部署 Kubernetes 控制节点

本部分将会在三台控制节点上部署 Kubernetes 控制服务，并配置高可用的集群架构。并且还会创建一个用于外部访问的负载均衡器。每个控制节点上需要部署的服务包括：Kubernetes API Server、Scheduler 以及 Controller Manager 等。

事前准备

以下命令需要在每台控制节点上面都运行一遍，包括 controller-0、controller-1 和 controller-2。可以使用 gcloud 命令登录每个控制节点。例如:

  1. gcloud compute ssh controller-0

部署 Kubernetes 控制平面

下载并安装 Kubernetes Controller 二进制文件

  1. wget -q --show-progress --https-only --timestamping \
  2.   "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-apiserver" \
  3.   "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-controller-manager" \
  4.   "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-scheduler" \
  5.   "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kubectl"
  7. chmod +x kube-apiserver kube-controller-manager kube-scheduler kubectl
  8. sudo mv kube-apiserver kube-controller-manager kube-scheduler kubectl /usr/local/bin/

配置 Kubernetes API Server

  1. sudo mkdir -p /var/lib/kubernetes/
  2. sudo mv ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem encryption-config.yaml /var/lib/kubernetes/

使用节点的内网 IP 地址作为 API server 与集群内部成员的广播地址。首先查询当前节点的内网 IP 地址：

  1. INTERNAL_IP=$(curl -s -H "Metadata-Flavor: Google" \
  2.   http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip)

生成 kube-apiserver.service systemd 配置文件：

  1. cat > kube-apiserver.service <<EOF
  2. [Unit]
  3. Description=Kubernetes API Server
  4. Documentation=https://github.com/kubernetes/kubernetes
  6. [Service]
  7. ExecStart=/usr/local/bin/kube-apiserver \\
  8.   --admission-control=Initializers,NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\
  9.   --advertise-address=${INTERNAL_IP} \\
  10.   --allow-privileged=true \\
  11.   --apiserver-count=3 \\
  12.   --audit-log-maxage=30 \\
  13.   --audit-log-maxbackup=3 \\
  14.   --audit-log-maxsize=100 \\
  15.   --audit-log-path=/var/log/audit.log \\
  16.   --authorization-mode=Node,RBAC \\
  17.   --bind-address=0.0.0.0 \\
  18.   --client-ca-file=/var/lib/kubernetes/ca.pem \\
  19.   --enable-swagger-ui=true \\
  20.   --etcd-cafile=/var/lib/kubernetes/ca.pem \\
  21.   --etcd-certfile=/var/lib/kubernetes/kubernetes.pem \\
  22.   --etcd-keyfile=/var/lib/kubernetes/kubernetes-key.pem \\
  23.   --etcd-servers=https://10.240.0.10:2379,https://10.240.0.11:2379,https://10.240.0.12:2379 \\
  24.   --event-ttl=1h \\
  25.   --experimental-encryption-provider-config=/var/lib/kubernetes/encryption-config.yaml \\
  26.   --insecure-bind-address=127.0.0.1 \\
  27.   --kubelet-certificate-authority=/var/lib/kubernetes/ca.pem \\
  28.   --kubelet-client-certificate=/var/lib/kubernetes/kubernetes.pem \\
  29.   --kubelet-client-key=/var/lib/kubernetes/kubernetes-key.pem \\
  30.   --kubelet-https=true \\
  31.   --runtime-config=api/all \\
  32.   --service-account-key-file=/var/lib/kubernetes/ca-key.pem \\
  33.   --service-cluster-ip-range=10.32.0.0/24 \\
  34.   --service-node-port-range=30000-32767 \\
  35.   --tls-ca-file=/var/lib/kubernetes/ca.pem \\
  36.   --tls-cert-file=/var/lib/kubernetes/kubernetes.pem \\
  37.   --tls-private-key-file=/var/lib/kubernetes/kubernetes-key.pem \\
  38.   --v=2
  39. Restart=on-failure
  40. RestartSec=5
  42. [Install]
  43. WantedBy=multi-user.target
  44. EOF

配置 Kubernetes Controller Manager

生成 kube-controller-manager.service systemd 配置文件：

  1. cat > kube-controller-manager.service <<EOF
  2. [Unit]
  3. Description=Kubernetes Controller Manager
  4. Documentation=https://github.com/kubernetes/kubernetes
  6. [Service]
  7. ExecStart=/usr/local/bin/kube-controller-manager \\
  8.   --address=0.0.0.0 \\
  9.   --cluster-cidr=10.200.0.0/16 \\
  10.   --cluster-name=kubernetes \\
  11.   --cluster-signing-cert-file=/var/lib/kubernetes/ca.pem \\
  12.   --cluster-signing-key-file=/var/lib/kubernetes/ca-key.pem \\
  13.   --leader-elect=true \\
  14.   --master=http://127.0.0.1:8080 \\
  15.   --root-ca-file=/var/lib/kubernetes/ca.pem \\
  16.   --service-account-private-key-file=/var/lib/kubernetes/ca-key.pem \\
  17.   --service-cluster-ip-range=10.32.0.0/24 \\
  18.   --v=2
  19. Restart=on-failure
  20. RestartSec=5
  22. [Install]
  23. WantedBy=multi-user.target
  24. EOF

配置 Kubernetes Scheduler

生成 kube-scheduler.service systemd 配置文件：

  1. cat > kube-scheduler.service <<EOF
  2. [Unit]
  3. Description=Kubernetes Scheduler
  4. Documentation=https://github.com/kubernetes/kubernetes
  6. [Service]
  7. ExecStart=/usr/local/bin/kube-scheduler \\
  8.   --leader-elect=true \\
  9.   --master=http://127.0.0.1:8080 \\
  10.   --v=2
  11. Restart=on-failure
  12. RestartSec=5
  14. [Install]
  15. WantedBy=multi-user.target
  16. EOF

启动控制器服务

  1. sudo mv kube-apiserver.service kube-scheduler.service kube-controller-manager.service /etc/systemd/system/
  2. sudo systemctl daemon-reload
  3. sudo systemctl enable kube-apiserver kube-controller-manager kube-scheduler
  4. sudo systemctl start kube-apiserver kube-controller-manager kube-scheduler

请等待 10 秒以便 Kubernetes API Server 初始化。

验证

  1. kubectl get componentstatuses

将输出结果

  1. NAME                 STATUS    MESSAGE              ERROR
  2. controller-manager   Healthy   ok
  3. scheduler            Healthy   ok
  4. etcd-2               Healthy   {"health": "true"}
  5. etcd-0               Healthy   {"health": "true"}
  6. etcd-1               Healthy   {"health": "true"}

记得在每台控制节点上面都运行一遍，包括 controller-0、controller-1 和 controller-2。

Kubelet RBAC 授权

本节将会配置 API Server 访问 Kubelet API 的 RBAC 授权。访问 Kubelet API 是获取 metrics、日志以及执行容器命令所必需的。

这里设置 Kubeket --authorization-mode 为 Webhook 模式。Webhook 模式使用 SubjectAccessReview API 来决定授权。

  1. gcloud compute ssh controller-0

创建 system:kube-apiserver-to-kubelet ClusterRole 以允许请求 Kubelet API 和执行许用来管理 Pods 的任务:

  1. cat <<EOF | kubectl apply -f -
  2. apiVersion: rbac.authorization.k8s.io/v1beta1
  3. kind: ClusterRole
  4. metadata:
  5.   annotations:
  6.     rbac.authorization.kubernetes.io/autoupdate: "true"
  7.   labels:
  8.     kubernetes.io/bootstrapping: rbac-defaults
  9.   name: system:kube-apiserver-to-kubelet
  10. rules:
  11.   - apiGroups:
  12.       - ""
  13.     resources:
  14.       - nodes/proxy
  15.       - nodes/stats
  16.       - nodes/log
  17.       - nodes/spec
  18.       - nodes/metrics
  19.     verbs:
  20.       - "*"
  21. EOF

Kubernetes API Server 使用客户端凭证授权 Kubelet 为 kubernetes 用户，此凭证用 --kubelet-client-certificate flag 来定义。

绑定 system:kube-apiserver-to-kubelet ClusterRole 到 kubernetes 用户:

  1. cat <<EOF | kubectl apply -f -
  2. apiVersion: rbac.authorization.k8s.io/v1beta1
  3. kind: ClusterRoleBinding
  4. metadata:
  5.   name: system:kube-apiserver
  6.   namespace: ""
  7. roleRef:
  8.   apiGroup: rbac.authorization.k8s.io
  9.   kind: ClusterRole
  10.   name: system:kube-apiserver-to-kubelet
  11. subjects:
  12.   - apiGroup: rbac.authorization.k8s.io
  13.     kind: User
  14.     name: kubernetes
  15. EOF

Kubernetes 前端负载均衡器

本节将会建立一个位于 Kubernetes API Servers 前端的外部负载均衡器。 kubernetes-the-hard-way 静态 IP 地址将会配置在这个负载均衡器上。

本指南创建的虚拟机内部并没有操作负载均衡器的权限，需要到创建这些虚拟机的那台机器上去做下面的操作。

创建外部负载均衡器网络资源：

  1. gcloud compute target-pools create kubernetes-target-pool
  3. gcloud compute target-pools add-instances kubernetes-target-pool \
  4.   --instances controller-0,controller-1,controller-2
  6. KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
  7.   --region $(gcloud config get-value compute/region) \
  8.   --format 'value(name)')
  10. gcloud compute forwarding-rules create kubernetes-forwarding-rule \
  11.   --address ${KUBERNETES_PUBLIC_ADDRESS} \
  12.   --ports 6443 \
  13.   --region $(gcloud config get-value compute/region) \
  14.   --target-pool kubernetes-target-pool

验证

查询 kubernetes-the-hard-way 静态 IP 地址:

  1. KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
  2.   --region $(gcloud config get-value compute/region) \
  3.   --format 'value(address)')

发送一个查询 Kubernetes 版本信息的 HTTP 请求

  1. curl --cacert ca.pem https://${KUBERNETES_PUBLIC_ADDRESS}:6443/version

结果为

  1. {
  2.   "major": "1",
  3.   "minor": "9",
  4.   "gitVersion": "v1.9.0",
  5.   "gitCommit": "925c127ec6b946659ad0fd596fa959be43f0cc05",
  6.   "gitTreeState": "clean",
  7.   "buildDate": "2017-12-15T20:55:30Z",
  8.   "goVersion": "go1.9.2",
  9.   "compiler": "gc",
  10.   "platform": "linux/amd64"
  11. }

下一步：部署 Kubernetes Worker 节点。