k8s的master节点必须运行的组件(k8s master节点)

这篇我们部署k8s的master节点，也就是所谓的控制平面，为了保证高可用，我们这里采用了两个master节点，还记得master节点上部署什么内容吗？回忆一下子，分别是api-server，scheduler和controller manager。

配置Apiserver

PS：该操作在两个master节点上都需要执行。

1、移动证书

[root@node1 ~]# mkdir -p /etc/kubernetes/ssl
[root@node1 ~]# mv ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem 
    service-account-key.pem service-account.pem 
    proxy-client.pem proxy-client-key.pem 
    /etc/kubernetes/ssl
[root@node1 ~]# ls /etc/kubernetes/ssl/
ca-key.pem  ca.pem  kubernetes-key.pem  kubernetes.pem  proxy-client-key.pem  proxy-client.pem  service-account-key.pem  service-account.pem
[root@node1 ~]#

2、配置服务

# 该master节点的IP地址，注意，两个节点需要各自配置自己的IP地址
[root@node1 ~]# IP=192.168.112.130
# 申明apiserver的数量
[root@node1 ~]# APISERVER_COUNT=2
# 申明etcd节点信息，以空格分开
[root@node1 ~]# ETCD_ENDPOINTS=(192.168.112.130 192.168.112.131 192.168.112.132)
# 创建apiserver管理服务
[root@node1 ~]# cat < /etc/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
documentation=https://github.com/kubernetes/kubernetes

[Service]
ExecStart=/usr/local/bin/kube-apiserver \
  --advertise-address=${IP} \
  --allow-privileged=true \
  --apiserver-count=${APISERVER_COUNT} \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=3 \
  --audit-log-maxsize=100 \
  --audit-log-path=/var/log/audit.log \
  --authorization-mode=Node,RBAC \
  --bind-address=0.0.0.0 \
  --client-ca-file=/etc/kubernetes/ssl/ca.pem \
  --enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \
  --etcd-cafile=/etc/kubernetes/ssl/ca.pem \
  --etcd-certfile=/etc/kubernetes/ssl/kubernetes.pem \
  --etcd-keyfile=/etc/kubernetes/ssl/kubernetes-key.pem \
  --etcd-servers=https://${ETCD_ENDPOINTS[0]}:2379,https://${ETCD_ENDPOINTS[1]}:2379,https://${ETCD_ENDPOINTS[2]}:2379 \
  --event-ttl=1h \
  --kubelet-certificate-authority=/etc/kubernetes/ssl/ca.pem \
  --kubelet-client-certificate=/etc/kubernetes/ssl/kubernetes.pem \
  --kubelet-client-key=/etc/kubernetes/ssl/kubernetes-key.pem \
  --service-account-issuer=api \
  --service-account-key-file=/etc/kubernetes/ssl/service-account.pem \
  --service-account-signing-key-file=/etc/kubernetes/ssl/service-account-key.pem \
  --api-audiences=api,vault,factors \
  --service-cluster-ip-range=10.233.0.0/16 \
  --service-node-port-range=30000-32767 \
  --proxy-client-cert-file=/etc/kubernetes/ssl/proxy-client.pem \
  --proxy-client-key-file=/etc/kubernetes/ssl/proxy-client-key.pem \
  --runtime-config=api/all=true \
  --requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \
  --requestheader-allowed-names=aggregator \
  --requestheader-extra-headers-prefix=X-Remote-Extra- \
  --requestheader-group-headers=X-Remote-Group \
  --requestheader-username-headers=X-Remote-User \
  --tls-cert-file=/etc/kubernetes/ssl/kubernetes.pem \
  --tls-private-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \
  --v=1
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
[root@node1 ~]#

配置controller-manager

PS：该操作在两个master节点上都需要执行。

1、移动证书

[root@node1 ~]# mv kube-controller-manager.kubeconfig /etc/kubernetes/
[root@node1 ~]# ls /etc/kubernetes/
kube-controller-manager.kubeconfig  ssl
[root@node1 ~]#

2、配置服务

[root@node1 ~]# cat < /etc/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
documentation=https://github.com/kubernetes/kubernetes

[Service]
ExecStart=/usr/local/bin/kube-controller-manager \
  --bind-address=0.0.0.0 \
  --cluster-cidr=10.200.0.0/16 \
  --cluster-name=kubernetes \
  --cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem \
  --cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem \
  --cluster-signing-duration=876000h0m0s \
  --kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \
  --leader-elect=true \
  --root-ca-file=/etc/kubernetes/ssl/ca.pem \
  --service-account-private-key-file=/etc/kubernetes/ssl/service-account-key.pem \
  --service-cluster-ip-range=10.233.0.0/16 \
  --use-service-account-credentials=true \
  --v=1
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
[root@node1 ~]#

配置scheduler服务

PS：该操作在两个master节点上都需要执行。

1、移动证书

[root@node1 ~]# mv kube-scheduler.kubeconfig /etc/kubernetes
[root@node1 ~]# ls /etc/kubernetes/
kube-controller-manager.kubeconfig  kube-scheduler.kubeconfig  ssl
[root@node1 ~]#

2、配置服务

剩余内容请转至VX公众号 “运维家” ，回复 “122” 查看。