部署Kubernetes Proxy

vim CentOS-Base.repo

[base] name=CentOS-$releasever - Base #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/ gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-7-11.noarch.rpm

rpm -ivh epel-release-7-11.noarch.rpm

1.配置kube-proxy使用LVS [root@k8snode1 ~]# yum install -y ipvsadm ipset conntrack

[root@k8smaster opt]# cd /usr/local/src/ssl/ [root@k8smaster ssl]# vim kube-proxy-csr.json

{ "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ] }

3.生成证书 [root@k8smaster ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem
-ca-key=/opt/kubernetes/ssl/ca-key.pem
-config=/opt/kubernetes/ssl/ca-config.json
-profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

4.分发证书到所有节点 [root@k8smaster ssl]# cp kube-proxy*.pem /opt/kubernetes/ssl/ [root@k8smaster ssl]# scp kube-proxy*.pem k8snode1:/opt/kubernetes/ssl/
[root@k8smaster ssl]# scp kube-proxy*.pem k8snode2:/opt/kubernetes/ssl/

5.创建kube-proxy配置文件 [root@k8smaster ssl]# kubectl config set-cluster kubernetes
--certificate-authority=/opt/kubernetes/ssl/ca.pem
--embed-certs=true
--server=https://192.168.137.171:6443
--kubeconfig=kube-proxy.kubeconfig

[root@k8smaster ssl]# kubectl config set-credentials kube-proxy
--client-certificate=/opt/kubernetes/ssl/kube-proxy.pem
--client-key=/opt/kubernetes/ssl/kube-proxy-key.pem
--embed-certs=true
--kubeconfig=kube-proxy.kubeconfig User "kube-proxy" set.

[root@k8smaster ssl]# kubectl config set-context default
--cluster=kubernetes
--user=kube-proxy
--kubeconfig=kube-proxy.kubeconfig Context "default" created.

[root@k8smaster ssl]# kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig Switched to context "default".

6.分发kubeconfig配置文件 [root@k8smaster ssl]# cp kube-proxy.kubeconfig /opt/kubernetes/cfg/ [root@k8smaster ssl]# scp kube-proxy.kubeconfig k8snode1:/opt/kubernetes/cfg/ [root@k8smaster ssl]# scp kube-proxy.kubeconfig k8snode2:/opt/kubernetes/cfg/

7.创建kube-proxy服务配置（node节点） [root@k8snode1 ~]# mkdir /var/lib/kube-proxy [root@k8snode1 ~]# vim /usr/lib/systemd/system/kube-proxy.service

[Unit] Description=Kubernetes Kube-Proxy Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service] WorkingDirectory=/var/lib/kube-proxy ExecStart=/opt/kubernetes/bin/kube-proxy
--bind-address=192.168.137.201
--hostname-override=192.168.137.201
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig
--masquerade-all
--feature-gates=SupportIPVSProxyMode=true
--proxy-mode=ipvs
--ipvs-min-sync-period=5s
--ipvs-sync-period=5s
--ipvs-scheduler=rr
--logtostderr=true
--v=2
--logtostderr=false
--log-dir=/opt/kubernetes/log

Restart=on-failure RestartSec=5 LimitNOFILE=65536

[Install] WantedBy=multi-user.target

9.查看服务状态 查看kube-proxy服务状态 [root@k8snode1 ~]# systemctl daemon-reload [root@k8snode1 ~]# systemctl enable kube-proxy [root@k8snode1 ~]# systemctl start kube-proxy [root@k8snode1 ~]# systemctl status kube-proxy

在node节点查看LVS状态 [root@k8snode1 ~]# ipvsadm -L -n IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn TCP 192.168.137.201:33246 rr TCP 192.168.137.215:33246 rr TCP 10.1.0.1:443 rr persistent 10800 -> 192.168.137.171:6443 Masq 1 0 0
TCP 10.1.0.2:53 rr TCP 10.1.72.67:443 rr TCP 10.1.233.95:80 rr TCP 127.0.0.1:33246 rr TCP 172.17.0.1:33246 rr UDP 10.1.0.2:53 rr

master节点查看 node状态 [root@k8smaster ~]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8snode1 Ready <none> 1h v1.10.1 k8snode2 Ready <none> 1h v1.10.1