Kubernetes部署与配置全指南

### Kubernetes部署与配置全指南 #### 1. 控制平面组件安装 控制平面包含多个关键组件，如`kube-controller-manager`、`kube-scheduler`等，下面分别介绍它们的安装步骤。 ##### 1.1 kube-controller-manager安装 - 下载`kube-controller-manager`： ```bash johndoe@kube-controller-1$ wget "https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/linux/amd64/kube-controller-manager" johndoe@kube-controller-1$ sudo chmod +x kube-controller-manager johndoe@kube-controller-1$ sudo mv kube-controller-manager /usr/local/bin/ ``` - 移动`kubeconfig`文件并创建单元文件： ```bash johndoe@kube-controller-1$ sudo cp /home/johndoe/kube-controller-manager.kubeconfig /var/lib/kubernetes/ johndoe@kube-controller-1$ cat << EOF | sudo tee /etc/systemd/system/kube-controller-manager.service [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/kubernetes/kubernetes [Service] ExecStart=/usr/local/bin/kube-controller-manager \\ --address=0.0.0.0 \\ --cluster-cidr=10.30.0.0/16 \\ --cluster-name=kubernetes \\ --cluster-signing-cert-file=/var/lib/kubernetes/ca.pem \\ --cluster-signing-key-file=/var/lib/kubernetes/ca-key.pem \\ --kubeconfig=/var/lib/kubernetes/kube-controller-manager.kubeconfig \\ --leader-elect=true \\ --root-ca-file=/var/lib/kubernetes/ca.pem \\ --service-account-private-key-file=/var/lib/kubernetes/service-account-key.pem \\ --service-cluster-ip-range=10.20.0.0/24 \\ --use-service-account-credentials=true \\ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF ``` ##### 1.2 kube-scheduler安装 - 下载`kube-scheduler`： ```bash johndoe@kube-controller-1$ wget "https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/linux/amd64/kube-scheduler" johndoe@kube-controller-1$ chmod +x kube-scheduler johndoe@kube-controller-1$ sudo mv kube-scheduler /usr/local/bin/ ``` - 移动`kubeconfig`文件： ```bash johndoe@kube-controller-1$ sudo cp /home/johndoe/kube-scheduler.kubeconfig /var/lib/kubernetes/ ``` - 创建`kube-scheduler.yml`文件： ```bash johndoe@kube-controller-1$ sudo cat << EOF | sudo tee /etc/kubernetes/config/kube-scheduler.yml apiVersion: componentconfig/v1alpha1 kind: KubeSchedulerConfiguration clientConnection: kubeconfig: "/var/lib/kubernetes/kube-scheduler.kubeconfig" leaderElection: leaderElect: true EOF ``` - 创建`kube-scheduler.service`文件： ```bash johndoe@kube-controller-1$ sudo cat << EOF | sudo tee /etc/systemd/system/kube-scheduler.service [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/kubernetes/kubernetes [Service] ExecStart=/usr/local/bin/kube-scheduler \\ --config=/etc/kubernetes/config/kube-scheduler.yml \\ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF ``` #### 2. 启动控制平面 在每个控制节点完成组件安装后，启动并测试服务。 ```bash johndoe@kube-controller-1$ sudo systemctl daemon-reload johndoe@kube-controller-1$ sudo systemctl enable kube-apiserver kube-controller-manager kube-scheduler johndoe@kube-controller-1$ sudo systemctl start kube-apiserver kube-controller-manager kube-scheduler johndoe@kube-controller-1$ sudo systemctl status kube-apiserver kube-controller-manager kube-scheduler ``` 设置`kubectl`上下文： ```bash johndoe@kube-controller-1$ mkdir /home/johndoe/.kube/ johndoe@kube-controller-1$ cat /home/johndoe/admin.kubeconfig > /home/johndoe/.kube/config johndoe@kube-controller-1$ kubectl get cs ``` 输出示例： | NAME | STATUS | MESSAGE | ERROR | | ---- | ---- | ---- | ---- | | controller-manager | Healthy | ok | | | scheduler | Healthy | ok | | | etcd-0 | Healthy | {"health": "true"} | | | etcd-1 | Healthy | {"health": "true"} | | | etcd-2 | Healthy | {"health": "true"} | | #### 3. 设置RBAC权限 API服务器需要权限与`kubelets` API通信，可通过创建集群角色并绑定到Kubernetes用户来实现。 ##### 3.1 创建集群角色 ```bash johndoe@kube-controller-1$ cat << EOF | kubectl apply -f - apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: annotations: rbac.authorization.kubernet ```