部署Kubernetes Proxy
vim CentOS-Base.repo
[base] name=CentOS-$releasever - Base #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/ gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
wget http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-7-11.noarch.rpm
rpm -ivh epel-release-7-11.noarch.rpm
1.配置kube-proxy使用LVS [root@k8snode1 ~]# yum install -y ipvsadm ipset conntrack
[root@k8smaster opt]# cd /usr/local/src/ssl/ [root@k8smaster ssl]# vim kube-proxy-csr.json
{ "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ] }
3.生成证书
[root@k8smaster ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem
-ca-key=/opt/kubernetes/ssl/ca-key.pem
-config=/opt/kubernetes/ssl/ca-config.json
-profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
4.分发证书到所有节点
[root@k8smaster ssl]# cp kube-proxy*.pem /opt/kubernetes/ssl/
[root@k8smaster ssl]# scp kube-proxy*.pem k8snode1:/opt/kubernetes/ssl/
[root@k8smaster ssl]# scp kube-proxy*.pem k8snode2:/opt/kubernetes/ssl/
5.创建kube-proxy配置文件
[root@k8smaster ssl]# kubectl config set-cluster kubernetes
--certificate-authority=/opt/kubernetes/ssl/ca.pem
--embed-certs=true
--server=https://192.168.137.171:6443
--kubeconfig=kube-proxy.kubeconfig
[root@k8smaster ssl]# kubectl config set-credentials kube-proxy
--client-certificate=/opt/kubernetes/ssl/kube-proxy.pem
--client-key=/opt/kubernetes/ssl/kube-proxy-key.pem
--embed-certs=true
--kubeconfig=kube-proxy.kubeconfig
User "kube-proxy" set.
[root@k8smaster ssl]# kubectl config set-context default
--cluster=kubernetes
--user=kube-proxy
--kubeconfig=kube-proxy.kubeconfig
Context "default" created.
[root@k8smaster ssl]# kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig Switched to context "default".
6.分发kubeconfig配置文件 [root@k8smaster ssl]# cp kube-proxy.kubeconfig /opt/kubernetes/cfg/ [root@k8smaster ssl]# scp kube-proxy.kubeconfig k8snode1:/opt/kubernetes/cfg/ [root@k8smaster ssl]# scp kube-proxy.kubeconfig k8snode2:/opt/kubernetes/cfg/
7.创建kube-proxy服务配置(node节点) [root@k8snode1 ~]# mkdir /var/lib/kube-proxy [root@k8snode1 ~]# vim /usr/lib/systemd/system/kube-proxy.service
[Unit] Description=Kubernetes Kube-Proxy Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
WorkingDirectory=/var/lib/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy
--bind-address=192.168.137.201
--hostname-override=192.168.137.201
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig
--masquerade-all
--feature-gates=SupportIPVSProxyMode=true
--proxy-mode=ipvs
--ipvs-min-sync-period=5s
--ipvs-sync-period=5s
--ipvs-scheduler=rr
--logtostderr=true
--v=2
--logtostderr=false
--log-dir=/opt/kubernetes/log
Restart=on-failure RestartSec=5 LimitNOFILE=65536
[Install] WantedBy=multi-user.target
9.查看服务状态 查看kube-proxy服务状态 [root@k8snode1 ~]# systemctl daemon-reload [root@k8snode1 ~]# systemctl enable kube-proxy [root@k8snode1 ~]# systemctl start kube-proxy [root@k8snode1 ~]# systemctl status kube-proxy
在node节点查看LVS状态
[root@k8snode1 ~]# ipvsadm -L -n
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.137.201:33246 rr
TCP 192.168.137.215:33246 rr
TCP 10.1.0.1:443 rr persistent 10800
-> 192.168.137.171:6443 Masq 1 0 0
TCP 10.1.0.2:53 rr
TCP 10.1.72.67:443 rr
TCP 10.1.233.95:80 rr
TCP 127.0.0.1:33246 rr
TCP 172.17.0.1:33246 rr
UDP 10.1.0.2:53 rr
master节点查看 node状态 [root@k8smaster ~]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8snode1 Ready <none> 1h v1.10.1 k8snode2 Ready <none> 1h v1.10.1