k8s系列-15-master节点安装

这篇我们部署k8s的master节点，也就是所谓的控制平面，为了保证高可用，我们这里采用了两个master节点，还记得master节点上部署什么内容吗？回忆一下子，分别是api-server，scheduler和controller manager。

配置Apiserver

PS：该操作在两个master节点上都需要执行。

1、移动证书

[root@node1 ~]# mkdir -p /etc/kubernetes/ssl[root@node1 ~]# mv ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem \    service-account-key.pem service-account.pem \    proxy-client.pem proxy-client-key.pem \    /etc/kubernetes/ssl[root@node1 ~]# ls /etc/kubernetes/ssl/ca-key.pem  ca.pem  kubernetes-key.pem  kubernetes.pem  proxy-client-key.pem  proxy-client.pem  service-account-key.pem  service-account.pem[root@node1 ~]#

2、配置服务

# 该master节点的IP地址，注意，两个节点需要各自配置自己的IP地址[root@node1 ~]# IP=192.168.112.130# 申明apiserver的数量[root@node1 ~]# APISERVER_COUNT=2# 申明etcd节点信息，以空格分开[root@node1 ~]# ETCD_ENDPOINTS=(192.168.112.130 192.168.112.131 192.168.112.132)# 创建apiserver管理服务[root@node1 ~]# cat <<EOF > /etc/systemd/system/kube-apiserver.service[Unit]Description=Kubernetes API ServerDocumentation=https://github.com/kubernetes/kubernetes[Service]ExecStart=/usr/local/bin/kube-apiserver \\  --advertise-address=${IP} \\  --allow-privileged=true \\  --apiserver-count=${APISERVER_COUNT} \\  --audit-log-maxage=30 \\  --audit-log-maxbackup=3 \\  --audit-log-maxsize=100 \\  --audit-log-path=/var/log/audit.log \\  --authorization-mode=Node,RBAC \\  --bind-address=0.0.0.0 \\  --client-ca-file=/etc/kubernetes/ssl/ca.pem \\  --enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\  --etcd-cafile=/etc/kubernetes/ssl/ca.pem \\  --etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem \\  --etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem \\  --etcd-servers=https://${ETCD_ENDPOINTS[0]}:2379,https://${ETCD_ENDPOINTS[1]}:2379,https://${ETCD_ENDPOINTS[2]}:2379 \\  --event-ttl=1h \\  --kubelet-certificate-authority=/etc/kubernetes/ssl/ca.pem \\  --kubelet-client-certificate=/etc/kubernetes/ssl/kubernetes.pem \\  --kubelet-client-key=/etc/kubernetes/ssl/kubernetes-key.pem \\  --service-account-issuer=api \\  --service-account-key-file=/etc/kubernetes/ssl/service-account.pem \\  --service-account-signing-key-file=/etc/kubernetes/ssl/service-account-key.pem \\  --api-audiences=api,vault,factors \\  --service-cluster-ip-range=10.233.0.0/16 \\  --service-node-port-range=30000-32767 \\  --proxy-client-cert-file=/etc/kubernetes/ssl/proxy-client.pem \\  --proxy-client-key-file=/etc/kubernetes/ssl/proxy-client-key.pem \\  --runtime-config=api/all=true \\  --requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \\  --requestheader-allowed-names=aggregator \\  --requestheader-extra-headers-prefix=X-Remote-Extra- \\  --requestheader-group-headers=X-Remote-Group \\  --requestheader-username-headers=X-Remote-User \\  --tls-cert-file=/etc/kubernetes/ssl/kubernetes.pem \\  --tls-private-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \\  --v=1Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOF[root@node1 ~]#

配置controller-manager

PS：该操作在两个master节点上都需要执行。

1、移动证书

[root@node1 ~]# mv kube-controller-manager.kubeconfig /etc/kubernetes/[root@node1 ~]# ls /etc/kubernetes/kube-controller-manager.kubeconfig  ssl[root@node1 ~]#

2、配置服务

[root@node1 ~]# cat <<EOF > /etc/systemd/system/kube-controller-manager.service[Unit]Description=Kubernetes Controller ManagerDocumentation=https://github.com/kubernetes/kubernetes[Service]ExecStart=/usr/local/bin/kube-controller-manager \\  --bind-address=0.0.0.0 \\  --cluster-cidr=10.200.0.0/16 \\  --cluster-name=kubernetes \\  --cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem \\  --cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem \\  --cluster-signing-duration=876000h0m0s \\  --kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\  --leader-elect=true \\  --root-ca-file=/etc/kubernetes/ssl/ca.pem \\  --service-account-private-key-file=/etc/kubernetes/ssl/service-account-key.pem \\  --service-cluster-ip-range=10.233.0.0/16 \\  --use-service-account-credentials=true \\  --v=1Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOF[root@node1 ~]#

配置scheduler服务

PS：该操作在两个master节点上都需要执行。

1、移动证书

[root@node1 ~]# mv kube-scheduler.kubeconfig /etc/kubernetes[root@node1 ~]# ls /etc/kubernetes/kube-controller-manager.kubeconfig  kube-scheduler.kubeconfig  ssl[root@node1 ~]#

2、配置服务

[root@node1 ~]# cat <<EOF > /etc/systemd/system/kube-scheduler.service[Unit]Description=Kubernetes SchedulerDocumentation=https://github.com/kubernetes/kubernetes[Service]ExecStart=/usr/local/bin/kube-scheduler \\  --authentication-kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\  --authorization-kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\  --kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\  --leader-elect=true \\  --bind-address=0.0.0.0 \\  --port=0 \\  --v=1Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOF[root@node1 ~]#

启动服务

PS：该操作在两个master节点上都需要执行。

剩余内容请转至VX公众号 “运维家” ，回复 “122” 查看。