kubelet的启动流程
1. kubelet-bootstrap为用户名称,10001是一个用户ID,system:kubelet-bootstrap是 kubelet-bootstrap用户的角色权限
[root@k8s-master01 cfg]# cat token.csv 0fb61c46f8991b718eb38d27b605b008,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
2.在master上操作给kubelet-bootstrap用户授权一个较小的办法证书的权限,绑定到系统集群角色
kubectl create clusterrolebinding kubelet-bootstrap
--clusterrole=system:node-bootstrapper
--user=kubelet-bootstrap
3.创建kubeconfig文件,这里通过kubeconfig.sh脚本来生成
vim kubeconfig.sh
# 创建 TLS Bootstrapping Token #BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ') BOOTSTRAP_TOKEN=0fb61c46f8991b718eb38d27b605b008 cat > token.csv <<EOF ${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,"system:kubelet-bootstrap" EOF #---------------------- APISERVER=$1 SSL_DIR=$2 # 创建kubelet bootstrapping kubeconfig export KUBE_APISERVER="https://$APISERVER:6443" # 设置集群参数 kubectl config set-cluster kubernetes --certificate-authority=$SSL_DIR/ca.pem --embed-certs=true --server=${KUBE_APISERVER} --kubeconfig=bootstrap.kubeconfig # 设置客户端认证参数 kubectl config set-credentials kubelet-bootstrap --token=${BOOTSTRAP_TOKEN} --kubeconfig=bootstrap.kubeconfig # 设置上下文参数 kubectl config set-context default --cluster=kubernetes --user=kubelet-bootstrap --kubeconfig=bootstrap.kubeconfig # 设置默认上下文 kubectl config use-context default --kubeconfig=bootstrap.kubeconfig #---------------------- # 创建kube-proxy kubeconfig文件 kubectl config set-cluster kubernetes --certificate-authority=$SSL_DIR/ca.pem --embed-certs=true --server=${KUBE_APISERVER} --kubeconfig=kube-proxy.kubeconfig kubectl config set-credentials kube-proxy --client-certificate=$SSL_DIR/kube-proxy.pem --client-key=$SSL_DIR/kube-proxy-key.pem --embed-certs=true --kubeconfig=kube-proxy.kubeconfig kubectl config set-context default --cluster=kubernetes --user=kube-proxy --kubeconfig=kube-proxy.kubeconfig kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
执行kubeconfig.sh脚本生成kubeconfig文件
[root@k8s-master01 master]# bash kubeconfig.sh 172.16.204.133 /opt/k8s/k8s-cert
[root@k8s-master01 master]# ls
apiserver.sh bootstrap.kubeconfig controller-manager.sh kubeconfig.sh kube-proxy.kubeconfig scheduler.sh token.csv
将在master上生成的kubeconfig文件和二进制文件拷贝到node节点的/opt/k8s/kubernetes/cfg
[root@k8s-master01 master]# scp -rp bootstrap.kubeconfig kube-proxy.kubeconfig root@172.16.204.134:/opt/k8s/kubernetes/cfg/ 100% 6274 2.2MB/s 00:00 [root@k8s-master01 master]# scp -rp bootstrap.kubeconfig kube-proxy.kubeconfig root@172.16.204.135:/opt/k8s/kubernetes/cfg/
[root@k8s-master01 bin]# cd /opt/k8s/soft/kubernetes/server/bin/
[root@k8s-master01 bin]# scp -r kubelet kube-proxy root@172.16.204.134:/opt/k8s/kubernetes/bin/
[root@k8s-master01 bin]# scp -r kubelet kube-proxy root@172.16.204.135:/opt/k8s/kubernetes/bin/
万事具备,开始部署node节点啦。。。。。
依然是通过脚本来部署kubelet和proxy
vim kubelet.sh
#!/bin/bash NODE_ADDRESS=$1 #指定默认dns服务器地址:我本地是:172.16.204.2 DNS_SERVER_IP=${2:-"172.16.204.2"} cat <<EOF >/opt/k8s/kubernetes/cfg/kubelet KUBELET_OPTS="--logtostderr=true \ --v=4 \ --address=${NODE_ADDRESS} \ --hostname-override=${NODE_ADDRESS} \ --kubeconfig=/opt/k8s/kubernetes/cfg/kubelet.kubeconfig \ --experimental-bootstrap-kubeconfig=/opt/k8s/kubernetes/cfg/bootstrap.kubeconfig \ --config=/opt/k8s/kubernetes/cfg/kubelet.config \ --cert-dir=/opt/k8s/kubernetes/ssl \ --pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0" EOF cat <<EOF >/opt/k8s/kubernetes/cfg/kubelet.config kind: KubeletConfiguration apiVersion: kubelet.config.k8s.io/v1beta1 address: ${NODE_ADDRESS} port: 10250 cgroupDriver: cgroupfs clusterDNS: - ${DNS_SERVER_IP} clusterDomain: cluster.local. failSwapOn: false EOF cat <<EOF >/usr/lib/systemd/system/kubelet.service [Unit] Description=Kubernetes Kubelet After=docker.service Requires=docker.service [Service] EnvironmentFile=/opt/k8s/kubernetes/cfg/kubelet ExecStart=/opt/k8s/kubernetes/bin/kubelet $KUBELET_OPTS Restart=on-failure KillMode=process [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable kubelet systemctl restart kubelet
vim proxy.sh
#!/bin/bash NODE_ADDRESS=$1 cat <<EOF >/opt/k8s/kubernetes/cfg/kube-proxy KUBE_PROXY_OPTS="--logtostderr=true \ --v=4 \ --hostname-override=${NODE_ADDRESS} \ --cluster-cidr=10.0.0.0/24 \ --proxy-mode=ipvs \ --kubeconfig=/opt/k8s/kubernetes/cfg/kube-proxy.kubeconfig" EOF cat <<EOF >/usr/lib/systemd/system/kube-proxy.service [Unit] Description=Kubernetes Proxy After=network.target [Service] EnvironmentFile=-/opt/k8s/kubernetes/cfg/kube-proxy ExecStart=/opt/k8s/kubernetes/bin/kube-proxy $KUBE_PROXY_OPTS Restart=on-failure [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable kube-proxy systemctl restart kube-proxy
采坑:
kube-controller-manager启动后报错:failed to acquire lease kube-system/
将可执行文件路/k8s/kubernetes/ 添加到 PATH 变量中
vim /etc/profile PATH=/opt/k8s/kubernetes/bin:$PATH:$HOME/bin source /etc/profile
=====================好多坑 放弃了================