标签：Node opt kubernetes kubelet 部署 kubeconfig -- docker k8s

部署k8s Node

1.移动kubelet bin文件

cp kubelet /opt/kubernetes/bin
scp kubelet root@192.168.201.129:/opt/kubernetes/bin
scp kubelet root@192.168.201.130:/opt/kubernetes/bin

2.创建kubelet kubeconfig文件

kubectl config set-cluster kubernetes --certificate-authority=/opt/kubernetes/ssl/ca.pem --embed-certs=true --server=https://192.168.201.128:6443 --kubeconfig=kubelet-bootstrap.kubeconfig

# token 为 token.csv文件中的token
kubectl config set-credentials kubelet-bootstrap --token=7170af4e8962c07460b5dfbbeab0b7fc --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl config set-context default --cluster=kubernetes --user=kubelet-bootstrap --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl config use-context default --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

scp kubelet-bootstrap.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg
scp kubelet-bootstrap.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg

3.创建kubelet配置文件

vi kubelet.json

# # 如果docker的驱动为systemd，cgroupDriver处修改为systemd。此处设置很重要，否则后面node节点无法加入到集群
{
  "kind": "KubeletConfiguration",
  "apiVersion": "kubelet.config.k8s.io/v1beta1",
  "authentication": {
    "x509": {
      "clientCAFile": "/opt/kubernetes/ssl/ca.pem"
    },
    "webhook": {
      "enabled": true,
      "cacheTTL": "2m0s"
    },
    "anonymous": {
      "enabled": false
    }
  },
  "authorization": {
    "mode": "Webhook",
    "webhook": {
      "cacheAuthorizedTTL": "5m0s",
      "cacheUnauthorizedTTL": "30s"
    }
  },
  "address": "192.168.201.128",
  "port": 10250,
  "readOnlyPort": 10255,
  "cgroupDriver": "cgroupfs",                     
  "hairpinMode": "promiscuous-bridge",
  "serializeImagePulls": false,
  "featureGates": {
    "RotateKubeletClientCertificate": true,
    "RotateKubeletServerCertificate": true
  },
  "clusterDomain": "cluster.local.",
  "clusterDNS": ["10.255.0.1"]
}

scp kubelet.json root@192.168.201.129:/opt/kubernetes/cfg
scp kubelet.json root@192.168.201.130:/opt/kubernetes/cfg

4.创建kubelet启动文件

vi /usr/lib/systemd/system/kubelet.service

[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/kubernetes/kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/opt/kubernetes/bin/kubelet \
  --bootstrap-kubeconfig=/opt/kubernetes/cfg/kubelet-bootstrap.kubeconfig \
  --cert-dir=/opt/kubernetes/ssl \
  --kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \
  --config=/opt/kubernetes/cfg/kubelet.json \
  --network-plugin=cni \
  --pod-infra-container-image=k8s.gcr.io/pause:3.2 \
  --alsologtostderr=true \
  --logtostderr=false \
  --log-dir=/var/log/kubernetes \
  --v=2
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

–hostname-override：显示名称，集群中唯一
–network-plugin：启用CNI
–kubeconfig：空路径，会自动生成，后面用于连接apiserver
–bootstrap-kubeconfig：首次启动向apiserver申请证书
–config：配置参数文件
–cert-dir：kubelet证书生成目录
–pod-infra-container-image：管理Pod网络容器的镜像

scp /usr/lib/systemd/system/kubelet.service root@192.168.201.129:/usr/lib/systemd/system
scp /usr/lib/systemd/system/kubelet.service root@192.168.201.130:/usr/lib/systemd/system

5.配置docker

# 配置镜像源
vi /etc/docker/daemon.json

{
    "exec-opts": ["native.cgroupdriver=systemd"],
    "registry-mirrors": [
        "https://1nj0zren.mirror.aliyuncs.com",
        "https://kfwkfulq.mirror.aliyuncs.com",
        "https://2lqq34jg.mirror.aliyuncs.com",
        "https://pee6w651.mirror.aliyuncs.com",
        "http://hub-mirror.c.163.com",
        "https://docker.mirrors.ustc.edu.cn",
        "http://f1361db2.m.daocloud.io",
        "https://registry.docker-cn.com"
    ]
}

systemctl restart docker

# 根据结果修改kubelet.json中的cgroupDriver字段
docker info | grep "Cgroup Driver"

# 配置依赖镜像
docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2 k8s.gcr.io/pause:3.2
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2

docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0 k8s.gcr.io/coredns:1.7.0
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0

6.启动kubelet

swapoff -a

systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet
systemctl status kubelet

7.node节点申请证书及处理

kubectl get csr

# 同意node节点申请
kubectl certificate approve node-csr-5HUR2owmeLoopO_z2dFoQuax7ZkHeyEpB4_ZQI9xKg4

kubectl certificate approve node-csr-8hOsOouGK0elW7U9cc9AKF3iHDu0XJDQrqKeg_b6ftw

kubectl certificate approve node-csr-i3f0Zblr-c9Fn--OoRBTxZt_4W6y9CrL-UjKWDqo71k

标签：Node,opt,kubernetes,kubelet,部署,kubeconfig,--,docker,k8s
来源： https://blog.csdn.net/weixin_41083358/article/details/114359890

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。