Kubernetes集群部署2
1.配置并启用 etcd 集群 A. 配置启动项并将启动项分发至其他节点 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 #vim/usr/lib/systemd/system/etcd.service [Unit] Description=etcd After=network.target After=network-online.target Wants=network-online.target Documentation= [Service] Type=notify WorkingDirectory= /var/lib/etcd EnvironmentFile=- /etc/etcd/etcd .conf ExecStart= /usr/bin/etcd --config- file /etc/etcd/etcd .conf Restart=on-failure RestartSec=5 LimitNOFILE=65536 [Install] WantedBy=multi-user.target #ansiblenode-mcopy-a'src=/usr/lib/systemd/system/etcd.servicedest=/usr/lib/systemd/system/' B.指定 etcd 的工作目录和数据目录 1 2 3 #mkdir-p/var/lib/etcd/&&mkdir-p/etc/etcd #ansiblenode-mfile-a'path=/var/lib/etcdstate=directory' #ansiblenode-mfile-a'path=/etc/etcdstate=directory' C. 配置 etcd.conf 配置文件并分发至其他节点 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 #exportETCD_NAME=etcd1 #exportINTERNAL_IP=192.168.100.102 #cat<<EOF>etcd.conf name: '${ETCD_NAME}' data- dir : "/var/lib/etcd/" listen-peer-urls:https: // ${INTERNAL_IP}:2380 listen-client-urls:https: // ${INTERNAL_IP}:2379,https: //127 .0.0.1:2379 initial-advertise-peer-urls:https: // ${INTERNAL_IP}:2380 advertise-client-urls:https: // ${INTERNAL_IP}:2379 initial-cluster: "etcd1=https://192.168.100.102:2380,etcd2=https://192.168.100.103:2380,etcd3=https://192.168.100.104:2380" initial-cluster-token: 'etcd-cluster' #初始化集群状态('new'or'existing'). initial-cluster-state: 'new' client-transport-security: cert- file : /etc/kubernetes/ssl/etcd .pem key- file : /etc/kubernetes/ssl/etcd-key .pem trusted-ca- file : /etc/kubernetes/ssl/ca .pem peer-transport-security: cert- file : /etc/kubernetes/ssl/etcd .pem key- file : /etc/kubernetes/ssl/etcd-key .pem trusted-ca- file : /etc/kubernetes/ssl/ca .pem EOF #mvetcd.conf/etc/etcd/ ##更换节点etcd名及其IP，完成后分发至相应节点 #ansible192.168.100.103-mcopy-a'src=etcd.confdest=/etc/etcd/etcd.conf' #ansible192.168.100.104-mcopy-a'src=etcd.confdest=/etc/etcd/etcd.conf' D. 启动 etcd 集群 1 2 3 4 5 6 #systemctlstartetcd #systemctlstatusetcd #systemctlenableetcd #ansiblenode-a'systemctlstartetcd' #ansiblenode-a'systemctlstatusetcd' #ansiblenode-a'systemctlenableetcd' 注:首个 etcd 节点会显示启动失败,那是由于没有检测到其他节点存活状态。 E.查看集群成员 1 2 3 4 #etcdctl--endpoints=https://192.168.100.102:2379memberlist 32293bbc65784dda:name=etcd1peerURLs=https: //192 .168.100.102:2380clientURLs=https: //192 .168.100.102:2379isLeader= true 703725a0e421bc44:name=etcd2peerURLs=https: //192 .168.100.103:2380clientURLs=https: //192 .168.100.103:2379isLeader= false 78ac8de330c5272a:name=etcd3peerURLs=https: //192 .168.200.104:2380clientURLs=https: //192 .168.100.104:2379isLeader= false F.查看集群健康状况 1 2 3 4 5 #etcdctl--endpoints=https://192.168.100.102:2379cluster-health member32293bbc65784ddaishealthy:gothealthyresultfromhttps: //192 .168.100.102:2379 member703725a0e421bc44ishealthy:gothealthyresultfromhttps: //192 .168.100.103:2379 member78ac8de330c5272aishealthy:gothealthyresultfromhttps: //192 .168.100.104:2379 clusterishealthy 2.配置并启用 flanneld A. 配置启动项并分发至其他节点 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 #vim/usr/lib/systemd/system/flanneld.service [Unit] Description=Flanneldoverlayaddressetcdagent After=network.target After=network-online.target Wants=network-online.target After=etcd.service Before=docker.service [Service] Type=notify EnvironmentFile= /etc/sysconfig/flanneld EnvironmentFile=- /etc/sysconfig/docker-network ExecStart= /usr/bin/flanneld-start $FLANNEL_OPTIONS ExecStartPost= /usr/libexec/flannel/mk-docker-opts .sh-kDOCKER_NETWORK_OPTIONS-d /run/flannel/docker Restart=on-failure [Install] WantedBy=multi-user.target RequiredBy=docker.service #ansiblenode-mcopy-a'src=/usr/lib/systemd/system/flanneld.servicedest=/usr/lib/systemd/system/' #cat<<EOF>/usr/bin/flanneld-start #!/bin/sh exec /usr/bin/flanneld \ -etcd-endpoints=${FLANNEL_ETCD_ENDPOINTS:-${FLANNEL_ETCD}}\ -etcd-prefix=${FLANNEL_ETCD_PREFIX:-${FLANNEL_ETCD_KEY}}\ "$@" EOF #chmod755/usr/bin/flanneld-start #ansiblenode-mcopy-a'src=/usr/bin/flanneld-startdest=/usr/bin/mode=755' B. 配置 flannel 配置文件并分发至其他节点 1 2 3 4 5 6 #cat<<EOF>/etc/sysconfig/flanneld FLANNEL_ETCD_ENDPOINTS= "https://192.168.100.102:2379,https://192.168.100.103:2379,https://192.168.100.104:2379" FLANNEL_ETCD_PREFIX= "/kube/network" FLANNEL_OPTIONS= "-etcd-cafile=/etc/kubernetes/ssl/ca.pem-etcd-certfile=/etc/kubernetes/ssl/etcd.pem-etcd-keyfile=/etc/kubernetes/ssl/etcd-key.pem" EOF #ansiblenode-mcopy-a'src=/etc/sysconfig/flannelddest=/etc/sysconfig/' C.使用 etcd 存储为 flannel 创建目录并添加网络配置 1 2 3 #etcdctl--endpoints=https://192.168.100.102:2379mkdir/kube/network #etcdctl--endpoints=https://192.168.100.102:2379set/kube/network/config'{"Network":"10.254.0.0/16"}' { "Network" : "10.254.0.0/16" } D. 启动 flanneld 1 2 3 4 5 6 #systemctlstartflanneld #systemctlstatusflanneld #systemctlenableflanneld #ansiblenode-a'systemctlstartflanneld' #ansiblenode-a'systemctlstatusflanneld' #ansiblenode-a'systemctlenableflanneld' E. 查看各节点网段 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 #cat/var/run/flannel/subnet.env FLANNEL_NETWORK=10.254.0.0 /16 FLANNEL_SUBNET=10.254.80.1 /24 FLANNEL_MTU=1472 FLANNEL_IPMASQ= false #ansiblenode-a"cat/var/run/flannel/subnet.env" 192.168.100.104|SUCCESS|rc=0>> FLANNEL_NETWORK=10.254.0.0 /16 FLANNEL_SUBNET=10.254.95.1 /24 FLANNEL_MTU=1472 FLANNEL_IPMASQ= false 192.168.100.103|SUCCESS|rc=0>> FLANNEL_NETWORK=10.254.0.0 /16 FLANNEL_SUBNET=10.254.59.1 /24 FLANNEL_MTU=1472 FLANNEL_IPMASQ= false F. 更改 docker 网段为 flannel 分配的网段 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #exportFLANNEL_SUBNET=10.254.80.1/24 #cat<<EOF>daemon.json { "bip" : "$FLANNEL_SUBNET" } EOF #mkdir-p/etc/docker/&&mvdaemon.json/etc/docker/ ##更换为相应节点网段，完成后分发至相应节点 #ansiblenode-mfile-a'path=/etc/docker/state=directory' #ansible192.168.100.103-mcopy-a'src=daemon.jsondest=/etc/docker/daemon.json' #ansible192.168.100.104-mcopy-a'src=daemon.jsondest=/etc/docker/daemon.json' #systemctldaemon-reload #systemctlrestartdocker #ansiblenode-a"systemctldaemon-reload" #ansiblenode-a"systemctlrestartdocker" G. 查看是否已分配相应网段 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 #route-n KernelIProutingtable DestinationGatewayGenmaskFlagsMetricRefUseIface 0.0.0.0192.168.100.20.0.0.0UG10000ens33 10.254.0.00.0.0.0255.255.0.0U000flannel0 10.254.80.00.0.0.0255.255.255.0U000docker0 192.168.100.00.0.0.0255.255.255.0U10000ens33 #ansiblenode-a'route-n' 192.168.100.103|SUCCESS|rc=0>> KernelIProutingtable DestinationGatewayGenmaskFlagsMetricRefUseIface 0.0.0.0192.168.100.20.0.0.0UG10000ens33 10.254.0.00.0.0.0255.255.0.0U000flannel0 10.254.59.00.0.0.0255.255.255.0U000docker0 192.168.100.00.0.0.0255.255.255.0U10000ens33 192.168.100.104|SUCCESS|rc=0>> KernelIProutingtable DestinationGatewayGenmaskFlagsMetricRefUseIface 0.0.0.0192.168.100.20.0.0.0UG10000ens33 10.254.0.00.0.0.0255.255.0.0U000flannel0 10.254.95.00.0.0.0255.255.255.0U000docker0 192.168.100.00.0.0.0255.255.255.0U10000ens33 H. 使用 etcdctl 命令查看 flannel 的相关信息 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 #etcdctl--endpoints=https://192.168.100.102:2379ls/kube/network/subnets /kube/network/subnets/10 .254.80.0-24 /kube/network/subnets/10 .254.59.0-24 /kube/network/subnets/10 .254.95.0-24 #etcdctl--endpoints=https://192.168.100.102:2379-oextendedget/kube/network/subnets/10.254.80.0-24 Key: /kube/network/subnets/10 .254.80.0-24 Created-Index:10 Modified-Index:10 TTL:85486 Index:12 { "PublicIP" : "192.168.100.102" } #etcdctl--endpoints=https://192.168.100.102:2379-oextendedget/kube/network/subnets/10.254.59.0-24 Key: /kube/network/subnets/10 .254.59.0-24 Created-Index:11 Modified-Index:11 TTL:85449 Index:12 { "PublicIP" : "192.168.100.103" } #etcdctl--endpoints=https://192.168.100.102:2379-oextendedget/kube/network/subnets/10.254.95.0-24 Key: /kube/network/subnets/10 .254.95.0-24 Created-Index:12 Modified-Index:12 TTL:85399 Index:12 { "PublicIP" : "192.168.100.104" } I. 测试网络是否正常 1 2 #ping-c410.254.59.1 #ping-c410.254.95.1 3. 配置并启用 Kubernetes Master 节点 Kubernetes Master 节点包含的组件: kube-apiserver kube-controller-manager kube-scheduler A. 配置 config 文件并分发至所有节点 1 2 3 4 5 6 #grep^[A-Z]/etc/kubernetes/config KUBE_LOGTOSTDERR= "--logtostderr=true" KUBE_LOG_LEVEL= "--v=0" KUBE_ALLOW_PRIV= "--allow-privileged=true" KUBE_MASTER= "--master=http://192.168.100.102:8080" #ansiblenode-mcopy-a'src=/etc/kubernetes/configdest=/etc/kubernetes/' B. 配置 kube-apiserver 启动项 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 #vim/usr/lib/systemd/system/kube-apiserver.service [Unit] Description=KubernetesAPIServer Documentation=https: //github .com /kubernetes/kubernetes After=network.target After=etcd.service [Service] EnvironmentFile=- /etc/kubernetes/config EnvironmentFile=- /etc/kubernetes/apiserver ExecStart= /usr/bin/kube-apiserver \ $KUBE_LOGTOSTDERR\ $KUBE_LOG_LEVEL\ $KUBE_ETCD_SERVERS\ $KUBE_API_ADDRESS\ $KUBE_API_PORT\ $KUBELET_PORT\ $KUBE_ALLOW_PRIV\ $KUBE_SERVICE_ADDRESSES\ $KUBE_ADMISSION_CONTROL\ $KUBE_API_ARGS Restart=on-failure Type=notify LimitNOFILE=65536 [Install] WantedBy=multi-user.target C. 配置 apiserver 配置文件 1 2 3 4 5 6 #grep^[A-Z]/etc/kubernetes/apiserver KUBE_API_ADDRESS= "--advertise-address=192.168.100.102--bind-address=192.168.100.102--insecure-bind-address=192.168.100.102" KUBE_ETCD_SERVERS= "--etcd-servers=https://192.168.100.102:2379,192.168.100.103:2379,192.168.100.104:2379" KUBE_SERVICE_ADDRESSES= "--service-cluster-ip-range=10.254.0.0/16" KUBE_ADMISSION_CONTROL= "--admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota" KUBE_API_ARGS= "--authorization-mode=RBAC,Node--kubelet-https=true--service-node-port-range=30000-42767--enable-bootstrap-token-auth--token-auth-file=/etc/kubernetes/token.csv--tls-cert-file=/etc/kubernetes/ssl/kubernetes.pem--tls-private-key-file=/etc/kubernetes/ssl/kubernetes-key.pem--client-ca-file=/etc/kubernetes/ssl/ca.pem--service-account-key-file=/etc/kubernetes/ssl/ca-key.pem--etcd-cafile=/etc/kubernetes/ssl/ca.pem--etcd-certfile=/etc/kubernetes/ssl/etcd.pem--etcd-keyfile=/etc/kubernetes/ssl/etcd-key.pem--enable-swagger-ui=true--event-ttl=1h--basic-auth-file=/etc/kubernetes/basic_auth_file" D. 配置访问用户 1 #echoadmin,admin,1>/etc/kubernetes/basic_auth_file 格式:用户名、密码和UID E. 启动 kube-apiserver 1 2 3 #systemctlstartkube-apiserver #systemctlstatuskube-apiserver #systemctlenablekube-apiserver F. 将 admin 用户与clusterrole: cluster-admin 绑定到一起并验证 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 #kubectlgetclusterrole/cluster-admin-oyaml #kubectlcreateclusterrolebindinglogin-on-dashboard-with-cluster-admin--clusterrole=cluster-admin--user=admin clusterrolebinding "login-on-dashboard-with-cluster-admin" created #kubectlgetclusterrolebinding/login-on-dashboard-with-cluster-admin-oyaml apiVersion:rbac.authorization.k8s.io /v1 kind:ClusterRoleBinding metadata: creationTimestamp:2017-10-31T10:35:06Z name:login-on-dashboard-with-cluster-admin resourceVersion: "116" selfLink: /apis/rbac .authorization.k8s.io /v1/clusterrolebindings/login-on-dashboard-with-cluster-admin uid:292ae19a-be27-11e7-853b-000c297aff5d roleRef: apiGroup:rbac.authorization.k8s.io kind:ClusterRole name:cluster-admin subjects: -apiGroup:rbac.authorization.k8s.io kind:User name:admin G. 配置 kube-controller-manager 启动项 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 #vim/usr/lib/systemd/system/kube-controller-manager.service [Unit] Description=KubernetesControllerManager Documentation= [Service] EnvironmentFile=- /etc/kubernetes/config EnvironmentFile=- /etc/kubernetes/controller-manager ExecStart= /usr/bin/kube-controller-manager \ $KUBE_LOGTOSTDERR\ $KUBE_LOG_LEVEL\ $KUBE_MASTER\ $KUBE_CONTROLLER_MANAGER_ARGS Restart=on-failure LimitNOFILE=65536 [Install] WantedBy=multi-user.target H. 配置 kube-controller-manager 配置文件 1 2 #grep^[A-Z]/etc/kubernetes/controller-manager KUBE_CONTROLLER_MANAGER_ARGS= "--address=127.0.0.1--service-cluster-ip-range=10.254.0.0/16--cluster-name=kubernetes--cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem--cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem--service-account-private-key-file=/etc/kubernetes/ssl/ca-key.pem--root-ca-file=/etc/kubernetes/ssl/ca.pem" I. 启动 kube-controller-manager 1 2 #systemctlstartkube-controller-manager #systemctlstatuskube-controller-manager J. 配置 kube-scheduler 启动项 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 #vim/usr/lib/systemd/system/kube-scheduler.service [Unit] Description=KubernetesSchedulerPlugin Documentation= [Service] EnvironmentFile=- /etc/kubernetes/config EnvironmentFile=- /etc/kubernetes/scheduler ExecStart= /usr/bin/kube-scheduler \ $KUBE_LOGTOSTDERR\ $KUBE_LOG_LEVEL\ $KUBE_MASTER\ $KUBE_SCHEDULER_ARGS Restart=on-failure LimitNOFILE=65536 [Install] WantedBy=multi-user.target K. 配置 kube-scheduler 配置文件 1 2 #grep^[A-Z]/etc/kubernetes/scheduler KUBE_SCHEDULER_ARGS= "--address=127.0.0.1" L. 启动 kube-scheduler 1 2 #systemctlstartkube-scheduler #systemctlstatuskube-scheduler M. 验证 Master 节点 1 2 3 4 5 6 #kubectlgetcs #kubectlgetcomponentstatuses NAMESTATUSMESSAGEERROR schedulerHealthyok controller-managerHealthyok etcd-0Healthy{ "health" : "true" } 4. 配置并启用 Kubernetes Node 节点 Kubernetes Node 节点包含如下组件: kubelet kube-proxy A. 为 kubelet 赋予权限并新建 kubelet 数据目录 kubelet 启动时向 kube-apiserver 发送 TLS bootstrapping 请求，需要先将 bootstrap token 文件中的 kubelet-bootstrap 用户赋予 system:node-bootstrapper cluster 角色(role)， 然后 kubelet 才能有权限创建认证请求(certificate signing requests)。 Master: 1 2 3 4 5 6 #kubectlcreateclusterrolebindingkubelet-bootstrap\ --clusterrole=system:node-bootstrapper\ --user=kubelet-bootstrap clusterrolebinding "kubelet-bootstrap" created #mkdir-p/var/lib/kubelet #ansiblenode-mfile-a'path=/var/lib/kubeletstate=directory' B. 配置 kubelet 启动项并分发至 node 节点 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 #vim/usr/lib/systemd/system/kubelet.service [Unit] Description=KubernetesKubeletServer Documentation=https: //github .com /kubernetes/kubernetes After=docker.service Requires=docker.service [Service] WorkingDirectory= /var/lib/kubelet EnvironmentFile=- /etc/kubernetes/config EnvironmentFile=- /etc/kubernetes/kubelet ExecStart= /usr/bin/kubelet \ $KUBE_LOGTOSTDERR\ $KUBE_LOG_LEVEL\ $KUBELET_ADDRESS\ $KUBELET_PORT\ $KUBELET_HOSTNAME\ $KUBE_ALLOW_PRIV\ $KUBELET_POD_INFRA_CONTAINER\ $KUBELET_ARGS Restart=on-failure [Install] WantedBy=multi-user.target ##分发至其他Node节点 #ansiblenode-mcopy-a'src=/usr/lib/systemd/system/kubelet.servicedest=/usr/lib/systemd/system/' C. 配置 kubelet 配置文件 1 2 3 4 5 6 7 8 9 10 11 12 13 #exportKUBELET_ADDRESS=192.168.100.102 #exportKUBELET_HOSTNAME=Master #cat<<EOF>kubelet KUBELET_ADDRESS= "--address=$KUBELET_ADDRESS" KUBELET_PORT= "--port=10250" KUBELET_HOSTNAME= "--hostname-override=$KUBELET_HOSTNAME" KUBELET_POD_INFRA_CONTAINER= "--pod-infra-container-image=hub.c.163.com/k8s163/pause-amd64:3.0" KUBELET_ARGS= "--cluster-dns=10.254.0.2--experimental-bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig--kubeconfig=/etc/kubernetes/kubelet.kubeconfig--fail-swap-on=false--cert-dir=/etc/kubernetes/ssl--cluster-domain=cluster.local.--serialize-image-pulls=false" EOF #mvkubelet/etc/kubernetes/ ##更换kubelet节点IP和hostname，完成后分发至相应节点 #ansible192.168.100.103-mcopy-a'src=kubeletdest=/etc/kubernetes/' #ansible192.168.100.104-mcopy-a'src=kubeletdest=/etc/kubernetes/' D.启动 kubelet 1 2 3 4 #systemctlstartkubelet #systemctlstatuskubelet #ansiblenode-a'systemctlstartkubelet' #ansiblenode-a'systemctlstatuskubelet' E.将 Node 加入 Kubernetes 集群 kubelet 首次启动时向 kube-apiserver 发送证书签名请求，必须通过 Master 认证才会将该 Node 加入到集群。 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 #kubectlgetnodes Noresourcesfound. #kubectlgetcsr###查看未授权的CSR请求 NAMEAGEREQUESTORCONDITION node-csr-ZU39iUu-E9FuadeTq589skubelet-bootstrapPending node-csr-sJXwbG8c9UUGS8iTrV815skubelet-bootstrapPending node-csr-zpol8cIJZfrcU8fd7l415skubelet-bootstrapPending #kubectlcertificateapprovenode-csr-ZU39iphJAYDQfsLssAwMViUu-E9Fua2pKhELMdeTq58###通过CSR请求[其他两个节点也使用同样的命令授权] certificatesigningrequest "node-csr-ZU39iphJAYDQfsLssAwMViUu-E9Fua2pKhELMdeTq58" approved #kubectlgetcsr NAMEAGEREQUESTORCONDITION node-csr-ZU39iUu-E9FuadeTq5850skubelet-bootstrapApproved,Issued node-csr-sJXwbG8c9UUGS8iTrV81mkubelet-bootstrapApproved,Issued node-csr-zpol8cIJZfrcU8fd7l41mkubelet-bootstrapApproved,Issued #kubectlgetnodes##查看nodes NAMESTATUSAGEVERSION masterReady1mv1.8.2 node1Ready2mv1.8.2 node2Ready2mv1.8.2 注:CSR 授权后会自动在 Node 端生成 kubelet kubeconfig 配置文件和公私钥: 1 2 3 4 #ls/etc/kubernetes/kubelet.kubeconfig /etc/kubernetes/kubelet .kubeconfig #ls/etc/kubernetes/ssl/kubelet* /etc/kubernetes/ssl/kubelet-client .crt /etc/kubernetes/ssl/kubelet-client .key /etc/kubernetes/ssl/kubelet .crt /etc/kubernetes/ssl/kubelet .key F. 配置 kube-proxy 启动项并分发至其他 node 节点 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 #vim/usr/lib/systemd/system/kube-proxy.service [Unit] Description=KubernetesKube-ProxyServer Documentation=https: //github .com /kubernetes/kubernetes After=network.target [Service] EnvironmentFile=- /etc/kubernetes/config EnvironmentFile=- /etc/kubernetes/proxy ExecStart= /usr/bin/kube-proxy \ $KUBE_LOGTOSTDERR\ $KUBE_LOG_LEVEL\ $KUBE_MASTER\ $KUBE_PROXY_ARGS Restart=on-failure LimitNOFILE=65536 [Install] WantedBy=multi-user.target ##分发至其他Node节点 #ansiblenode-mcopy-a'src=/usr/lib/systemd/system/kube-proxy.servicedest=/usr/lib/systemd/system/' G. 调整内核参数 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 #grep-v^#/etc/sysctl.conf###配置kube-proxy代理模式 net.ipv4.ip_forward=1 net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf-call-ip6tables=1 #sysctl-p###加载系统参数 net.ipv4.ip_forward=1 net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf-call-ip6tables=1 #ansiblenode-mcopy-a'src=/etc/sysctl.confdest=/etc/' #ansiblenode-a'sysctl-p' 192.168.100.104|SUCCESS|rc=0>> net.ipv4.ip_forward=1 net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf-call-ip6tables=1 192.168.100.103|SUCCESS|rc=0>> net.ipv4.ip_forward=1 net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf-call-ip6tables=1 说明:在这加这个参数是因为 kube-proxy 使用 iptables 来进行数据转发，而Linux系统默认是禁止数据包转发，这里我是因为无法使用nodeport发现的。 H.配置 kube-proxy 配置文件并分发至其他 node 节点 1 2 3 4 5 6 7 8 #exportKUBE_PROXY=192.168.100.102 #cat<<EOF>proxy KUBE_PROXY_ARGS= "--bind-address=$KUBE_PROXY--hostname-override=$KUBE_PROXY--cluster-cidr=10.254.0.0/16--proxy-mode=iptables--kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig" EOF #mvproxy/etc/kubernetes/proxy ##更换kube-proxy节点IP，完成后分发至相应节点 #ansible192.168.100.103-mcopy-a'src=proxydest=/etc/kubernetes/' #ansible192.168.100.104-mcopy-a'src=proxydest=/etc/kubernetes/' I. 启动 kube-proxy 1 2 3 4 #systemctlstartkube-proxy #systemctlstatuskube-proxy #ansiblenode-a'systemctlstartkube-proxy' #ansiblenode-a'systemctlstatuskube-proxy' J. 查看节点相关信息 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 #kubectlgetnodes-owide###查看节点相关信息(注:这里容器显示Unknown是因为版本相对较高) NAMESTATUSROLESAGEVERSIONEXTERNAL-IPOS-IMAGEKERNEL-VERSIONCONTAINER-RUNTIME masterReady<none>3mv1.8.2<none>CentOSLinux7(Core)3.10.0-693.2.2.el7.x86_64docker: //Unknown node1Ready<none>3mv1.8.2<none>CentOSLinux7(Core)3.10.0-693.2.2.el7.x86_64docker: //Unknown node2Ready<none>3mv1.8.2<none>CentOSLinux7(Core)3.10.0-693.2.2.el7.x86_64docker: //Unknown #kubectlgetnode--show-labels=true #kubectlgetnodes--show-labels###查看节点标签 NAMESTATUSROLESAGEVERSIONLABELS masterReady<none>4mv1.8.2beta.kubernetes.io /arch =amd64,beta.kubernetes.io /os =linux,kubernetes.io /hostname =master node1Ready<none>5mv1.8.2beta.kubernetes.io /arch =amd64,beta.kubernetes.io /os =linux,kubernetes.io /hostname =node1 node2Ready<none>5mv1.8.2beta.kubernetes.io /arch =amd64,beta.kubernetes.io /os =linux,kubernetes.io /hostname =node2 #kubectlversion--short###查看kubectl版本信息 ClientVersion:v1.8.2 ServerVersion:v1.8.2 #curl###查看健康状况 ok #kubectlcluster-info###查看集群信息 Kubernetesmasterisrunningathttps: //192 .168.100.102:6443 #kubectlgetns###获取所有命名空间 #kubectlgetnamespace NAMESTATUSAGE defaultActive29m kube-publicActive29m kube-systemActive29m #kubectlgetservices###查看默认service NAMETYPECLUSTER-IPEXTERNAL-IPPORT(S)AGE kubernetesClusterIP10.254.0.1<none>443 /TCP 36m #kubectlgetservices--all-namespaces###查看所有service NAMESPACENAMETYPECLUSTER-IPEXTERNAL-IPPORT(S)AGE defaultkubernetesClusterIP10.254.0.1<none>443 /TCP 37m #kubectlgetep###查看endpoints #kubectlgetendpoints NAMEENDPOINTSAGE kubernetes192.168.100.102:644338m #kubectlgetsa###查看serviceaccount #kubectlgetserviceaccount NAMESECRETSAGE default138m 说明:其他命令可使用kubectl --help查看，某些长命令可以缩写(如kubectl get namespace可缩写为kubectl get ns），kubectl命令表参考如下: http://docs.kubernetes.org.cn/683.html 本文转自 结束的伤感 51CTO博客，原文链接:http://blog.51cto.com/wangzhijian/2046124
