cfg/kube-proxy.conf << EOF KUBE_PROXY_OPTS="--logtostderr=false \\ --v=2 \\ --log-dir=/opt/kubernetes/logs \\ --config=/opt/kubernetes/cfg/kube-proxy-config.yml" EOF
2、配置參數文件
cat > /opt/kubernetes/cfg/kube-proxy-config.yml << EOF kind: KubeProxyConfiguration apiVersion: kubeproxy.config.k8s.io/v1alpha1 bindAddress: 0.0.0.0 metricsBindAddress: 0.0.0.0:10249 clientConnection: kubeconfig: /opt/kubernetes/cfg/kube-proxy.kubeconfig hostnameOverride: k8s-master clusterCIDR: 10.0.0.0/24 EOF
3、生成kube-proxy.kubeconfig文件
cd ~/TLS/k8s # 創建證書請求文件 cat > kube-proxy-csr.json << EOF { "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "k8s", "OU": "System" } ] } EOF cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy 生成證書 ls kube-proxy*pem kube-proxy-key.pem kube-proxy.pem
4、生成kubeconfig文件
KUBE_APISERVER="https://192.168.112.120:7443" kubectl config set-cluster kubernetes \ --certificate-authority=/opt/kubernetes/ssl/ca.pem \ --embed-certs=true \ --server=${KUBE_APISERVER} \ --kubeconfig=kube-proxy.kubeconfig kubectl config set-credentials kube-proxy \ --client-certificate=./kube-proxy.pem \ --client-key=./kube-proxy-key.pem \ --embed-certs=true \ --kubeconfig=kube-proxy.kubeconfig kubectl config set-context default \ --cluster=kubernetes \ --user=kube-proxy \ --kubeconfig=kube-proxy.kubeconfig kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
拷貝到配置文件指定路徑：
cp kube-proxy.kubeconfig /opt/kubernetes/cfg/
5、systemd管理kube-proxy
cat > /usr/lib/systemd/system/kube-proxy.service << EOF [Unit] Description=Kubernetes Proxy After=network.target [Service] EnvironmentFile=/opt/kubernetes/cfg/kube-proxy.conf ExecStart=/opt/kubernetes/bin/kube-proxy \$KUBE_PROXY_OPTS Restart=on-failure LimitNOFILE=65536 [Install] WantedBy=multi-user.target EOF
6、啟動並設置開機啟動
systemctl daemon-reload systemctl start kube-proxy systemctl enable kube-proxy
7、查看集群
kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master1 NotReady <none> 101s v1.20.4 kubectl label node k8s-master1 node-role.kubernetes.io/master= kubectl label node k8s-master1 node-role.kubernetes.io/node=