Kubernetes控制节点安装配置

#环境安装
Centos 7 Linux release 7.3.1611
网络: 互通
配置主机名
设置各个服务器的主机名hosts
#查找kubernetes支持的docker版本
Kubernetes v1.7.5 == Docker 1.12.6
#然后到https://yum.dockerproject.org/repo/main/centos/7/Packages/下载安装
############################################################################################################################
#DOCKER 安装
#安装后启动并设置为开机自启
rpm –ivh https://yum.dockerproject.org/repo/main/centos/7/Packages/docker-engine-1.12.6-1.el7.centos.x86_64.rpm
sudo systemctl start docker
sudo systemctl enable docker

#安装控制节点
############################################################################################################################
#ETCD 安装
tar xf etcd.tar.gz
cd etcd
cp etcd etcdctl /usr/bin
cat << EOF > /usr/lib/systemd/system/etcd.service
[unit]
Description=Etcd Server
After=network.target

[Service]
Type=simple
WorkingDirectory=/var/lib/etcd/
EnvironmentFile=/etc/etcd/etcd.conf
ExecStart=/usr/bin/etcd $ETCD_CMD

[Install]
WantedBy=multi-user.target
EOF
cat << EOF > /etc/etcd/etcd.conf
ETCD_CMD="--listen-client-urls http://0.0.0.0:2379 --advertise-client-urls http://0.0.0.0:2379 "
EOF
systemctl daemon-reload
systemctl enable etcd.service
systemctl start etcd.service
systemctl status etcd.service

####################################################################################################################################
#安装Kubernetes
#下载地址: https://github.com/kubernetes/kubernetes/releases/tag/v1.7.5
tar zxf kubernetes-server-linux-amd64.tar.gz
sh cluster/get-kube-binaries.sh
cd server
tar xf kubernetes-server-linux-amd64.tar.gz
cd server/bin
#准备证书
mkdir /etc/kubernetes/crt
cd /etc/kubernetes/crt
#API service证书创建完后一共有6个文件,test.com替换成自己的域名,master替换成控制节点主机名
openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -subj "/CN=test.com" -days 5000 -out ca.crt
openssl genrsa -out server.key 2048
openssl req -new -key server.key -subj "/CN=master" -config master_ssl.cnf -out server.csr
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 5000 -extensions v3_req -extfile master_ssl.cnf -out server.crt
#kube-controller-manager证书,k8s-node-1任意设置
openssl genrsa -out cs_client.key 2048
openssl req -new -key cs_client.key -subj "/CN=k8s-node-1" -out cs_client.csr
openssl x509 -req -in cs_client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out cs_client.crt -days 5000
#下载service包
cd -
sh kubernetes/cluster/get-kube-binaries.sh
cd kubernetes/server/
tar xf kubernetes-server-linux-amd64.tar.gz
cd server/bin/
#DNS1234不要更改,DNS5为控制节点主机名ip1为要创建的kubernetes私有IP,不能属于当前网络,ip2为本机外网IP
#配置master_ssl.cnf
cat << EOF > master_ssl.cnf
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints= CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName= @alt_names
[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster.local
DNS.5 = master
IP.1 = 169.169.0.1
IP.2 = 192.168.1.1
EOF
#创建kubeconfig文件
cat << EOF > /etc/kubernetes/kubeconfig
apiVersion: v1
kind: Config
users:
- name: controllermanager
  user:
    client-certificate: /etc/kubernetes/crt/cs_client.crt
    client-key: /etc/kubernetes/crt/cs_client.key
clusters:
- name: local
  cluster:
    certificate-authority: /etc/kubernetes/crt/ca.crt
contexts:
- context:
    cluster: local
    user: controllermanager
  name: my-context
current-context: my-context
EOF

#########################################################################################################
#安装kube-apiserver
cp kube-apiserver /usr/bin
cat << EOF > /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=etcd.service
Wants=etcd.service

[Service]
EnvironmentFile=/etc/kubernetes/apiserver
ExecStart=/usr/bin/kube-apiserver $KUBE_API_ARGS
Restart=on-failure
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

#配置文件service-cluster-ip-range与上面制定的169.169.0.1IP段一致,service-node-port-range允许映射的端口范围,insecure-port采用https配置为0,secure-port服务端口
cat << EOF > /etc/kubernetes/apiserver
KUBE_API_ARGS="--etcd_servers=http://127.0.0.1:2379 --insecure-bind-address=0.0.0.0 \
--service-cluster-ip-range=169.169.0.0/16 \
--service-node-port-range=1-65535 \
--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
--logtostderr=false --log-dir=/var/log/kubernetes --v=2 \
--client_ca_file=/etc/kubernetes/crt/ca.crt \
--tls-private-key-file=/etc/kubernetes/crt/server.key \
--tls-cert-file=/etc/kubernetes/crt/server.crt \
--insecure-port=0 \
--secure-port=8080"
EOF

########################################################################################################################################################
#安装kube-controller-manager
cp kube-controller-manager /usr/bin
cat << EOF > /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=kube-apiserver.service
Requires=kube-apiserver.service

[Service]
EnvironmentFile=/etc/kubernetes/controller-manager
ExecStart=/usr/bin/kube-controller-manager $KUBE_CONTROLLER_MANAGER_ARGS
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
#配置masterIP替换为master的IP
cat << EOF >/etc/kubernetes/controller-manager
KUBE_CONTROLLER_MANAGER_ARGS="--master=https://masterIP:8080 --logtostderr=false --log-dir=/var/log/kubernetes --v=2 --service_account_private_key_file=/etc/kubernetes/crt/server.key --root-ca-file=/etc/kubernetes/crt/ca.crt --kubeconfig=/etc/kubernetes/kubeconfig"
EOF

####################################################################################
#安装kube-scheduler
cp ../kube-scheduler /usr/bin
cat << EOF > /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=kube-apiserver.service
Requires=kube-apiserver.service

[Service]
EnvironmentFile=/etc/kubernetes/scheduler
ExecStart=/usr/bin/kube-scheduler $KUBE_SCHEDULER_ARGS
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
#配置masterIP替换为master的IP
cat << EOF > /etc/kubernetes/scheduler
KUBE_SCHEDULER_ARGS="--master=https://masterIP:8080 --logtostderr=false \
--log-dir=/var/log/kubernetes --v=2 \
--kubeconfig=/etc/kubernetes/kubeconfig \
--service-cluster-ip-range=169.169.0.0/16"
EOF

######################################################################################
#启动
systemctl daemon-reload
for i in kube-apiserver kube-apiserver kube-scheduler
do
    systemctl enable $i
    systemctl restart $i
    systemctl status $i
done

#配置kubectl,master替换为控制节点IP
kubectl config set-cluster default-cluster --server=https://master:8080 --certificate-authority=/etc/kubernetes/crt/ca.crt
kubectl config set-credentials default-admin --certificate-authority=/etc/kubernetes/crt/ca.crt --client-key=/etc/kubernetes/crt/cs_client.key --client-certificate=/etc/kubernetes/crt/cs_client.crt
kubectl config set-context default-system --cluster=default-cluster --user=default-admin
kubectl config use-context default-system
#查看节点,当前还没添加节点所有为空
kubectl get nodes