node 节点部署

部署 kubelet 组件

解压node节点压缩包，并将其中的二进制文件发送到指定位置

 tar -zxvf kubernetes-node-linux-amd64.tar.gz
 mkdir /k8s/node/{bin,ssl,config} -p
 cd kubernetes/node/bin/
 cp kubelet kube-proxy /k8s/node/bin/

创建 配置文件

• 创建 kubelet bootstrapping.kubeconfig 文件 设置集群参数（server是api地址）

./kubectl config set-cluster kubernetes \
    --certificate-authority=/k8s/node/ssl/ca.pem \
    --embed-certs=true \
    --server=https://192.168.1.250:6443 \
    --kubeconfig=bootstrap.kubeconfig

• 设置客户端认证参数(token便是之前master生成的)

./kubectl config set-credentials kubelet-bootstrap \
  --token=1aef0e8e0b24943e3b86db2d01afcc15 \
  --kubeconfig=bootstrap.kubeconfig

• 设置上下文参数

./kubectl config set-context default \
  --cluster=kubernetes \
  --user=kubelet-bootstrap \
  --kubeconfig=bootstrap.kubeconfig

• 设置默认上下文

./kubectl config use-context default --kubeconfig=bootstrap.kubeconfig

• 将bootstrap kubeconfig 文件拷贝到所有 nodes节点

cp bootstrap.kubeconfig  /k8s/node/config/
scp bootstrap.kubeconfig  192.168.1.252:/k8s/node/config/

• 创建 kubelet 参数配置模板文件

vi /k8s/node/config/kubelet.config
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 192.168.1.251
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS: ["10.0.0.2"]
clusterDomain: cluster.local.
failSwapOn: false
authentication:
  anonymous:
    enabled: true

创建 unit 文件

• 创建kubelet配置文件

vi /k8s/node/config/kubelet

KUBELET_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=192.168.1.251 \
--kubeconfig=/k8s/node/config/kubelet.kubeconfig \
--bootstrap-kubeconfig=/k8s/node/config/bootstrap.kubeconfig \
--config=/k8s/node/config/kubelet.config \
--cert-dir=/k8s/node/ssl \
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"

创建应用

vi /usr/lib/systemd/system/kubelet.service 

[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=/k8s/node/config/kubelet
ExecStart=/k8s/node/bin/kubelet $KUBELET_OPTS
Restart=on-failure
KillMode=process

[Install]
WantedBy=multi-user.target

绑定角色(master节点运行)

./kubectl create clusterrolebinding kubelet-bootstrap \
  --clusterrole=system:node-bootstrapper \
  --user=kubelet-bootstrap

启动服务

systemctl daemon-reload
systemctl enable kubelet
systemctl restart kubelet

验证成功状态

systemctl status kubelet

查看csr请求 注意是在master上执行

可以看到有一个未批准的证书

[root@node9 bin]#  kubectl get csr
NAME                                                   AGE   REQUESTOR           CONDITION
node-csr-8kntaktl8b6rd8gkRsnTI0x9JPEQTbSqD2mCqiDNbmc   18m   kubelet-bootstrap   Pending

复制文件到另一节点并修改ip

 cd /k8s/node/
 scp -r  *  192.168.1.252:/k8s/node/
 scp /usr/lib/systemd/system/kubelet.service  192.168.1.252:/usr/lib/systemd/system/kubelet.service 

批准kubelet的TLS证书请求

再次查看csr请求可以看到两个节点都存在了

执行批准命令

kubectl get csr|grep 'Pending' | awk 'NR>0{print $1}'| xargs kubectl certificate approve
kubectl get csr

可以看到两个节点状态是批准的了

可以为某一节点设置角色

##master 角色
kubectl label node 192.168.1.250  node-role.kubernetes.io/master='master'
kubectl label node 192.168.1.251   node-role.kubernetes.io/node='node'
kubectl label node 192.168.1.252  node-role.kubernetes.io/node='node'
##删除某一个
kubectl label node/192.168.1.252  node-role.kubernetes.io/node-

部署 kube-proxy 组件

生成证书

• 创建kube-proxy证书

 cat << EOF | tee kube-proxy-csr.json
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "beijing",
      "ST": "beijing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=/k8s/node/ssl/ca.pem \
   -ca-key=/k8s/node/ssl/ca-key.pem \
   -config=/home/sslTools/ssl/ca-config.json \
   -profile=k8s  kube-proxy-csr.json | cfssljson -bare kube-proxy

 cp kube-proxy* /k8s/node/ssl/

安装LVS

yum install -y ipvsadm ipset conntrack

创建 kube-proxy 配置文件

# 创建kube-proxy kubeconfig文件
 
/home/k8stools/kubernetes/node/bin/kubectl config set-cluster kubernetes \
  --certificate-authority=/k8s/node/ssl/ca.pem \
  --embed-certs=true \
  --server=https://192.168.1.250:6443 \
  --kubeconfig=kube-proxy.kubeconfig

/home/k8stools/kubernetes/node/bin/kubectl config set-credentials kube-proxy \
  --client-certificate=/k8s/node/ssl/kube-proxy.pem \
  --client-key=/k8s/node/ssl/kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-proxy.kubeconfig

/home/k8stools/kubernetes/node/bin/kubectl config set-context default \
  --cluster=kubernetes \
  --user=kube-proxy \
  --kubeconfig=kube-proxy.kubeconfig

/home/k8stools/kubernetes/node/bin/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

 cp kube-proxy* /k8s/node/ssl/
 cp kube-proxy.kubeconfig  /k8s/node/config/

配置文件创建

vi /k8s/node/config/kube-proxy

KUBE_PROXY_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=192.168.1.251 \
--cluster-cidr=10.0.0.0/24 \
--kubeconfig=/k8s/node/config/kube-proxy.kubeconfig"

创建kube-proxy systemd unit 文件

vi /usr/lib/systemd/system/kube-proxy.service 

[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
EnvironmentFile=-/k8s/node/config/kube-proxy
ExecStart=/k8s/node/bin/kube-proxy $KUBE_PROXY_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target

启动服务

systemctl daemon-reload
systemctl enable kube-proxy
systemctl restart kube-proxy

验证状态

systemctl status kube-proxy

ok,将所需文件传输到另一节点上同样方式启动验证。注意更改 /k8s/node/config/kube-proxy 文件的hostname-override 属性

---

至此，node节点全部配置结束