kubernetes学习(8)---kubernetes安装

一百零八步

1653人浏览 · 2022-03-07 20:05:23

一百零八步 · 2022-03-07 20:05:23 发布

安装kubernetes

在k8s-100-52(192.168.100.52)、k8s-100-53(192.168.100.53)、k8s-100-54(192.168.100.54)、k8s-100-55(192.168.100.55)和k8s-100-56(192.168.100.56)上，下载kubernetes安装包 先安装，未启动，等证书生成后启动

# kubernetes下载需要某些特殊方法，请自行解决
wget https://dl.k8s.io/v1.20.0/kubernetes-server-linux-amd64.tar.gz  # 我这里使用的1.20.0版本  看自己个人需要

tar -xf kubernetes-server-linux-amd64.tar.gz  --strip-components=3 -C /usr/local/bin kubernetes/server/bin/kube{let,ctl,-apiserver,-controller-manager,-scheduler,-proxy}

版本查看

kubelet --version

10、生产证书

二进制安装最关键步骤，一步错误全盘皆输，一定要注意每个步骤都要是正确的

在运维主机(192.168.100.50)上操作

# 下载
sudo wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -O /usr/bin/cfssl && \
sudo wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -O /usr/bin/cfssl-json && \
sudo wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -O /usr/bin/cfssl-certinfo
# 赋予执行权限
chmod +x /usr/bin/cfssl*

开始准备自签证书 cfssl参考文章

cd /opt
mkdir -p certs
cd certs

准备CA证书，创建CA证书签名请求（csr）的JSON配置文件

主要ca-config.json ca-config.json是CA的证书生成策略

1、ca-config.json：可以定义多个 profiles，分别指定不同的过期时间、使用场景等参数；后续在签名证书时使用某个 profile；
2、signing：表示该证书可用于签名其它证书；生成的 ca.pem 证书中 CA=TRUE；
3、server auth：服务端证书；表示client可以用该 CA 对server提供的证书进行验证；server 由服务器使用，并由客户端验证服务器身份
4、client auth：客户端证书；表示server可以用该CA对client提供的证书进行验证；client用于通过服务器验证客户端。
5、peer 对等证书；就是server auth、client auth都有的。成员之间共用，供它们彼此之间通信使用

{
    "signing": {
        "default": {
            "expiry": "88888h"
        },
        "profiles": {
            # 用于服务端认证客户端，例如etcdctl、etcd proxy、fleetctl、docker客户端
            "server": {
                "expiry": "88888h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            # 服务端使用，客户端以此验证服务端身份，例如docker服务端、kube-apiserver
            "client": {
                "expiry": "88888h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            # 双向证书，用于etcd集群成员间通信
            "peer": {
                "expiry": "88888h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}

主要的ca-csr.json文件

{
    "CN": "Xuexi",         # 机构组织
    "hosts": [
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "shanghai",
            "L": "shanghai",
            "O": "xuexi",
            "OU": "ops"
        }
    ],
    "ca": {
        "expiry": "88888h"     # 根证书有效期：20年，这里就是kubeadm不建议新手使用的地方
    }
}

在运维节点（192.168.100.50）上生成etcd证书

生成证书的CSR文件：证书签名请求文件，配置了一些域名、公司、单位等信息

etcd-ca-csr.json文件内容如下：

{
  "CN": "etcd",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shanghai",
      "L": "shanghai",
      "O": "xuexi",
      "OU": "ops"
    }
  ],
  "ca": {
    "expiry": "88888h"
  }
}

开始生成etcd证书

# 生成etcd CA证书和CA证书的key
cfssl gencert -initca etcd-ca-csr.json | cfssl-json -bare /opt/certs/etcd-ca

配置etcd证书请求文件etcd-peer-csr.json，内容如下：

vim etcd-peer-csr.json

{
    "CN": "k8s-etcd",
    "hosts": [
        "192.168.100.50",
        "192.168.100.51",
        "192.168.100.52",
        "192.168.100.53",
        "192.168.100.54",
        "192.168.100.55",
        "192.168.100.56",
        "192.168.100.57",
        "192.168.100.58",
        "192.168.100.59",
        "192.168.100.60"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "shanghai",
            "L": "shanghai",
            "O": "xuexi",
            "OU": "ops"
        }
    ]
}

开始生成etcd证书

cfssl gencert -ca=etcd-ca.pem -ca-key=etcd-ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json | cfssl-json -bare etcd-peer

将证书复制到其他节点

MasterNodes='k8s-100-52 k8s-100-53 k8s-100-54 k8s-100-55 k8s-100-56'
for NODE in $MasterNodes; do
    ssh $NODE "mkdir -p /etc/etcd/ssl"
    for FILE in etcd-ca-key.pem etcd-ca.pem etcd-peer-key.pem etcd-peer.pem; do
        scp /opt/certs/${FILE} ${NODE}:/etc/etcd/ssl/${FILE}
    done
done

生成k8s组件证书

在运维节点(192.168.100.50)上生成kubernetes的证书

将证书做成承载式证书（为什么做成承载证书，后面要研究一下）

cd /opt/certs
cfssl gencert -initca ca-csr.json | cfssl-json -bare ca

10.96.0是k8s service的网段，如果需要更改k8s service网段，那就需要更改10.96.0.1，如果不是高可用集群，192.168.100.52为master01的ip

其中 **apiserver-csr.json**内容如下：

cd /opt/certs
vim apiserver-csr.json

{
    "CN": "k8s-apiserver",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
        "10.96.0.1",
        "192.168.100.52",
        "127.0.0.1",
        "kubernetes",
        "kubernetes.default",
        "kubernetes.default.svc",
        "kubernetes.default.svc.cluster",
        "kubernetes.default.svc.cluster.local",
        "192.168.100.50",
        "192.168.100.51",
        "192.168.100.53",
        "192.168.100.54",
        "192.168.100.55",
        "192.168.100.56",
        "192.168.100.57",
        "192.168.100.58",
        "192.168.100.59",
        "192.168.100.60"
    ],
    "names": [
       {
            "C": "CN",
            "ST": "shanghai",
            "L": "shanghai",
            "O": "xuexi",
            "OU": "ops"
        }
    ]
}

生成证书

cd /opt/certs 
# cfssl生成证书的操作
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer apiserver-csr.json | cfssl-json -bare apiserver

生成apiserver的聚合证书。Requestheader-client-xxx requestheader-allowwd-xxx:aggerator

其中 **front-proxy-ca-csr.json**文件内容如下

vim /opt/certs/front-proxy-ca-csr.json

内容如下

{
  "CN": "kubernetes",
  "key": {
     "algo": "rsa",
     "size": 2048
  }
}

开始生成apiserver的聚合证书

cfssl gencert -initca front-proxy-ca-csr.json | cfssl-json -bare front-proxy-ca

其中聚合证书client端请求证书，**front-proxy-client-csr.json**内容如下：

vim /opt/certs/front-proxy-client-csr.json

内容如下

{
  "CN": "front-proxy-client",
  "key": {
     "algo": "rsa",
     "size": 2048
  }
}

签发证书

cfssl gencert -ca=front-proxy-ca.pem -ca-key=front-proxy-ca-key.pem -config=ca-config.json -profile=peer front-proxy-client-csr.json | cfssl-json -bare front-proxy-client

生成controller-manager的证书

其中，**manager-csr.json**文件如下

vim /opt/certs/manager-csr.json

{
  "CN": "system:kube-controller-manager",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shanghai",
      "L": "shanghai",
      "O": "system:kube-controller-manager",
      "OU": "ops"
    }
  ]
}

签发证书

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=peer manager-csr.json | cfssl-json -bare controller-manager

将证书拷贝至各节点上

KubernetesNodes='k8s-100-52 k8s-100-53 k8s-100-54 k8s-100-55 k8s-100-56'
for NODE in $KubernetesNodes; do
    ssh $NODE "mkdir -p /etc/kubernetes/pki"
    for FILE in $(ls /opt/certs); do
        scp /opt/certs/${FILE} $NODE:/etc/kubernetes/pki/${FILE}
    done
done

在master01节点上(192.168.100.52)

cd /etc/kubernetes/pki

# 设置一个环境项，一个上下文
kubectl config set-cluster kubernetes \
     --certificate-authority=/etc/kubernetes/pki/ca.pem \
     --embed-certs=true \
     --server=https://192.168.100.57:8443 \
     --kubeconfig=/etc/kubernetes/pki/controller-manager.kubeconfig
     
# 设置一个用户项   set-credentials
kubectl config set-context system:kube-controller-manager@kubernetes \
    --cluster=kubernetes \
    --user=system:kube-controller-manager \
    --kubeconfig=/etc/kubernetes/pki/controller-manager.kubeconfig
    
# 设置一个用户项   set-credentials
kubectl config set-credentials system:kube-controller-manager \
   --client-certificate=/etc/kubernetes/pki/controller-manager.pem \
   --client-key=/etc/kubernetes/pki/controller-manager-key.pem \
   --embed-certs=true \
   --kubeconfig=/etc/kubernetes/pki/controller-manager.kubeconfig
   
# 使用某个环境当作默认环境
kubectl config use-context system:kube-controller-manager@kubernetes \
     --kubeconfig=/etc/kubernetes/pki/controller-manager.kubeconfig

生成scheduler的证书（在192.168.100.50上，后scp到192.168.100.52上）

其中，**shceduler-csr.json**文件如下

vim /opt/certs/scheduler-csr.json

{
  "CN": "system:kube-scheduler",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shanghai",
      "L": "shanghai",
      "O": "system:kube-scheduler",
      "OU": "ops"
    }
  ]
}

生成scheduler的证书

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=peer scheduler-csr.json | cfssl-json -bare scheduler

scp证书到master01上

scp /opt/certs/scheduler* root@k8s-100-52:/etc/kubernetes/pki/

同样的操作

cd /etc/kubernetes/pki
kubectl config set-cluster kubernetes \
     --certificate-authority=/etc/kubernetes/pki/ca.pem \
     --embed-certs=true \
     --server=https://192.168.100.57:8443 \
     --kubeconfig=/etc/kubernetes/pki/scheduler.kubeconfig
     
kubectl config set-credentials system:kube-scheduler \
     --client-certificate=/etc/kubernetes/pki/scheduler.pem \
     --client-key=/etc/kubernetes/pki/scheduler-key.pem \
     --embed-certs=true \
     --kubeconfig=/etc/kubernetes/pki/scheduler.kubeconfig
     
kubectl config set-context system:kube-scheduler@kubernetes \
     --cluster=kubernetes \
     --user=system:kube-scheduler \
     --kubeconfig=/etc/kubernetes/pki/scheduler.kubeconfig
     
kubectl config use-context system:kube-scheduler@kubernetes \
     --kubeconfig=/etc/kubernetes/pki/scheduler.kubeconfig

创建admin用户 (192.168.100.50上)

其中，admin-csr.json内容如下

vim /opt/certs/admin-csr.json

内容如下

{
  "CN": "admin",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shanghai",
      "L": "shanghai",
      "O": "system:masters",
      "OU": "ops"
    }
  ]
}

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=peer admin-csr.json | cfssl-json -bare admin

scp到master上(192.168.100.52)

scp /opt/certs/admin* root@k8s-100-52:/etc/kubernetes/pki

在master(192.168.100.52)上操作

cd /etc/kubernetes/pki

内容如下

kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/pki/ca.pem \
  --embed-certs=true \
  --server=https://192.168.100.57:8443 \
  --kubeconfig=/etc/kubernetes/pki/admin.kubeconfig
  
kubectl config set-credentials kubernetes-admin --client-certificate=/etc/kubernetes/pki/admin.pem \
  --client-key=/etc/kubernetes/pki/admin-key.pem \
  --embed-certs=true \
  --kubeconfig=/etc/kubernetes/pki/admin.kubeconfig
  
kubectl config set-context kubernetes-admin@kubernetes --cluster=kubernetes \
  --user=kubernetes-admin \
  --kubeconfig=/etc/kubernetes/pki/admin.kubeconfig
  
kubectl config use-context kubernetes-admin@kubernetes \
  --kubeconfig=/etc/kubernetes/pki/admin.kubeconfig

创建ServiceAccount key —》 secret

openssl genrsa -out /etc/kubernetes/pki/sa.key 2048

openssl rsa -in /etc/kubernetes/pki/sa.key -pubout -out /etc/kubernetes/pki/sa.pub

发送证书到所有节点

KubernetesNodes='k8s-100-52 k8s-100-53 k8s-100-54 k8s-100-55 k8s-100-56'
for NODE in $KubernetesNodes; do
    for FILE in $(ls /etc/kubernetes/pki | grep -v etcd); do
        scp /etc/kubernetes/pki/${FILE} $NODE:/etc/kubernetes/pki/${FILE}
    done
    for FILE in admin.kubeconfig controller-manager.kubeconfig scheduler.kubeconfig; do
        scp /etc/kubernetes/pki/${FILE} $NODE:/etc/kubernetes/${FILE}
    done
done

11、kubernetes系统组件配置

etcd 配置

etcd配置大致相同，注意修改每个节点的etcd配置的主机名和IP地址

在**192.168.100.52**上

vim /etc/etcd/etcd.config.yml

内容如下：

name: 'k8s-100-52'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.100.52:2380'
listen-client-urls: 'https://192.168.100.52:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.100.52:2380'
advertise-client-urls: 'https://192.168.100.52:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-100-52=https://192.168.100.52:2380,k8s-100-53=https://192.168.100.53:2380,k8s-100-54=https://192.168.100.54:2380,k8s-100-55=https://192.168.100.55:2380,k8s-100-56=https://192.168.100.56:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false

在**192.168.100.53**上

vim /etc/etcd/etcd.config.yml

内容如下

name: 'k8s-100-53'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.100.53:2380'
listen-client-urls: 'https://192.168.100.53:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.100.53:2380'
advertise-client-urls: 'https://192.168.100.53:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-100-52=https://192.168.100.52:2380,k8s-100-53=https://192.168.100.53:2380,k8s-100-54=https://192.168.100.54:2380,k8s-100-55=https://192.168.100.55:2380,k8s-100-56=https://192.168.100.56:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false

在**192.168.100.54**上

vim /etc/etcd/etcd.config.yml

内容如下

name: 'k8s-100-54'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.100.54:2380'
listen-client-urls: 'https://192.168.100.54:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.100.54:2380'
advertise-client-urls: 'https://192.168.100.54:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-100-52=https://192.168.100.52:2380,k8s-100-53=https://192.168.100.53:2380,k8s-100-54=https://192.168.100.54:2380,k8s-100-55=https://192.168.100.55:2380,k8s-100-56=https://192.168.100.56:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false

在**192.168.100.55**上

vim /etc/etcd/etcd.config.yml

内容如下

name: 'k8s-100-55'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.100.55:2380'
listen-client-urls: 'https://192.168.100.55:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.100.55:2380'
advertise-client-urls: 'https://192.168.100.55:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-100-52=https://192.168.100.52:2380,k8s-100-53=https://192.168.100.53:2380,k8s-100-54=https://192.168.100.54:2380,k8s-100-55=https://192.168.100.55:2380,k8s-100-56=https://192.168.100.56:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false

在**192.168.100.56**上

vim /etc/etcd/etcd.config.yml

内容如下

name: 'k8s-100-56'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.100.56:2380'
listen-client-urls: 'https://192.168.100.56:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.100.56:2380'
advertise-client-urls: 'https://192.168.100.56:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-100-52=https://192.168.100.52:2380,k8s-100-53=https://192.168.100.53:2380,k8s-100-54=https://192.168.100.54:2380,k8s-100-55=https://192.168.100.55:2380,k8s-100-56=https://192.168.100.56:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/kubernetes/pki/etcd/etcd-peer.pem'
  key-file: '/etc/kubernetes/pki/etcd/etcd-peer-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false

创建service

所有master节点创建etcd service 并启动

vim /usr/lib/systemd/system/etcd.service

内容如下

[Unit]
Description=Etcd Service
Documentation=https://coreos.com/etcd/docs/latest/
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd --config-file=/etc/etcd/etcd.config.yml
Restart=on-failure
RestartSec=10
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
Alias=etcd3.service

所有Master节点创建etcd的证书目录

mkdir -p /etc/kubernetes/pki/etcd
ln -s /etc/etcd/ssl/* /etc/kubernetes/pki/etcd

# 启动服务
systemctl daemon-reload && systemctl enable --now etcd

查看etcd状态

export ETCDCTL_API=3

etcdctl --endpoints="192.168.100.52:2379,192.168.100.53:2379,192.168.100.54:2379,192.168.100.55:2379,192.168.100.56:2379" --cacert=/etc/kubernetes/pki/etcd/etcd-ca.pem --cert=/etc/kubernetes/pki/etcd/etcd-peer.pem --key=/etc/kubernetes/pki/etcd/etcd-peer-key.pem  endpoint status --write-out=table

12、kubernetes组件配置

所有节点创建相关目录

mkdir -p /etc/kubernetes/manifests/ /etc/systemd/system/kubelet.service.d /var/lib/kubelet /var/log/kubernetes

配置apiserver

**master01(192.168.100.52)**配置所有master节点都要配置apiserver

注意k8s service网段为10.96.0.0/12，该网段不能和宿主机的网段、Pod网段的重复，请按需修改

vim /usr/lib/systemd/system/kube-apiserver.service

内容如下

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]
ExecStart=/usr/local/bin/kube-apiserver \
      --v=2  \
      --logtostderr=true  \
      --allow-privileged=true  \
      --bind-address=0.0.0.0  \
      --secure-port=6443  \
      --insecure-port=0  \
      --advertise-address=192.168.100.52 \       # 不同节点，此处的ip需要按需修改
      --service-cluster-ip-range=10.96.0.0/12  \
      --service-node-port-range=10000-40000  \
      --etcd-servers=https://192.168.100.52:2379,https://192.168.100.53:2379,https://192.168.100.54:2379,https://192.168.100.55:2379,https://192.168.100.56:2379 \
      --etcd-cafile=/etc/etcd/ssl/etcd-ca.pem  \
      --etcd-certfile=/etc/etcd/ssl/etcd-peer.pem  \
      --etcd-keyfile=/etc/etcd/ssl/etcd-peer-key.pem  \
      --client-ca-file=/etc/kubernetes/pki/ca.pem  \
      --tls-cert-file=/etc/kubernetes/pki/apiserver.pem  \
      --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem  \
      --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.pem  \
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-key.pem  \
      --service-account-key-file=/etc/kubernetes/pki/sa.pub  \
      --service-account-signing-key-file=/etc/kubernetes/pki/sa.key  \
      --service-account-issuer=https://kubernetes.default.svc.cluster.local \
      --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname  \
      --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota  \
      --authorization-mode=Node,RBAC  \
      --enable-bootstrap-token-auth=true  \
      --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem  \
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.pem  \
      --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client-key.pem  \
      --requestheader-allowed-names=aggregator  \
      --requestheader-group-headers=X-Remote-Group  \
      --requestheader-extra-headers-prefix=X-Remote-Extra-  \
      --requestheader-username-headers=X-Remote-User
      # --token-auth-file=/etc/kubernetes/token.csv

Restart=on-failure
RestartSec=10s
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target

同理每个节点

此处以三个master节点验证
在这里插入图片描述

启动apiserver

所有master节点开启kube-apiserver

systemctl daemon-reload && systemctl enable --now kube-apiserver

# 查看apiserver是否启动成功
systemctl status kube-apiserver

配置Controller-manager

**所有master节点**配置kube-controller-manager service

注意本文档使用的k8s Pod网段为172.16.0.0/12，该网段不能和宿主机的网段、k8s Service网段的重复，请按需修改

vim /usr/lib/systemd/system/kube-controller-manager.service

内容如下

[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]
ExecStart=/usr/local/bin/kube-controller-manager \
      --v=2 \
      --logtostderr=true \
      --address=127.0.0.1 \
      --root-ca-file=/etc/kubernetes/pki/ca.pem \
      --cluster-signing-cert-file=/etc/kubernetes/pki/ca.pem \
      --cluster-signing-key-file=/etc/kubernetes/pki/ca-key.pem \
      --service-account-private-key-file=/etc/kubernetes/pki/sa.key \
      --kubeconfig=/etc/kubernetes/pki/controller-manager.kubeconfig \
      --leader-elect=true \
      --use-service-account-credentials=true \
      --node-monitor-grace-period=40s \
      --node-monitor-period=5s \
      --pod-eviction-timeout=2m0s \
      --controllers=*,bootstrapsigner,tokencleaner \
      --allocate-node-cidrs=true \
      --cluster-cidr=172.16.0.0/12 \    # 一定要记住这个ip，这个ip如果配置错误，后面的calico启动会有问题
      --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem \
      --node-cidr-mask-size=24
      
Restart=always
RestartSec=10s

[Install]
WantedBy=multi-user.target

所有master节点启动kube-controller-manager

systemctl daemon-reload && systemctl enable --now kube-controller-manager

# 检查状态
systemctl status kube-controller-manager

在这里插入图片描述

13、TLS Bootstrapping 配置

在master（192.168.100.52）上创建bootstrap使用相关config文件

cd /etc/kubernetes/pki

kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.pem --embed-certs=true --server=https://192.168.100.57:8443 --kubeconfig=/etc/kubernetes/pki/bootstrap-kubelet.kubeconfig

kubectl config set-credentials tls-bootstrap-token-user --token=c8ad9c.2e4d610cf3e7426e --kubeconfig=/etc/kubernetes/pki/bootstrap-kubelet.kubeconfig

kubectl config set-context tls-bootstrap-token-user@kubernetes --cluster=kubernetes --user=tls-bootstrap-token-user --kubeconfig=/etc/kubernetes/pki/bootstrap-kubelet.kubeconfig

kubectl config use-context tls-bootstrap-token-user@kubernetes --kubeconfig=/etc/kubernetes/pki/bootstrap-kubelet.kubeconfig

在运维主机（192.168.100.50）上编辑bootstrap.secret.yaml文件

cd /data/k8s-yaml/k8s-v1-20-install  # 这里是文件服务器上

mkdir -p /data/k8s-yaml/k8s-v1-20-install/bootstrap
cd /data/k8s-yaml/k8s-v1-20-install/bootstrap
vim bootstrap.secret.yaml

内容如下

apiVersion: v1
kind: Secret
metadata:
  name: bootstrap-token-c8ad9c
  namespace: kube-system
type: bootstrap.kubernetes.io/token
stringData:
  description: "The default bootstrap token generated by 'kubelet '."
  token-id: c8ad9c   # 注意：如果要修改bootstrap.secret.yaml的token-id和token-secret，需要保证下图红圈内的字符串一致的，并且位数是一样的。还要保证上个命令的黄色字体：c8ad9c.2e4d610cf3e7426e与你修改的字符串要一致
  token-secret: 2e4d610cf3e7426e
  usage-bootstrap-authentication: "true"
  usage-bootstrap-signing: "true"
  auth-extra-groups:  system:bootstrappers:default-node-token,system:bootstrappers:worker,system:bootstrappers:ingress
 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubelet-bootstrap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:node-bootstrapper
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:bootstrappers:default-node-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: node-autoapprove-bootstrap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:bootstrappers:default-node-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: node-autoapprove-certificate-rotation
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:nodes
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: system:kube-apiserver-to-kubelet
rules:
  - apiGroups:
      - ""
    resources:
      - nodes/proxy
      - nodes/stats
      - nodes/log
      - nodes/spec
      - nodes/metrics
    verbs:
      - "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:kube-apiserver
  namespace: ""
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:kube-apiserver-to-kubelet
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: kube-apiserver

在这里插入图片描述

在master（192.168.100.52）上

mkdir -p /root/.kube 
cp /etc/kubernetes/pki/admin.kubeconfig /root/.kube/config
kubectl create -f http://k8s-yaml.xuexi.com/k8s-v1-20-install/bootstrap/bootstrap.secret.yaml

Node节点配置

将master03的证书复制到Node节点

cd /etc/kubernetes/pki
for NODE in k8s-100-53 k8s-100-54 k8s-100-55 k8s-100-56; do
    ssh $NODE mkdir -p /etc/kubernetes/pki /etc/etcd/ssl 
    for FILE in etcd-ca.pem etcd-peer.pem etcd-peer-key.pem; do
        scp /etc/etcd/ssl/$FILE $NODE:/etc/etcd/ssl/
    done
    for FILE in ca.pem ca-key.pem front-proxy-ca.pem bootstrap-kubelet.kubeconfig; do
        scp /etc/kubernetes/pki/$FILE $NODE:/etc/kubernetes/pki/${FILE}
    done
done

kubelet配置

所有节点创建相关目录

mkdir -p /var/lib/kubelet /var/log/kubernetes /etc/systemd/system/kubelet.service.d /etc/kubernetes/manifests/

除了master节点，其余节点均配置kubelet service

vim  /usr/lib/systemd/system/kubelet.service

内容如下

[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/kubernetes/kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/kubelet

Restart=always
StartLimitInterval=0
RestartSec=10

[Install]
WantedBy=multi-user.target

给所有节点配置kubelet sevice的配置文件10-kubelet.conf

vim /etc/systemd/system/kubelet.service.d/10-kubelet.conf
# 内容如下
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/pki/bootstrap-kubelet.kubeconfig --kubeconfig=/etc/kubernetes/pki/kubelet.kubeconfig"
Environment="KUBELET_SYSTEM_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin"
Environment="KUBELET_CONFIG_ARGS=--config=/etc/kubernetes/kubelet-conf.yml --pod-infra-container-image=harbor.xuexi.com/public/pause:v3.2"   # 这里的pause容器是kubernetes的容器，主要是给同一个pod提供共享的网络、存储等资源的
Environment="KUBELET_EXTRA_ARGS=--node-labels=node.kubernetes.io/node='' "
ExecStart=
ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_SYSTEM_ARGS $KUBELET_EXTRA_ARGS

harbor.xuexi.com/public/pause:v3.2 # 这里的pause容器是kubernetes的容器，主要是给同一个pod提供共享的网络、存储等资源的，我是存入了自己的harbor中，需要自己下载并推送到harbor中

创建kubelet的配置文件

注意：如果更改了k8s的service网段，需要更改kubelet-conf.yml 的clusterDNS:配置，改成k8s Service网段的第十个地址，比如10.96.0.10

vim  /etc/kubernetes/kubelet-conf.yml

内容如下

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
port: 10250
readOnlyPort: 10255
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.pem
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
cgroupsPerQOS: true
clusterDNS:
- 10.96.0.10                    # 一般是Service网段的第十个地址
clusterDomain: cluster.local
containerLogMaxFiles: 5
containerLogMaxSize: 10Mi
contentType: application/vnd.kubernetes.protobuf
cpuCFSQuota: true
cpuManagerPolicy: none
cpuManagerReconcilePeriod: 10s
enableControllerAttachDetach: true
enableDebuggingHandlers: true
enforceNodeAllocatable:
- pods
eventBurst: 10
eventRecordQPS: 5
evictionHard:
  imagefs.available: 15%
  memory.available: 100Mi
  nodefs.available: 10%
  nodefs.inodesFree: 5%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: true
fileCheckFrequency: 20s
hairpinMode: promiscuous-bridge
healthzBindAddress: 127.0.0.1
healthzPort: 10248
httpCheckFrequency: 20s
imageGCHighThresholdPercent: 85
imageGCLowThresholdPercent: 80
imageMinimumGCAge: 2m0s
iptablesDropBit: 15
iptablesMasqueradeBit: 14
kubeAPIBurst: 10
kubeAPIQPS: 5
makeIPTablesUtilChains: true
maxOpenFiles: 1000000
maxPods: 110
nodeStatusUpdateFrequency: 10s
oomScoreAdj: -999
podPidsLimit: -1
registryBurst: 10
registryPullQPS: 5
resolvConf: /etc/resolv.conf
rotateCertificates: true
runtimeRequestTimeout: 2m0s
serializeImagePulls: true
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
volumeStatsAggPeriod: 1m0s

启动kubele

systemctl daemon-reload && systemctl enable --now kubelet

查看集群状态

kubectl get nodes

在这里插入图片描述

kube-proxy配置

在运维主机(192.168.100.50)上准备kube-proxy的文件

vim /data/k8s-yaml/k8s-v1-20-install/kube-proxy/kube-proxy.conf

内容如下

apiVersion: kubeproxy.config.k8s.io/v1alpha1
bindAddress: 0.0.0.0
clientConnection:
  acceptContentTypes: ""
  burst: 10
  contentType: application/vnd.kubernetes.protobuf
  kubeconfig: /etc/kubernetes/pki/kube-proxy.kubeconfig
  qps: 5
clusterCIDR: 10.244.0.0/16
configSyncPeriod: 15m0s
conntrack:
  max: null
  maxPerCore: 32768
  min: 131072
  tcpCloseWaitTimeout: 1h0m0s
  tcpEstablishedTimeout: 24h0m0s
enableProfiling: false
healthzBindAddress: 0.0.0.0:10256
hostnameOverride: ""
iptables:
  masqueradeAll: false
  masqueradeBit: 14
  minSyncPeriod: 0s
  syncPeriod: 30s
ipvs:
  masqueradeAll: true
  minSyncPeriod: 5s
  scheduler: "rr"
  syncPeriod: 30s
kind: KubeProxyConfiguration
metricsBindAddress: 127.0.0.1:10249
mode: "ipvs"
nodePortAddresses: null
oomScoreAdj: -999
portRange: ""
udpIdleTimeout: 250ms

vim /data/k8s-yaml/k8s-v1-20-install/kube-proxy/kube-proxy.yml

内容如下

apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-proxy
  namespace: kube-system
  labels:
    app: kube-proxy
data:
  config.conf: |-
    apiVersion: kubeproxy.config.k8s.io/v1alpha1
    kind: KubeProxyConfiguration
    bindAddress: 0.0.0.0
    clientConnection:
      acceptContentTypes: ""
      burst: 10
      contentType: application/vnd.kubernetes.protobuf
      kubeconfig: /var/lib/kube-proxy/kubeconfig.conf
      qps: 5
    clusterCIDR: 10.244.0.0/16
    configSyncPeriod: 15m0s
    conntrack:
      maxPerCore: 32768
      min: 131072
      tcpCloseWaitTimeout: 1h0m0s
      tcpEstablishedTimeout: 24h0m0s
    enableProfiling: false
    healthzBindAddress: 0.0.0.0:10256
    hostnameOverride: ""
    iptables:
      masqueradeAll: false
      masqueradeBit: 14
      minSyncPeriod: 0s
      syncPeriod: 30s
    ipvs:
      minSyncPeriod: 0s
      scheduler: rr
      syncPeriod: 30s
    metricsBindAddress: 127.0.0.1:10249
    mode: ipvs
    featureGates:
      SupportIPVSProxyMode: true
    oomScoreAdj: -999
    portRange: ""
    resourceContainer: /kube-proxy
    udpIdleTimeout: 250ms
  kubeconfig.conf: |-
    apiVersion: v1
    kind: Config
    clusters:
    - cluster:
        certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        server: {{KUBE_APISERVER}}
      name: default
    contexts:
    - context:
        cluster: default
        namespace: default
        user: default
      name: default
    current-context: default
    users:
    - name: default
      user:
        tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-proxy
  namespace: kube-system
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: system:kube-proxy
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
subjects:
  - kind: ServiceAccount
    name: kube-proxy
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: system:node-proxier
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  labels:
    k8s-app: kube-proxy
  name: kube-proxy
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: kube-proxy
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        k8s-app: kube-proxy
    spec:
      serviceAccount: kube-proxy
      serviceAccountName: kube-proxy
      priorityClassName: system-node-critical
      tolerations:
      - key: CriticalAddonsOnly
        operator: Exists
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
      - key: node.kubernetes.io/not-ready
        operator: Exists
        effect: NoSchedule
      hostNetwork: true
      containers:
      - name: kube-proxy
        image: harbor.xuexi.com/public/kube-proxy-amd64:v1.11.3   # 这里的镜像需要自己下载，我是放到了自己的harbor上
        command:
        - /usr/local/bin/kube-proxy
        - --config=/var/lib/kube-proxy/config.conf
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /var/lib/kube-proxy
          name: kube-proxy
        - mountPath: /run/xtables.lock
          name: xtables-lock
        - mountPath: /lib/modules
          name: lib-modules
          readOnly: true
      volumes:
      - configMap:
          defaultMode: 420
          name: kube-proxy
        name: kube-proxy
      - hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
        name: xtables-lock
      - hostPath:
          path: /lib/modules
          type: ""
        name: lib-modules

vim /data/k8s-yaml/k8s-v1-20-install/kube-proxy/kube-proxy.service

内容如下

[Unit]
Description=Kubernetes Kube Proxy
Documentation=https://github.com/kubernetes/kubernetes
After=network.target

[Service]
ExecStart=/usr/local/bin/kube-proxy \
  --config=/etc/kubernetes/kube-proxy.conf \
  --v=2

Restart=always
RestartSec=10s

[Install]
WantedBy=multi-user.target

在master（192.168.100.52）上操作

# 在kube-system名称空间中创建serviceaccount
kubectl -n kube-system create serviceaccount kube-proxy

# 创建clusterrolebinding
kubectl create clusterrolebinding system:kube-proxy --clusterrole system:node-proxier --serviceaccount kube-system:kube-proxy

# 空间变量
SECRET=$(kubectl -n kube-system get sa/kube-proxy --output=jsonpath='{.secrets[0].name}')
JWT_TOKEN=$(kubectl -n kube-system get secret/$SECRET --output=jsonpath='{.data.token}' | base64 -d)
PKI_DIR=/etc/kubernetes/pki
K8S_DIR=/etc/kubernetes/pki

# 常规操作
kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.pem --embed-certs=true --server=https://192.168.100.57:8443 --kubeconfig=${K8S_DIR}/kube-proxy.kubeconfig

kubectl config set-credentials kubernetes --token=${JWT_TOKEN} --kubeconfig=/etc/kubernetes/pki/kube-proxy.kubeconfig

kubectl config set-context kubernetes --cluster=kubernetes --user=kubernetes --kubeconfig=/etc/kubernetes/pki/kube-proxy.kubeconfig

kubectl config use-context kubernetes --kubeconfig=/etc/kubernetes/pki/kube-proxy.kubeconfig

所有节点下载kube-proxy的systemd Service文件

将kube-proxy.kubeconfig文件发送至所有节点用老方法

cd /etc/kubernetes/ && wget http://k8s-yaml.xuexi.com/k8s-v1-20-install/kube-proxy/kube-proxy.conf
cd /usr/lib/systemd/system/ && wget http://k8s-yaml.xuexi.com/k8s-v1-20-install/kube-proxy/kube-proxy.service

所有节点启动kube-proxy

systemctl daemon-reload && systemctl enable --now kube-proxy

Cloudpods

开源、云原生的融合云平台

更多推荐

面向未来的 IT 基础设施管理架构——融合云（Unified IaaS）

随着数字化时代的到来，IT系统已成为人类社会正常运转不可或缺的组成部分。不远的未来，智能制造，5G和人工智能等技术将成为推动生产力发展的重要引擎，人类社会将面临前所未有的全面彻底的数字化浪潮。IT基础设施作为IT系统运行的平台和载体，是实现数字化的基石。在这场数字化浪潮中，企业必须积极拥抱云计算技术，采用符合技术发展趋势、面向未来的IT基础构架，才能在未来的竞争中赢得先机。一、云计算历经十余年

Cloudpods

Cloudpods负载均衡的功能介绍

作者:周有松今天的内容会从以下几个方面展开：负载均衡产品简介。主要介绍负载均衡作为一个云上产品，它的功能模型是怎样的，日常使用中会遇到的业务词汇负载均衡的功能与典型应用场景。这部分主要结合业务词汇，对负载均衡服务中常见的一些功能选项进行介绍，并举例介绍一些典型的应用场景最后，我们做一下总结，讨论一下负载均衡产品相比传统方式的优点一、产品简介 1. 以NGINX为例提到负载均衡，我们以

Cloudpods

使用Linux vfio将Nvidia GPU透传给QEMU虚拟机

Linux 上虚拟机 GPU 透传需要使用 vfio 的方式。主要是因为在 vfio 方式下对虚拟设备的权限和 DMA 隔离上做的更好。但是这么做也有个缺点，这个物理设备在主机和其他虚拟机都不能使用了。 qemu 直接使用物理设备本身命令行是很简单的，关键在于事先在主机上对系统、内核和物理设备的一些配置。单纯从 qemu 的命令行来看，其实和普通虚拟机启动就差了最后那个-device的选项。这