kubernetes 1.20.7 二进制安装-kubelet安装(十)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# master节点执行
# 远程创建目录，创建manifests的目的是预留一个静态pod目录，目前暂时还用不到。
for i in {201..203};do ssh 172.17.20.$i mkdir /etc/kubernetes/{manifests,pki} /etc/kubernetes/pki/ca -p ;done
for i in {210..212};do ssh 172.17.20.$i mkdir /etc/kubernetes/{manifests,pki} /etc/kubernetes/pki/ca -p ;done

# 复制CA根证书
for i in {210..212};do scp /etc/kubernetes/pki/ca/ca.pem 172.17.20.$i:/etc/kubernetes/pki/ca/ ;done

# 安装kubelet
for i in {201..203};do scp /server/packages/kubernetes/server/bin/kubelet root@172.17.20.$i:/usr/local/bin/kubelet ;done
for i in {210..212};do scp /server/packages/kubernetes/server/bin/kubelet root@172.17.20.$i:/usr/local/bin/kubelet ;done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 设置集群信息
kubectl config set-cluster kubernetes --kubeconfig=kubelet-bootstrap.conf --server=https://172.17.20.200:6443 --certificate-authority=/etc/kubernetes/pki/ca/ca.pem --embed-certs=true

# 设置用户信息，之前用的是证书，现在这里用的是token(这个token我们后面只赋予他创建csr请求的权限)，kubelet的证书我们交给apiserver来管理
kubectl config set-credentials kubelet-bootstrap --kubeconfig=kubelet-bootstrap.conf --token=`sed 's#,.*##' /etc/kubernetes/token.csv`

# 设置上下文信息
kubectl config set-context kubernetes --kubeconfig=kubelet-bootstrap.conf --cluster=kubernetes --user=kubelet-bootstrap

# 设置默认上下文
kubectl config use-context kubernetes --kubeconfig=kubelet-bootstrap.conf

# 分发到node节点
# 我这里master节点也作为node节点使用
for i in {202..203};do scp /etc/kubernetes/kubelet-bootstrap.conf 172.17.20.$i:/etc/kubernetes/ ;done

for i in {210..212};do scp /etc/kubernetes/kubelet-bootstrap.conf 172.17.20.$i:/etc/kubernetes/ ;done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: create-csrs-for-bootstrapping
subjects:
- kind: Group
  name: system:bootstrappers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: system:node-bootstrapper
  apiGroup: rbac.authorization.k8s.io
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kube-apiserver-kubelet-apis-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:kubelet-api-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: kubernetes
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

cat > /etc/kubernetes/kubelet.yaml <<EOF
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
enableServer: true
staticPodPath: /etc/kubernetes/manifests
syncFrequency: 1m
fileCheckFrequency: 20s
address: 0.0.0.0
port: 10250
readOnlyPort: 0
rotateCertificates: true
serverTLSBootstrap: true
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca/ca.pem
authorization:
  mode: Webhook
healthzPort: 10248
healthzBindAddress: 0.0.0.0
clusterDomain: cluster.local
clusterDNS: 
  # 配置这个为预留，后期部署core-dns将使用这个地址
  - 10.1.0.10
nodeStatusUpdateFrequency: 10s
nodeStatusReportFrequency: 1m
imageMinimumGCAge: 2m
imageGCHighThresholdPercent: 80
imageGCLowThresholdPercent: 75
volumeStatsAggPeriod: 1m
cgroupDriver: systemd
runtimeRequestTimeout: 2m
maxPods: 200
kubeAPIQPS: 5
kubeAPIBurst: 10
serializeImagePulls: false
evictionHard:
  memory.available: "100Mi"
  nodefs.available: "10%"
  nodefs.inodesFree: "5%"
  imagefs.available: "15%"
containerLogMaxSize: 10Mi
containerLogMaxFiles: 8
EOF


# 分发到其他节点
for i in {202..203};do scp /etc/kubernetes/kubelet.yaml 172.17.20.$i:/etc/kubernetes/ ;done

for i in {210..212};do scp /etc/kubernetes/kubelet.yaml 172.17.20.$i:/etc/kubernetes/ ;done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

cat > /etc/systemd/system/kubelet.service <<EOF
[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/kubelet \\
  --bootstrap-kubeconfig=/etc/kubernetes/kubelet-bootstrap.conf \\
  --cert-dir=/etc/kubernetes/pki/ \\
  --config=/etc/kubernetes/kubelet.yaml \\
  --container-runtime=docker \\
  --network-plugin=cni \\
  --cni-bin-dir=/opt/cni/bin/ \\
  --hostname-override=172.17.20.201 \\
  --kubeconfig=/etc/kubernetes/kubelet.conf \\
  --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.2 \\
  --alsologtostderr=true \\
  --logtostderr=false \\
  --log-file=/var/log/kubelet.log \\
  --log-file-max-size=100 \\
  --v=2
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# master节点执行
cat <<EOF | kubectl apply -f -
# 自动批准"system:bootstrappers"组的所有CSR
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: auto-approve-csrs-for-group
subjects:
- kind: Group
  name: system:bootstrappers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
  apiGroup: rbac.authorization.k8s.io
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# master节点执行
cat <<EOF | kubectl apply -f -
# 自动批准"system:nodes"组的CSR续约请求
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: auto-approve-renewals-for-nodes
subjects:
- kind: Group
  name: system:nodes
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
  apiGroup: rbac.authorization.k8s.io
EOF

1
2
3

# 所有node节点执行
systemctl start kubelet
systemctl enable kubelet