5、二进制安装K8s 之 部署kube-scheduler

二进制安装K8s之部署kube-scheduler

1、创建配置文件

cat > /data/k8s/config/kube-scheduler.conf << EOF
KUBE_SCHEDULER_OPTS="--logtostderr=false \\
--v=2 \\
--log-dir=/data/k8s/kubernetes/logs \\
--leader-elect \\
--kubeconfig=/data/k8s/config/kube-scheduler.kubeconfig \\
--bind-address=127.0.0.1"
EOF

• –leader-elect：当该组件启动多个时，自动选举（HA）

2、生成kube-scheduler 证书：

cat > /data/docker/TSL/k8s/kube-scheduler-csr.json <<EOF
{
    "CN": "system:kube-scheduler",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "system:masters",
            "OU": "System"
        }
    ]
}
EOF

• 生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

#拷贝生成的.pem证书

cp /data/docker/TSL/k8s/kube-scheduler*.pem /data/k8s/ssl/

3、生成kube-scheduler.kubeconfig 配置文件

#在shell 命令行执行

KUBE_CONFIG="/data/k8s/config/kube-scheduler.kubeconfig"
KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \
--certificate-authority=/data/k8s/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials kube-scheduler \
--client-certificate=/data/k8s/ssl/kube-scheduler.pem \
--client-key=/data/k8s/ssl/kube-scheduler-key.pem \
--embed-certs=true \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \
--cluster=kubernetes \
--user=kube-scheduler \
--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成 kube-controller-manager.kubeconfig 文件
##查看，文件里会有密钥，这里忽略,server: 地址就是k8s master 地址
 cat /data/k8s/config/kube-controller-manager.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: =
    server: https://192.168.100.170:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kube-scheduler
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: kube-scheduler
  user:
    client-certificate-data:
    client-key-data: =

4、systemd管理scheduler

cat > /usr/lib/systemd/system/kube-scheduler.service << EOF
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/kubernetes/kubernetes
[Service]
EnvironmentFile=/data/k8s/config/kube-scheduler.conf
ExecStart=/data/k8s/bin/kube-scheduler \$KUBE_SCHEDULER_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF

5、启动并设置开机启动

systemctl daemon-reload
systemctl start kube-scheduler
systemctl enable kube-scheduler

---

6、生成admin证书

cat > /data/docker/TSL/k8s/admin-csr.json <<EOF
{
    "CN": "admin",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "system:masters",
            "OU": "System"
        }
    ]
}
EOF

• 生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

#拷贝证书

cp /data/docker/TSL/k8s/admin*.pem /data/k8s/ssl/

• 生成 kuconfig文件

#在shell命令行执行

KUBE_CONFIG="/data/k8s/config/config"
KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \
--certificate-authority=/data/k8s/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials cluster-admin \
--client-certificate=/data/k8s/ssl/admin.pem \
--client-key=/data/k8s/ssl/admin-key.pem \
--embed-certs=true \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \
--cluster=kubernetes \
--user=cluster-admin \
--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成的文件在/data/k8s/config/config
#k8s 默认配置文件位置：/root/.kube/
#创建目录
mkdir /root/.kube/ 

#复制文件
cp /data/k8s/config/config /root/.kube/config

#查看授权文件
cat config/config
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: =
    server: https://192.168.0.170:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kube-controller-manager
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: cluster-admin
  user:
    client-certificate-data: ==
    client-key-data: =

7、 测试

#1.21
[root@master01 k8s]# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME                 STATUS    MESSAGE                         ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-2               Healthy   {"health":"true","reason":""}
etcd-0               Healthy   {"health":"true","reason":""}
etcd-1               Healthy   {"health":"true","reason":""}

#1.20
[root@k8s-master01 k8s]# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME                 STATUS    MESSAGE             ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-1               Healthy   {"health":"true"}
etcd-0               Healthy   {"health":"true"}
etcd-2               Healthy   {"health":"true"}

8、创建集群角色绑定，后面用

将apiserver-config 配置里的token 文件用户名绑定

/data/k8s/config/token.csv

kubectl create clusterrolebinding kubelet-bootstrap \
--clusterrole=system:node-bootstrapper \
--user=kubelet-bootstrap