kubernetes v1.18.2 二进制部署 ipv4 kube-apiserver 部署

标签：roo   hub   cli   obj   count   manual   desc   osc   文件目录   

# 设置证书环境变量
# 设置证书使用时间87600h 10年
export EXPIRY_TIME="87600h"
# kube-apiserver 服务器IP 如果外部访问K8s 集群使用VIP ip 请在下面添加vip ip
export K8S_APISERVER_VIP="\"192.168.2.175\",\"192.168.2.176\",\"192.168.2.177\""
# kubernetes 服务 IP (一般是 SERVICE_CIDR 中第一个IP)
export CLUSTER_KUBERNETES_SVC_IP="10.66.0.1"
# 设置集群参数
export CLUSTER_NAME=kubernetes
export KUBE_API=https://192.168.2.175:5443
# K8S 外部IP 这里高可用使用本地环回IP
export K8S_VIP_DOMAIN=127.0.0.1
export K8S_SSL="\"${K8S_VIP_DOMAIN}\""
#证书所需要的配置参数
export CERT_ST="GuangDong"
export CERT_L="GuangZhou"
export CERT_O="k8s"
export CERT_OU="Qist"
export CERT_PROFILE="kubernetes"
# 生成 EncryptionConfig 所需的加密 key
export ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64)
# 设置工作目录
export  HOST_PATH=`pwd`

# etcd 如果已经创建可以不用重复创建
# 创建etcd K8S 证书json 存放目录
mkdir -p ${HOST_PATH}/cfssl/{k8s,etcd}
# 创建签发证书存放目录
mkdir -p ${HOST_PATH}/cfssl/pki/{k8s,etcd}
# CA 配置文件用于配置根证书的使用场景 (profile) 和具体参数 (usage，过期时间、服务端认证、客户端认证、加密等)，后续在签名其它证书时需要指定特定场景。
cat 

kube-apiserver 二进制文件准备

wget https://storage.googleapis.com/kubernetes-release/release/v1.18.2/kubernetes-server-linux-amd64.tar.gz
# 解压下载好文件
tar -xvf  kubernetes-server-linux-amd64.tar.gz
# 创建二进制远程存放目录
ssh 192.168.2.175 mkdir -p /apps/k8s/bin
ssh 192.168.2.176 mkdir -p /apps/k8s/bin
ssh 192.168.2.177 mkdir -p /apps/k8s/bin
# 分发解压好二进制文件
cd kubernetes/server/bin/
scp -r kube-apiserver 192.168.2.175:/apps/k8s/bin
scp -r kube-apiserver 192.168.2.176:/apps/k8s/bin
scp -r kube-apiserver 192.168.2.177:/apps/k8s/bin

kube-apiserver 配置文件准备

# 生成encryption-config.yaml
cat 

创建apiserver systemd文件

cat 

kube-apiserver 启动准备

# 创建文件目录
ssh 192.168.2.175 mkdir -p /apps/k8s/{log,kubelet-plugins,conf} && mkdir -p /apps/k8s/kubelet-plugins/volume
ssh 192.168.2.176 mkdir -p /apps/k8s/{log,kubelet-plugins,conf} && mkdir -p /apps/k8s/kubelet-plugins/volume
ssh 192.168.2.177 mkdir -p /apps/k8s/{log,kubelet-plugins,conf} && mkdir -p /apps/k8s/kubelet-plugins/volume
# 创建k8s 用户
ssh  192.168.2.175 useradd k8s -s /sbin/nologin -M
ssh  192.168.2.176 useradd k8s -s /sbin/nologin -M
ssh  192.168.2.177 useradd k8s -s /sbin/nologin -M
# 给/apps/k8s k8s 用户权限
ssh  192.168.2.175 chown -R k8s:root /apps/k8s
ssh  192.168.2.176 chown -R k8s:root /apps/k8s
ssh  192.168.2.177 chown -R k8s:root /apps/k8s

kube-apiserver 启动

# 刷新service
ssh  192.168.2.175 systemctl daemon-reload
ssh  192.168.2.176 systemctl daemon-reload
ssh  192.168.2.177 systemctl daemon-reload
# 设置开机启动
ssh  192.168.2.175 systemctl enable kube-apiserver.service
ssh  192.168.2.176 systemctl enable kube-apiserver.service 
ssh  192.168.2.177 systemctl enable kube-apiserver.service 
# 启动 kube-apiserver
ssh  192.168.2.175 systemctl  start kube-apiserver.service
ssh  192.168.2.176 systemctl  start kube-apiserver.service
ssh  192.168.2.177 systemctl  start kube-apiserver.service
# 查看启动状态
ssh  192.168.2.175 systemctl  status kube-apiserver.service
ssh  192.168.2.176 systemctl  status kube-apiserver.service 
ssh  192.168.2.177 systemctl  status kube-apiserver.service

验证kube-apiserver 是否启动成功

#创建 kubeconfig 文件夹
mkdir -p ${HOST_PATH}/kubeconfig
# 创建admin管理员登录kubeconfig
# 设置集群参数
kubectl config set-cluster ${CLUSTER_NAME} --certificate-authority=${HOST_PATH}/cfssl/pki/k8s/k8s-ca.pem --embed-certs=true  --server=${KUBE_API} --kubeconfig=${HOST_PATH}/kubeconfig/admin.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials admin  --client-certificate=${HOST_PATH}/cfssl/pki/k8s/k8s-apiserver-admin.pem  --client-key=${HOST_PATH}/cfssl/pki/k8s/k8s-apiserver-admin-key.pem  --embed-certs=true  --kubeconfig=${HOST_PATH}/kubeconfig/admin.kubeconfig
# 设置上下文参数 
kubectl config set-context ${CLUSTER_NAME} --cluster=${CLUSTER_NAME} --user=admin --namespace=kube-system --kubeconfig=${HOST_PATH}/kubeconfig/admin.kubeconfig
# 设置默认上下文
kubectl config use-context ${CLUSTER_NAME} --kubeconfig=${HOST_PATH}/kubeconfig/admin.kubeconfig
# 创建当前家目录.kube 目录
mkdir -p ~/.kube
cp ${HOST_PATH}/kubeconfig/admin.kubeconfig ~/.kube/config
# cp 二进制kubectl 到 /bin 目录
cp kubectl  /bin
# 验证集群
root@Qist:/tmp/sss# kubectl get cs
NAME                 STATUS      MESSAGE                                                                                     ERROR
controller-manager   Unhealthy   Get http://127.0.0.1:10252/healthz: dial tcp 127.0.0.1:10252: connect: connection refused
scheduler            Unhealthy   Get http://127.0.0.1:10251/healthz: dial tcp 127.0.0.1:10251: connect: connection refused
etcd-1               Healthy     {"health":"true"}
etcd-0               Healthy     {"health":"true"}
etcd-2               Healthy     {"health":"true"}
root@Qist:/tmp/sss# kubectl cluster-info
Kubernetes master is running at https://192.168.2.175:5443

To further debug and diagnose cluster problems, use ‘kubectl cluster-info dump‘.
集群能够正常访问 kube-apiserver 部署正常

kubernetes v1.18.2 二进制部署 ipv4 kube-apiserver 部署

标签：roo   hub   cli   obj   count   manual   desc   osc   文件目录   

原文地址：https://blog.51cto.com/juestnow/2492845