二进制安装kubernetes集群

链接地址 https://www.cnblogs.com/leleyao/p/10453848.html  安装etcd

证书制作

apiserver 证书

[root@master01 ssl]# ls *json
ca-config.json  ca-csr.json  server-csr.json
[root@master01 ssl]# cat *json
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "cnpc",
            "OU": "RF"
        }
    ]
}
{
    "CN": "kubernetes",
    "hosts": [
      "10.0.0.1",
      "127.0.0.1",
      "172.16.8.100",
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "cnpc",
            "OU": "RF"
        }
    ]
}

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

kube-proxy 的证书

[root@master01 ssl]# cat proxy-csr.json
{
"CN": "kube-proxy",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing",
"O": "cnpc",
"OU": "RF"
}
]
}

 cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes proxy-csr.json | cfssljson -bare kube-proxy

配置flannel 服务

etcdctl --cacert=/etc/etcd/ssl/ca.pem --cert=/etc/etcd/ssl/etcd.pem --key=/etc/etcd/ssl/etcd-key.pem --endpoints=https://192.168.141.135:2379,https://192.168.141.136:2379,https://192.168.141.137:2379  put /coreos.com/network/config  '{ "Network": "172.18.0.0/16", "Backend": {"Type": "vxlan"}}
flanneld 当前版本 (v0.10.0) 不支持 etcd v3，故使用 etcd v2 API 写入配置 key 和网段数据

修改配置文件

通过yum方式获取默认 systemd 文件
[root@master01 ~]# cat /usr/lib/systemd/system/flanneld.service
[Unit]
Description=Flanneld overlay address etcd agent
After=network.target
After=network-online.target
Wants=network-online.target
After=etcd.service
Before=docker.service

[Service]
Type=notify
EnvironmentFile=/etc/sysconfig/flanneld
EnvironmentFile=-/etc/sysconfig/docker-network
ExecStart=/bin/flanneld-start $FLANNEL_OPTIONS                      #注意启动命令的位置
ExecStartPost=/bin/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/docker  #博主nc，写错了路径 flannel 重启了 1000次
Restart=on-failure

[Install]
WantedBy=multi-user.target
WantedBy=docker.service

[root@master01 ~]# cat /usr/lib/systemd/system/docker.service.d/flannel.conf
[Service]
EnvironmentFile=-/run/flannel/docker

[root@master01 ~]# rpm -ql flannel
/etc/sysconfig/flanneld
/run/flannel
/usr/bin/flanneld
/usr/bin/flanneld-start
/usr/lib/systemd/system/docker.service.d/flannel.conf
/usr/lib/systemd/system/flanneld.service
/usr/lib/tmpfiles.d/flannel.conf
/usr/libexec/flannel
/usr/libexec/flannel/mk-docker-opts.sh
/usr/share/doc/flannel-0.7.
/usr/share/doc/flannel-0.7./CONTRIBUTING.md
/usr/share/doc/flannel-0.7./DCO
/usr/share/doc/flannel-0.7./LICENSE
/usr/share/doc/flannel-0.7./MAINTAINERS
/usr/share/doc/flannel-0.7./NOTICE
/usr/share/doc/flannel-0.7./README.md
保留 /etc/flanne/usr/lib/systemd/system/docker.service.d/flannel.conf/usr/lib/systemd/system/flanneld.service

[root@master01 ~]# cd /etc/kubernetes/
[root@master01 kubernetes]# mkdir flannel

[root@master01 flannel]# cp /usr/lib/systemd/system/docker.service.d/flannel.conf .

[root@master01 flannel]# cp /etc/sysconfig/flanneld .

[root@master01 flannel]# cp /usr/lib/systemd/system/flanneld.service .

[root@master01 flannel]# vim /etc/sysconfig/flanneld

# Flanneld configuration options

# etcd url location. Point this to the server where etcd runs
FLANNEL_ETCD_ENDPOINTS=FLANNEL_ETCD_ENDPOINTS=FLANNEL_ETCD_ENDPOINTS="-etcd-cafile=/etc/etcd/ssl/ca.pem -etcd-certfile=/etc/etcd/ssl/etcd.pem -etcd-keyfile=/etc/etcd/ssl/etcd-key.pem -etcd-endpoints=https://192.168.141.135:2379,https://192.168.141.136:2379,https://192.168.141.137:2379"

# etcd config key. This is the configuration key that flannel queries
# For address range assignment
FLANNEL_ETCD_PREFIX="/coreos.com/network"

# Any additional options that you want to pass
#FLANNEL_OPTIONS=""

[root@master01 flannel]# ansible all -m copy -a 'src=/etc/sysconfig/flanneld dest=/etc/sysconfig/flanneld'
192.168.141.135 | SUCCESS => {
"changed": false,
"checksum": "d45252d0c4214ef41743ae03ef0efa2668b84add",
"gid": 0,
"group": "root",
"mode": "0644",
"owner": "root",
"path": "/etc/sysconfig/flanneld",
"size": 536,
"state": "file",
"uid": 0
}
192.168.141.137 | SUCCESS => {
"changed": true,
"checksum": "d45252d0c4214ef41743ae03ef0efa2668b84add",
"dest": "/etc/sysconfig/flanneld",
"gid": 0,
"group": "root",
"md5sum": "3da1d82f18fda0747be4565ea1f426f7",
"mode": "0644",
"owner": "root",
"size": 536,
"src": "/root/.ansible/tmp/ansible-tmp-1558088021.59-228568509248759/source",
"state": "file",
"uid": 0
}
192.168.141.136 | SUCCESS => {
"changed": true,
"checksum": "d45252d0c4214ef41743ae03ef0efa2668b84add",
"dest": "/etc/sysconfig/flanneld",
"gid": 0,
"group": "root",
"md5sum": "3da1d82f18fda0747be4565ea1f426f7",
"mode": "0644",
"owner": "root",
"size": 536,
"src": "/root/.ansible/tmp/ansible-tmp-1558088021.57-153282686622293/source",
"state": "file",
"uid": 0
}

mk-docker-opts.sh 脚本将分配给 flanneld 的 Pod 子网网段信息写入 /run/flannel/docker 文件，后续 docker 启动时 使用这个文件中的环境变量配置 docker0 网桥；

flanneld 使用系统缺省路由所在的接口与其它节点通信，对于有多个网络接口（如内网和公网）的节点，可以用 -iface 参数指定通信接口，如上面的 eth0 接口;

flanneld 运行时需要 root 权限

确定 etcd状态

[root@master02 yum.repos.d]# etcdctl --ca-file=/etc/etcd/ssl/ca.pem --cert-file=/etc/etcd/ssl/etcd.pem --key-file=/etc/etcd/ssl/etcd-key.pem --endpoints='https://192.168.141.135:2379,https://192.168.141.136:2379,https://192.168.141.137:2379' ls /coreos.com/network/subnets/
/coreos.com/network/subnets/172.18.62.0-24
/coreos.com/network/subnets/172.18.80.0-24
/coreos.com/network/subnets/172.18.53.0-24