这篇我们部署k8s的master节点，也就是所谓的控制平面，为了保证高可用，我们这里采用了两个master节点，还记得master节点上部署什么内容吗？回忆一下子，分别是api-server，scheduler和controller manager。
配置Apiserver
PS：该操作在两个master节点上都需要执行。
1、移动证书
[root@node1 ~]# mkdir -p /etc/kubernetes/ssl[root@node1 ~]# mv ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem \service-account-key.pem service-account.pem \proxy-client.pem proxy-client-key.pem \/etc/kubernetes/ssl[root@node1 ~]# ls /etc/kubernetes/ssl/ca-key.pem ca.pem kubernetes-key.pem kubernetes.pem proxy-client-key.pem proxy-client.pem service-account-key.pem service-account.pem[root@node1 ~]#
2、配置服务
# 该master节点的IP地址，注意，两个节点需要各自配置自己的IP地址[root@node1 ~]# IP=192.168.112.130# 申明apiserver的数量[root@node1 ~]# APISERVER_COUNT=2# 申明etcd节点信息，以空格分开[root@node1 ~]# ETCD_ENDPOINTS=(192.168.112.130 192.168.112.131 192.168.112.132)# 创建apiserver管理服务[root@node1 ~]# cat <<EOF > /etc/systemd/system/kube-apiserver.service[Unit]Description=Kubernetes API ServerDocumentation=https://github.com/kubernetes/kubernetes[Service]ExecStart=/usr/local/bin/kube-apiserver \\--advertise-address=${IP} \\--allow-privileged=true \\--apiserver-count=${APISERVER_COUNT} \\--audit-log-maxage=30 \\--audit-log-maxbackup=3 \\--audit-log-maxsize=100 \\--audit-log-path=/var/log/audit.log \\--authorization-mode=Node,RBAC \\--bind-address=0.0.0.0 \\--client-ca-file=/etc/kubernetes/ssl/ca.pem \\--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\--etcd-cafile=/etc/kubernetes/ssl/ca.pem \\--etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem \\--etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem \\--etcd-servers=https://${ETCD_ENDPOINTS[0]}:2379,https://${ETCD_ENDPOINTS[1]}:2379,https://${ETCD_ENDPOINTS[2]}:2379 \\--event-ttl=1h \\--kubelet-certificate-authority=/etc/kubernetes/ssl/ca.pem \\--kubelet-client-certificate=/etc/kubernetes/ssl/kubernetes.pem \\--kubelet-client-key=/etc/kubernetes/ssl/kubernetes-key.pem \\--service-account-issuer=api \\--service-account-key-file=/etc/kubernetes/ssl/service-account.pem \\--service-account-signing-key-file=/etc/kubernetes/ssl/service-account-key.pem \\--api-audiences=api,vault,factors \\--service-cluster-ip-range=10.233.0.0/16 \\--service-node-port-range=30000-32767 \\--proxy-client-cert-file=/etc/kubernetes/ssl/proxy-client.pem \\--proxy-client-key-file=/etc/kubernetes/ssl/proxy-client-key.pem \\--runtime-config=api/all=true \\--requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \\--requestheader-allowed-names=aggregator \\--requestheader-extra-headers-prefix=X-Remote-Extra- \\--requestheader-group-headers=X-Remote-Group \\--requestheader-username-headers=X-Remote-User \\--tls-cert-file=/etc/kubernetes/ssl/kubernetes.pem \\--tls-private-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \\--v=1Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOF[root@node1 ~]#
配置controller-manager
PS：该操作在两个master节点上都需要执行。
1、移动证书
[root@node1 ~]# mv kube-controller-manager.kubeconfig /etc/kubernetes/[root@node1 ~]# ls /etc/kubernetes/kube-controller-manager.kubeconfig ssl[root@node1 ~]#
2、配置服务
[root@node1 ~]# cat <<EOF > /etc/systemd/system/kube-controller-manager.service[Unit]Description=Kubernetes Controller ManagerDocumentation=https://github.com/kubernetes/kubernetes[Service]ExecStart=/usr/local/bin/kube-controller-manager \\--bind-address=0.0.0.0 \\--cluster-cidr=10.200.0.0/16 \\--cluster-name=kubernetes \\--cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem \\--cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem \\--cluster-signing-duration=876000h0m0s \\--kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\--leader-elect=true \\--root-ca-file=/etc/kubernetes/ssl/ca.pem \\--service-account-private-key-file=/etc/kubernetes/ssl/service-account-key.pem \\--service-cluster-ip-range=10.233.0.0/16 \\--use-service-account-credentials=true \\--v=1Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOF[root@node1 ~]#
配置scheduler服务
PS：该操作在两个master节点上都需要执行。
1、移动证书
[root@node1 ~]# mv kube-scheduler.kubeconfig /etc/kubernetes[root@node1 ~]# ls /etc/kubernetes/kube-controller-manager.kubeconfig kube-scheduler.kubeconfig ssl[root@node1 ~]#
2、配置服务
[root@node1 ~]# cat <<EOF > /etc/systemd/system/kube-scheduler.service[Unit]Description=Kubernetes SchedulerDocumentation=https://github.com/kubernetes/kubernetes[Service]ExecStart=/usr/local/bin/kube-scheduler \\--authentication-kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\--authorization-kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\--kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\--leader-elect=true \\--bind-address=0.0.0.0 \\--port=0 \\--v=1Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOF[root@node1 ~]#
启动服务
PS：该操作在两个master节点上都需要执行。
剩余内容请转至VX公众号 “运维家” ，回复 “122” 查看。
网友评论