K8S-Demo集群实践11：部署ipvs模式的kube-kubelet组件
- 一、创建和分发kubelet bootstrap kubeconfig文件
- 二、创建和分发kubelet的参数配置文件
- 三、创建和分发kubelet的systemd unit文件
- 四、启动kubelet服务
- 1、授予kube-apiserver访问kubelet API的权限
- 2、Bootstrap Token Auth 和授予权限
- 3、自动approve CSR请求，生成kubelet client证书
- 4、手动approve server cert csr
- 五、启动并检查kubelet服务的运行状态
- 1、启动kubelet服务
- 2、检查kubelet服务状态
- 3、kube-controller-manager为各node生成了kubeconfig文件和公私钥
- 4、查看节点状态
- 参考
- 附专栏链接
- kubelet运行在每个worker节点上，接收kube-apiserver发送的请求，管理Pod容器，执行交互式命令，如exec、run、logs等
- kubelet启动时自动向kube-apiserver注册节点信息，内置的cadvisor统计和监控节点的资源使用情况
一、创建和分发kubelet bootstrap kubeconfig文件
[root@master1 ~]# cd /opt/install/kubeconfig
[root@master1 kubeconfig]# for node_name in ${ALL_NAMES[@]}
do
echo ">>> ${node_name}"
# 创建 token
export BOOTSTRAP_TOKEN=$(kubeadm token create \
--description kubelet-bootstrap-token \
--groups system:bootstrappers:${node_name} \
--kubeconfig ~/.kube/config)
# 设置集群参数
kubectl config set-cluster k8s-demo \
--certificate-authority=/opt/install/cert/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
--token=${BOOTSTRAP_TOKEN} \
--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
# 设置上下文参数
kubectl config set-context default \
--cluster=k8s-demo \
--user=kubelet-bootstrap \
--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
# 设置默认上下文
kubectl config use-context default --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
done- 分发到所有节点 3Master+3Node，方便监控每个节点的资源利用率
[root@master1 ~]# cd /opt/install/kubeconfig
[root@master1 kubeconfig]# for node_name in ${ALL_NAMES[@]}
do
echo ">>> ${node_name}"
scp kubelet-bootstrap-${node_name}.kubeconfig root@${node_name}:/opt/k8s/etc//kubelet-bootstrap.kubeconfig
done二、创建和分发kubelet的参数配置文件
- 准备模板 kubelet-config.yaml.template
[root@master1 ~]# cd /opt/install/kubeconfig
[root@master1 kubeconfig]# cat > kubelet-config.yaml.template <<EOF
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: "##NODE_IP##"
staticPodPath: ""
syncFrequency: 1m
fileCheckFrequency: 20s
httpCheckFrequency: 20s
staticPodURL: ""
port: 10250
readOnlyPort: 0
rotateCertificates: true
serverTLSBootstrap: true
authentication:
anonymous:
enabled: false
webhook:
enabled: true
x509:
clientCAFile: "/opt/k8s/etc/cert/ca.pem"
authorization:
mode: Webhook
registryPullQPS: 0
registryBurst: 20
eventRecordQPS: 0
eventBurst: 20
enableDebuggingHandlers: true
enableContentionProfiling: true
healthzPort: 10248
healthzBindAddress: "##NODE_IP##"
clusterDomain: "${CLUSTER_DNS_DOMAIN}"
clusterDNS:
- "${CLUSTER_DNS_SVC_IP}"
nodeStatusUpdateFrequency: 10s
nodeStatusReportFrequency: 1m
imageMinimumGCAge: 2m
imageGCHighThresholdPercent: 85
imageGCLowThresholdPercent: 80
volumeStatsAggPeriod: 1m
kubeletCgroups: ""
systemCgroups: ""
cgroupRoot: ""
cgroupsPerQOS: true
cgroupDriver: cgroupfs
runtimeRequestTimeout: 10m
hairpinMode: promiscuous-bridge
maxPods: 220
podCIDR: "${CLUSTER_CIDR}"
podPidsLimit: -1
resolvConf: /etc/resolv.conf
maxOpenFiles: 1000000
kubeAPIQPS: 1000
kubeAPIBurst: 2000
serializeImagePulls: false
evictionHard:
memory.available: "100Mi"
nodefs.available: "10%"
nodefs.inodesFree: "5%"
imagefs.available: "15%"
evictionSoft: {}
enableControllerAttachDetach: true
failSwapOn: true
containerLogMaxSize: 20Mi
containerLogMaxFiles: 10
systemReserved: {}
kubeReserved: {}
systemReservedCgroup: ""
kubeReservedCgroup: ""
enforceNodeAllocatable: ["pods"]
EOF- ddress：kubelet安全端口（https，10250）监听的地址，不能为127.0.0.1，否则kube-apiserver、heapster等不能调用kubelet的API
- readOnlyPort=0：关闭只读端口(默认 10255)，等效为未指定
- authentication.anonymous.enabled：设置为false，不允许匿名访问10250端口
- authentication.x509.clientCAFile：指定签名客户端证书的CA证书，开启HTTP证书认证
- authentication.webhook.enabled=true：开启HTTPS bearer token认证
- 分发到所有节点
[root@master1 ~]# cd /opt/install/kubeconfig
[root@master1 kubeconfig]# for node_ip in ${ALL_IPS[@]}
do
echo ">>> ${node_ip}"
sed -e "s/##NODE_IP##/${node_ip}/" kubelet-config.yaml.template > kubelet-config-${node_ip}.yaml.template
scp kubelet-config-${node_ip}.yaml.template root@${node_ip}:/opt/k8s/etc/kubelet-config.yaml
done三、创建和分发kubelet的systemd unit文件
[root@master1 ~]# cd /opt/install/service
[root@master1 service]# cat > kubelet.service.template <<EOF
[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service
Requires=docker.service
[Service]
WorkingDirectory=${K8S_DIR}/kubelet
ExecStart=/opt/k8s/bin/kubelet \\
--allow-privileged=true \\
--bootstrap-kubeconfig=/opt/k8s/etc/kubelet-bootstrap.kubeconfig \\
--cert-dir=/etc/kubernetes/cert \\
--container-runtime=docker \\
--container-runtime-endpoint=unix:///var/run/dockershim.sock \\
--root-dir=${K8S_DIR}/kubelet \\
--kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\
--config=/etc/kubernetes/kubelet-config.yaml \\
--network-plugin=cni \\
--cni-bin-dir=/opt/k8s/bin \\
--cni-conf-dir=/etc/cni/net.d \\
--hostname-override=##NODE_NAME## \\
--pod-infra-container-image=harbor.demo/k8s/pause-amd64:3.1 \\
--image-pull-progress-deadline=15m \\
--volume-plugin-dir=${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/ \\
--logtostderr=true \\
--node-labels=node-role.kubernetes.io/##NODE_LABEL##= \\
--v=2
Restart=always
RestartSec=5
StartLimitInterval=0
[Install]
WantedBy=multi-user.target
EOF- –bootstrap-kubeconfig：指向bootstrap kubeconfig文件，kubelet使用该文件中的用户名和token向kube-apiserver发送TLS Bootstrapping请求
- k8s approve kubelet的csr请求后，在–cert-dir目录创建证书和私钥文件，然后写入–kubeconfig文件
- 拉取容器镜像 docker pull mirrorgooglecontainers/pause-amd64:3.1 并推送到私有仓库 harbor.demo/k8s/pause-amd64:3.1
[root@master1 ~]# cd /opt/install/service
[root@master1 service]# for node_name in ${ALL_NAMES[@]}
do
echo ">>> ${node_name}"
sed -e "s/##NODE_NAME##/${node_name}/" kubelet.service.template > kubelet-${node_name}.service
scp kubelet-${node_name}.service root@${node_name}:/etc/systemd/system/kubelet.service
done四、启动kubelet服务
1、授予kube-apiserver访问kubelet API的权限
[root@master1 ~]# kubectl create clusterrolebinding k8s-demo-apiserver-kubelet-apis --clusterrole=system:kubelet-api-admin --user k8s-demo-apiserver
clusterrolebinding.rbac.authorization.k8s.io/kube-apiserver:kubelet-apis created- 在执行kubectl exec、run、logs等命令时，apiserver会将请求转发到kubelet的https端口。这里定义RBAC规则，授权apiserver使用的证书（apiserver.pem）用户名
（CN：k8s-demo-apiserver）访问kubelet API的权限：
2、Bootstrap Token Auth 和授予权限
- kubelet启动时查找–kubeletconfig参数对应的文件是否存在，如果不存在则使用–bootstrap-kubeconfig指定的kubeconfig文件向kube-apiserver发送证书签名请求 (CSR)
- kube-apiserver收到CSR请求后，对其中的Token进行认证，认证通过后将请求的user设置为system:bootstrap:，group 设置为system:bootstrappers，这一过程称为Bootstrap Token Auth
- 默认情况下，这个user和group没有创建CSR的权限，kubelet启动失败，错误日志如下：
[root@master1 ~]# journalctl -u kubelet -a |grep -A 2 'certificatesigningrequests'
May 26 12:13:41 zhangjun-k8s-01 kubelet[128468]: I0526 12:13:41.798230 128468 certificate_manager.go:366] Rotating certificates
May 26 12:13:41 zhangjun-k8s-01 kubelet[128468]: E0526 12:13:41.801997 128468 certificate_manager.go:385] Failed while requesting
a signed certificate from the master: cannot create certificate signing request: certificatesigningrequests.certificates.k8s.io is forbidden:
User "system:bootstrap:82jfrm" cannot create resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope- 解决办法是：创建一个clusterrolebinding，将group system:bootstrappers和clusterrole system:node-bootstrapper绑定：
# kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --group=system:bootstrappers
clusterrolebinding.rbac.authorization.k8s.io/kubelet-bootstrap created3、自动approve CSR请求，生成kubelet client证书
- 创建三个ClusterRoleBinding，分别授予group system:bootstrappers和group system:nodes进行approve client、renew client、renew server证书的权限
[root@master1 ~]# cd /opt/install/yaml
[root@master1 yaml]# cat > csr-crb.yaml <<EOF
# Approve all CSRs for the group "system:bootstrappers"
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: auto-approve-csrs-for-group
subjects:
- kind: Group
name: system:bootstrappers
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
apiGroup: rbac.authorization.k8s.io
---
# To let a node of the group "system:nodes" renew its own credentials
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: node-client-cert-renewal
subjects:
- kind: Group
name: system:nodes
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
apiGroup: rbac.authorization.k8s.io
---
# A ClusterRole which instructs the CSR approver to approve a node requesting a
# serving cert matching its client cert.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: approve-node-server-renewal-csr
rules:
- apiGroups: ["certificates.k8s.io"]
resources: ["certificatesigningrequests/selfnodeserver"]
verbs: ["create"]
---
# To let a node of the group "system:nodes" renew its own server credentials
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: node-server-cert-renewal
subjects:
- kind: Group
name: system:nodes
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: approve-node-server-renewal-csr
apiGroup: rbac.authorization.k8s.io
EOF
[root@master1 yaml]# kubectl apply -f csr-crb.yaml
clusterrolebinding.rbac.authorization.k8s.io/auto-approve-csrs-for-group created
clusterrolebinding.rbac.authorization.k8s.io/node-client-cert-renewal created
clusterrole.rbac.authorization.k8s.io/approve-node-server-renewal-csr created
clusterrolebinding.rbac.authorization.k8s.io/node-server-cert-renewal created- auto-approve-csrs-for-group：自动approve node的第一次CSR；注意第一次CSR时，请求的Group为system:bootstrappers
- node-client-cert-renewal：自动approve node后续过期的client证书，自动生成的证书Group为system:nodes
- node-server-cert-renewal：自动approve node后续过期的server证书，自动生成的证书Group为system:nodes
4、手动approve server cert csr
-CSR approving controllers不会自动approve kubelet server证书签名请求，需要手动 approve
[root@node1 ~]# kubectl get csr | grep Pending | awk '{print $1}' | xargs kubectl certificate approve
[root@node1 ~]# kubectl get csr
NAME AGE SIGNERNAME REQUESTOR CONDITION
csr-ff2w8 5m18s kubernetes.io/kubelet-serving system:node:node1 Approved,Issued
csr-fqhnw 5m19s kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:j5xo8k Approved,Issued
csr-jdxg4 5m18s kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:h9da08 Approved,Issued
csr-llp6t 5m17s kubernetes.io/kubelet-serving system:node:node3 Approved,Issued
csr-lndkt 5m17s kubernetes.io/kubelet-serving system:node:node2 Approved,Issued
csr-wp7lj 5m19s kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:j1g5ao Approved,Issued五、启动并检查kubelet服务的运行状态
1、启动kubelet服务
[root@master1 ~]# for node_ip in ${ALL_IPS[@]}
do
echo ">>> ${node_ip}"
ssh root@${node_ip} "/usr/sbin/swapoff -a"
ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kubelet && systemctl restart kubelet"
done- 启动服务前必须先创建工作目录
- 关闭swap分区，否则kubelet会启动失败
2、检查kubelet服务状态
[root@master1 ~]# kubectl get csr
NAME AGE SIGNERNAME REQUESTOR CONDITION
csr-67krs 60m kubernetes.io/kubelet-serving system:node:node1 Approved,Issued
csr-hsp9x 59m kubernetes.io/kubelet-serving system:node:node2 Approved,Issued
csr-pjgt2 59m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:go9xnb Approved,Issued
csr-qqlsp 60m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:nfqm3q Approved,Issued
csr-t4nnl 59m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:rjhm7f Approved,Issued
csr-zrj2g 59m kubernetes.io/kubelet-serving system:node:node3 Approved,Issued
[root@master1 ~]# kubectl get node -o wide
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
node1 Ready <none> 93d v1.18.5 192.168.66.13 <none> CentOS Linux 7 (Core) 4.4.231-1.el7.elrepo.x86_64 docker://18.6.3
node2 Ready <none> 93d v1.18.5 192.168.66.14 <none> CentOS Linux 7 (Core) 4.4.231-1.el7.elrepo.x86_64 docker://18.6.3
node3 Ready <none> 93d v1.18.5 192.168.66.15 <none> CentOS Linux 7 (Core) 4.4.231-1.el7.elrepo.x86_64 docker://18.6.3- Pending的CSR用于创建kubelet server证书，需要手动approve
- 这里如果看不到信息，显示No Resources Found，可能以前有以前认证过的配置残留，尝试删除/opt/k8s/etc/kubelet-bootstrap.kubeconfig文件后，重启kubelet即可
3、kube-controller-manager为各node生成了kubeconfig文件和公私钥
[root@node1 ~]# ls -l /opt/k8s/etc/kubelet.kubeconfig
-rw------- 1 root root 2246 Feb 7 15:38 /opt/k8s/etc/kubelet.kubeconfig
[root@node1 ~]# ls -l /opt/k8s/etc/cert/kubelet-*
-rw------- 1 root root 1228 Jul 19 11:41 kubelet-client-2020-07-19-11-41-44.pem
lrwxrwxrwx 1 root root 59 Jul 19 11:41 kubelet-client-current.pem -> /etc/kubernetes/cert/kubelet-client-2020-07-19-11-41-44.pem
-rw------- 1 root root 1261 Jul 19 11:46 kubelet-server-2020-07-19-11-46-58.pem
lrwxrwxrwx 1 root root 59 Jul 19 11:46 kubelet-server-current.pem -> /etc/kubernetes/cert/kubelet-server-2020-07-19-11-46-58.pem4、查看节点状态
[root@node1 ~]# kubectl get csr | grep Pending | awk '{print $1}' | xargs kubectl certificate approve
[root@node1 ~]# kubectl get csr
NAME AGE SIGNERNAME REQUESTOR CONDITION
csr-ff2w8 5m18s kubernetes.io/kubelet-serving system:node:node1 Approved,Issued
csr-fqhnw 5m19s kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:j5xo8k Approved,Issued
csr-jdxg4 5m18s kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:h9da08 Approved,Issued
csr-llp6t 5m17s kubernetes.io/kubelet-serving system:node:node3 Approved,Issued
csr-lndkt 5m17s kubernetes.io/kubelet-serving system:node:node2 Approved,Issued
csr-wp7lj 5m19s kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:j1g5ao Approved,Issued- 在master节点部署 kubelet 和 kube-proxy，并且不允许调度Pod到Master节点
[root@node1 ~]# kubectl taint nodes master1 node-role.kubernetes.io/master=:NoSchedule
[root@node1 ~]# kubectl taint nodes master2 node-role.kubernetes.io/master=:NoSchedule
[root@node1 ~]# kubectl taint nodes master3 node-role.kubernetes.io/master=:NoSchedule- Taints 污点选项有
- NoSchedule: 一定不能被调度
- PreferNoSchedule: 尽量不要调度
- NoExecute: 不仅不会调度, 还会驱逐Node上已有的Pod
- 先用起来，通过操作实践认识k8s，积累多了自然就理解了
- 把理解的知识分享出来，自造福田，自得福缘
- 追求简单，容易使人理解，知识的上下文也是知识的一部分，例如版本，时间等
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
