06-3.部署高可用 kube-controller-manager 集群

本文档介绍部署高可用 kube-controller-manager 集群的步骤。

该集群包含 3 个节点，启动后将通过竞争选举机制产生一个 leader 节点，其它节点为阻塞状态。当 leader 节点不可用时，阻塞的节点将再次进行选举产生新的 leader 节点，从而保证服务的可用性。

为保证通信安全，本文档先生成 x509 证书和私钥，kube-controller-manager 在如下两种情况下使用该证书：

  1. 与 kube-apiserver 的安全端口通信;
  2. 在安全端口(https，10252) 输出 prometheus 格式的 metrics；

注意：如果没有特殊指明，本文档的所有操作均在 zhangjun-k8s01 节点上执行，然后远程分发文件和执行命令。

准备工作

下载最新版本的二进制文件、安装和配置 flanneld 参考：06-1.部署master节点.md。

创建 kube-controller-manager 证书和私钥

创建证书签名请求：

  1. cd /opt/k8s/work
  2. cat > kube-controller-manager-csr.json <<EOF
  3. {
  4.     "CN": "system:kube-controller-manager",
  5.     "key": {
  6.         "algo": "rsa",
  7.         "size": 2048
  8.     },
  9.     "hosts": [
  10.       "127.0.0.1",
  11.       "172.27.137.240",
  12.       "172.27.137.239",
  13.       "172.27.137.238"
  14.     ],
  15.     "names": [
  16.       {
  17.         "C": "CN",
  18.         "ST": "BeiJing",
  19.         "L": "BeiJing",
  20.         "O": "system:kube-controller-manager",
  21.         "OU": "4Paradigm"
  22.       }
  23.     ]
  24. }
  25. EOF
  • hosts 列表包含所有 kube-controller-manager 节点 IP；
  • CN 和 O 均为 system:kube-controller-manager，kubernetes 内置的 ClusterRoleBindings system:kube-controller-manager 赋予 kube-controller-manager 工作所需的权限。

生成证书和私钥：

  1. cd /opt/k8s/work
  2. cfssl gencert -ca=/opt/k8s/work/ca.pem \
  3.   -ca-key=/opt/k8s/work/ca-key.pem \
  4.   -config=/opt/k8s/work/ca-config.json \
  5.   -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager
  6. ls kube-controller-manager*pem

将生成的证书和私钥分发到所有 master 节点：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_ip in ${NODE_IPS[@]}
  4.   do
  5.     echo ">>> ${node_ip}"
  6.     scp kube-controller-manager*.pem root@${node_ip}:/etc/kubernetes/cert/
  7.   done

创建和分发 kubeconfig 文件

kube-controller-manager 使用 kubeconfig 文件访问 apiserver，该文件提供了 apiserver 地址、嵌入的 CA 证书和 kube-controller-manager 证书：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. kubectl config set-cluster kubernetes \
  4.   --certificate-authority=/opt/k8s/work/ca.pem \
  5.   --embed-certs=true \
  6.   --server=${KUBE_APISERVER} \
  7.   --kubeconfig=kube-controller-manager.kubeconfig
  9. kubectl config set-credentials system:kube-controller-manager \
  10.   --client-certificate=kube-controller-manager.pem \
  11.   --client-key=kube-controller-manager-key.pem \
  12.   --embed-certs=true \
  13.   --kubeconfig=kube-controller-manager.kubeconfig
  15. kubectl config set-context system:kube-controller-manager \
  16.   --cluster=kubernetes \
  17.   --user=system:kube-controller-manager \
  18.   --kubeconfig=kube-controller-manager.kubeconfig
  20. kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig

分发 kubeconfig 到所有 master 节点：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_ip in ${NODE_IPS[@]}
  4.   do
  5.     echo ">>> ${node_ip}"
  6.     scp kube-controller-manager.kubeconfig root@${node_ip}:/etc/kubernetes/
  7.   done

创建 kube-controller-manager systemd unit 模板文件

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. cat > kube-controller-manager.service.template <<EOF
  4. [Unit]
  5. Description=Kubernetes Controller Manager
  6. Documentation=https://github.com/GoogleCloudPlatform/kubernetes
  8. [Service]
  9. WorkingDirectory=${K8S_DIR}/kube-controller-manager
  10. ExecStart=/opt/k8s/bin/kube-controller-manager \\
  11.   --profiling \\
  12.   --cluster-name=kubernetes \\
  13.   --controllers=*,bootstrapsigner,tokencleaner \\
  14.   --kube-api-qps=1000 \\
  15.   --kube-api-burst=2000 \\
  16.   --leader-elect \\
  17.   --use-service-account-credentials\\
  18.   --concurrent-service-syncs=2 \\
  19.   --bind-address=##NODE_IP## \\
  20.   --secure-port=10252 \\
  21.   --tls-cert-file=/etc/kubernetes/cert/kube-controller-manager.pem \\
  22.   --tls-private-key-file=/etc/kubernetes/cert/kube-controller-manager-key.pem \\
  23.   --port=0 \\
  24.   --authentication-kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\
  25.   --client-ca-file=/etc/kubernetes/cert/ca.pem \\
  26.   --requestheader-allowed-names="" \\
  27.   --requestheader-client-ca-file=/etc/kubernetes/cert/ca.pem \\
  28.   --requestheader-extra-headers-prefix="X-Remote-Extra-" \\
  29.   --requestheader-group-headers=X-Remote-Group \\
  30.   --requestheader-username-headers=X-Remote-User \\
  31.   --authorization-kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\
  32.   --cluster-signing-cert-file=/etc/kubernetes/cert/ca.pem \\
  33.   --cluster-signing-key-file=/etc/kubernetes/cert/ca-key.pem \\
  34.   --experimental-cluster-signing-duration=876000h \\
  35.   --horizontal-pod-autoscaler-sync-period=10s \\
  36.   --concurrent-deployment-syncs=10 \\
  37.   --concurrent-gc-syncs=30 \\
  38.   --node-cidr-mask-size=24 \\
  39.   --service-cluster-ip-range=${SERVICE_CIDR} \\
  40.   --pod-eviction-timeout=6m \\
  41.   --terminated-pod-gc-threshold=10000 \\
  42.   --root-ca-file=/etc/kubernetes/cert/ca.pem \\
  43.   --service-account-private-key-file=/etc/kubernetes/cert/ca-key.pem \\
  44.   --kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\
  45.   --logtostderr=true \\
  46.   --v=2
  47. Restart=on-failure
  48. RestartSec=5
  50. [Install]
  51. WantedBy=multi-user.target
  52. EOF
  • --port=0：关闭监听非安全端口（http），同时 --address 参数无效，--bind-address 参数有效；
  • --secure-port=10252、--bind-address=0.0.0.0: 在所有网络接口监听 10252 端口的 https /metrics 请求；
  • --kubeconfig：指定 kubeconfig 文件路径，kube-controller-manager 使用它连接和验证 kube-apiserver；
  • --authentication-kubeconfig 和 --authorization-kubeconfig：kube-controller-manager 使用它连接 apiserver，对 client 的请求进行认证和授权。kube-controller-manager 不再使用 --tls-ca-file 对请求 https metrics 的 Client 证书进行校验。如果没有配置这两个 kubeconfig 参数，则 client 连接 kube-controller-manager https 端口的请求会被拒绝(提示权限不足)。
  • --cluster-signing-*-file：签名 TLS Bootstrap 创建的证书；
  • --experimental-cluster-signing-duration：指定 TLS Bootstrap 证书的有效期；
  • --root-ca-file：放置到容器 ServiceAccount 中的 CA 证书，用来对 kube-apiserver 的证书进行校验；
  • --service-account-private-key-file：签名 ServiceAccount 中 Token 的私钥文件，必须和 kube-apiserver 的 --service-account-key-file 指定的公钥文件配对使用；
  • --service-cluster-ip-range ：指定 Service Cluster IP 网段，必须和 kube-apiserver 中的同名参数一致；
  • --leader-elect=true：集群运行模式，启用选举功能；被选为 leader 的节点负责处理工作，其它节点为阻塞状态；
  • --controllers=*,bootstrapsigner,tokencleaner：启用的控制器列表，tokencleaner 用于自动清理过期的 Bootstrap token；
  • --horizontal-pod-autoscaler-*：custom metrics 相关参数，支持 autoscaling/v2alpha1；
  • --tls-cert-file、--tls-private-key-file：使用 https 输出 metrics 时使用的 Server 证书和秘钥；
  • --use-service-account-credentials=true: kube-controller-manager 中各 controller 使用 serviceaccount 访问 kube-apiserver；

为各节点创建和分发 kube-controller-mananger systemd unit 文件

替换模板文件中的变量，为各节点创建 systemd unit 文件：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for (( i=0; i < 3; i++ ))
  4.   do
  5.     sed -e "s/##NODE_NAME##/${NODE_NAMES[i]}/" -e "s/##NODE_IP##/${NODE_IPS[i]}/" kube-controller-manager.service.template > kube-controller-manager-${NODE_IPS[i]}.service 
  6.   done
  7. ls kube-controller-manager*.service
  • NODE_NAMES 和 NODE_IPS 为相同长度的 bash 数组，分别为节点名称和对应的 IP；

分发到所有 master 节点：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_ip in ${NODE_IPS[@]}
  4.   do
  5.     echo ">>> ${node_ip}"
  6.     scp kube-controller-manager-${node_ip}.service root@${node_ip}:/etc/systemd/system/kube-controller-manager.service
  7.   done
  • 文件重命名为 kube-controller-manager.service;

启动 kube-controller-manager 服务

  1. source /opt/k8s/bin/environment.sh
  2. for node_ip in ${NODE_IPS[@]}
  3.   do
  4.     echo ">>> ${node_ip}"
  5.     ssh root@${node_ip} "mkdir -p ${K8S_DIR}/kube-controller-manager"
  6.     ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl restart kube-controller-manager"
  7.   done
  • 启动服务前必须先创建工作目录；

检查服务运行状态

  1. source /opt/k8s/bin/environment.sh
  2. for node_ip in ${NODE_IPS[@]}
  3.   do
  4.     echo ">>> ${node_ip}"
  5.     ssh root@${node_ip} "systemctl status kube-controller-manager|grep Active"
  6.   done

确保状态为 active (running)，否则查看日志，确认原因：

  1. journalctl -u kube-controller-manager

kube-controller-manager 监听 10252 端口，接收 https 请求：

  1. $ sudo netstat -lnpt | grep kube-cont
  2. tcp        0      0 172.27.137.240:10252    0.0.0.0:*               LISTEN      108977/kube-control

查看输出的 metrics

注意：以下命令在 kube-controller-manager 节点上执行。

  1. $ curl -s --cacert /opt/k8s/work/ca.pem --cert /opt/k8s/work/admin.pem --key /opt/k8s/work/admin-key.pem https://172.27.137.240:10252/metrics |head
  2. # HELP ClusterRoleAggregator_adds (Deprecated) Total number of adds handled by workqueue: ClusterRoleAggregator
  3. # TYPE ClusterRoleAggregator_adds counter
  4. ClusterRoleAggregator_adds 3
  5. # HELP ClusterRoleAggregator_depth (Deprecated) Current depth of workqueue: ClusterRoleAggregator
  6. # TYPE ClusterRoleAggregator_depth gauge
  7. ClusterRoleAggregator_depth 0
  8. # HELP ClusterRoleAggregator_longest_running_processor_microseconds (Deprecated) How many microseconds has the longest running processor for ClusterRoleAggregator been running.
  9. # TYPE ClusterRoleAggregator_longest_running_processor_microseconds gauge
  10. ClusterRoleAggregator_longest_running_processor_microseconds 0
  11. # HELP ClusterRoleAggregator_queue_latency (Deprecated) How long an item stays in workqueueClusterRoleAggregator before being requested.

kube-controller-manager 的权限

ClusteRole system:kube-controller-manager 的权限很小，只能创建 secret、serviceaccount 等资源对象，各 controller 的权限分散到 ClusterRole system:controller:XXX 中：

  1. $ kubectl describe clusterrole system:kube-controller-manager
  2. Name:         system:kube-controller-manager
  3. Labels:       kubernetes.io/bootstrapping=rbac-defaults
  4. Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
  5. PolicyRule:
  6.   Resources                                  Non-Resource URLs  Resource Names  Verbs
  7.   ---------                                  -----------------  --------------  -----
  8.   secrets                                    []                 []              [create delete get update]
  9.   endpoints                                  []                 []              [create get update]
  10.   serviceaccounts                            []                 []              [create get update]
  11.   events                                     []                 []              [create patch update]
  12.   tokenreviews.authentication.k8s.io         []                 []              [create]
  13.   subjectaccessreviews.authorization.k8s.io  []                 []              [create]
  14.   configmaps                                 []                 []              [get]
  15.   namespaces                                 []                 []              [get]
  16.   *.*                                        []                 []              [list watch]

需要在 kube-controller-manager 的启动参数中添加 --use-service-account-credentials=true 参数，这样 main controller 会为各 controller 创建对应的 ServiceAccount XXX-controller。内置的 ClusterRoleBinding system:controller:XXX 将赋予各 XXX-controller ServiceAccount 对应的 ClusterRole system:controller:XXX 权限。

  1. $ kubectl get clusterrole|grep controller
  2. system:controller:attachdetach-controller                              51m
  3. system:controller:certificate-controller                               51m
  4. system:controller:clusterrole-aggregation-controller                   51m
  5. system:controller:cronjob-controller                                   51m
  6. system:controller:daemon-set-controller                                51m
  7. system:controller:deployment-controller                                51m
  8. system:controller:disruption-controller                                51m
  9. system:controller:endpoint-controller                                  51m
  10. system:controller:expand-controller                                    51m
  11. system:controller:generic-garbage-collector                            51m
  12. system:controller:horizontal-pod-autoscaler                            51m
  13. system:controller:job-controller                                       51m
  14. system:controller:namespace-controller                                 51m
  15. system:controller:node-controller                                      51m
  16. system:controller:persistent-volume-binder                             51m
  17. system:controller:pod-garbage-collector                                51m
  18. system:controller:pv-protection-controller                             51m
  19. system:controller:pvc-protection-controller                            51m
  20. system:controller:replicaset-controller                                51m
  21. system:controller:replication-controller                               51m
  22. system:controller:resourcequota-controller                             51m
  23. system:controller:route-controller                                     51m
  24. system:controller:service-account-controller                           51m
  25. system:controller:service-controller                                   51m
  26. system:controller:statefulset-controller                               51m
  27. system:controller:ttl-controller                                       51m
  28. system:kube-controller-manager                                         51m

以 deployment controller 为例：

  1. $ kubectl describe clusterrole system:controller:deployment-controller
  2. Name:         system:controller:deployment-controller
  3. Labels:       kubernetes.io/bootstrapping=rbac-defaults
  4. Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
  5. PolicyRule:
  6.   Resources                          Non-Resource URLs  Resource Names  Verbs
  7.   ---------                          -----------------  --------------  -----
  8.   replicasets.apps                   []                 []              [create delete get list patch update watch]
  9.   replicasets.extensions             []                 []              [create delete get list patch update watch]
  10.   events                             []                 []              [create patch update]
  11.   pods                               []                 []              [get list update watch]
  12.   deployments.apps                   []                 []              [get list update watch]
  13.   deployments.extensions             []                 []              [get list update watch]
  14.   deployments.apps/finalizers        []                 []              [update]
  15.   deployments.apps/status            []                 []              [update]
  16.   deployments.extensions/finalizers  []                 []              [update]
  17.   deployments.extensions/status      []                 []              [update]

查看当前的 leader

  1. $ kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
  2. apiVersion: v1
  3. kind: Endpoints
  4. metadata:
  5.   annotations:
  6.     control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"zhangjun-k8s01_6537b938-7f5a-11e9-8487-00220d338975","leaseDurationSeconds":15,"acquireTime":"2019-05-26T02:03:18Z","renewTime":"2019-05-26T02:06:08Z","leaderTransitions":1}'
  7.   creationTimestamp: "2019-05-26T01:52:39Z"
  8.   name: kube-controller-manager
  9.   namespace: kube-system
  10.   resourceVersion: "1965"
  11.   selfLink: /api/v1/namespaces/kube-system/endpoints/kube-controller-manager
  12.   uid: f1755fc5-7f58-11e9-b4c4-00220d338975

可见，当前的 leader 为 zhangjun-k8s01 节点。

测试 kube-controller-manager 集群的高可用

停掉一个或两个节点的 kube-controller-manager 服务，观察其它节点的日志，看是否获取了 leader 权限。

参考

  1. 关于 controller 权限和 use-service-account-credentials 参数：https://github.com/kubernetes/kubernetes/issues/48208
  2. kubelet 认证和授权：https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization