主机列表

本次实验选择5台主机,3台作为master主机,2台作为node节点

节点ipOS版本hostname -f安装软件
192.168.0.1RHEL7.4k8s-master01docker,etcd,flanneld,kube-apiserver,kube-controller-manager,kube-scheduler
192.168.0.2RHEL7.4k8s-master02docker,etcd,flanneld,kube-apiserver,kube-controller-manager,kube-scheduler
192.168.0.3RHEL7.4k8s-master03docker,etcd,flanneld,kube-apiserver,kube-controller-manager,kube-scheduler
192.168.0.4RHEL7.4k8s-node01docker,flanneld,kubelet,kube-proxy
192.168.0.5RHEL7.4k8s-node02docker,flanneld,kubelet,kube-proxy

kubectl 是 kubernetes 集群的命令行管理工具,默认从 ~/.kube/config 文件读取 kube-apiserver 地址、证书、用户名等信息,如果没有配置,执行 kubectl 命令时可能会出错,~/.kube/config只需要部署一次,然后拷贝到其他的master。

下载解压二进制文件

# wget https://dl.k8s.io/v1.15.3/kubernetes-server-linux-amd64.tar.gz 
# tar xf kubernetes-server-linux-amd64.tar.gz

# cd kubernetes/server/bin/
# cp  kubeadm  kubectl  /k8s/kubernetes/bin/

创建请求证书

cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}
EOF

  • O 为system:masters,kube-apiserver 收到该证书后将请求的 Group 设置为 system:masters;
  • 预定义的 ClusterRoleBinding cluster-admin 将 Group system:masters 与 Role cluster-admin绑定,该 Role 授予所有 API的权限;
  • 该证书只会被 kubectl 当做 client 证书使用,所以 hosts 字段为空;

 生成证书和私钥

cfssl gencert -ca=/k8s/kubernetes/ssl/ca.pem -ca-key=/k8s/kubernetes/ssl/ca-key.pem  -config=/k8s/kubernetes/ssl/ca-config.json  -profile=kubernetes admin-csr.json | cfssljson -bare admin

 创建~/.kube/config文件

kubectl config set-cluster kubernetes --certificate-authority=/k8s/kubernetes/ssl/ca.pem --embed-certs=true --server=https://192.168.0.1:6443 --kubeconfig=kubectl.kubeconfig
kubectl config set-credentials admin --client-certificate=admin.pem --client-key=admin-key.pem --embed-certs=true --kubeconfig=kubectl.kubeconfig
kubectl config set-context kubernetes  --cluster=kubernetes --user=admin --kubeconfig=kubectl.kubeconfig
kubectl config use-context kubernetes  --kubeconfig=kubectl.kubeconfig

分发~/.kube/config文件

cp kubectl.kubeconfig ~/.kube/config
scp -r /k8s/kubernetes/ssl/kubectl.kubeconfig 192.168.0.2:~/.kube/config
scp -r /k8s/kubernetes/ssl/kubectl.kubeconfig 192.168.0.3:~/.kube/config

 

Logo

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐