07-2.部署 kubelet 组件

kubelet 运行在每个 worker 节点上,接收 kube-apiserver 发送的请求,管理 Pod 容器,执行交互式命令,如 exec、run、logs 等。

kubelet 启动时自动向 kube-apiserver 注册节点信息,内置的 cadvisor 统计和监控节点的资源使用情况。

为确保安全,部署时关闭了 kubelet 的非安全 http 端口,对请求进行认证和授权,拒绝未授权的访问(如 apiserver、heapster 的请求)。

注意:如果没有特殊指明,本文档的所有操作均在 zhangjun-k8s01 节点上执行,然后远程分发文件和执行命令。

下载和分发 kubelet 二进制文件

参考 06-1.部署master节点.md

安装依赖包

参考 07-0.部署worker节点.md

创建 kubelet bootstrap kubeconfig 文件

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_name in ${NODE_NAMES[@]}
  4. do
  5. echo ">>> ${node_name}"
  6. # 创建 token
  7. export BOOTSTRAP_TOKEN=$(kubeadm token create \
  8. --description kubelet-bootstrap-token \
  9. --groups system:bootstrappers:${node_name} \
  10. --kubeconfig ~/.kube/config)
  11. # 设置集群参数
  12. kubectl config set-cluster kubernetes \
  13. --certificate-authority=/etc/kubernetes/cert/ca.pem \
  14. --embed-certs=true \
  15. --server=${KUBE_APISERVER} \
  16. --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  17. # 设置客户端认证参数
  18. kubectl config set-credentials kubelet-bootstrap \
  19. --token=${BOOTSTRAP_TOKEN} \
  20. --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  21. # 设置上下文参数
  22. kubectl config set-context default \
  23. --cluster=kubernetes \
  24. --user=kubelet-bootstrap \
  25. --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  26. # 设置默认上下文
  27. kubectl config use-context default --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  28. done
  • 向 kubeconfig 写入的是 token,bootstrap 结束后 kube-controller-manager 为 kubelet 创建 client 和 server 证书;

查看 kubeadm 为各节点创建的 token:

  1. $ kubeadm token list --kubeconfig ~/.kube/config
  2. TOKEN TTL EXPIRES USAGES DESCRIPTION EXTRA GROUPS
  3. 3gzd53.ahl5unc2d09yjid9 23h 2019-05-27T11:29:57+08:00 authentication,signing kubelet-bootstrap-token system:bootstrappers:zhangjun-k8s02
  4. 82jfrm.um1mkjkr7w2c7ex9 23h 2019-05-27T11:29:56+08:00 authentication,signing kubelet-bootstrap-token system:bootstrappers:zhangjun-k8s01
  5. b1f7np.lwnnzur3i8ymtkur 23h 2019-05-27T11:29:57+08:00 authentication,signing kubelet-bootstrap-token system:bootstrappers:zhangjun-k8s03
  • token 有效期为 1 天,超期后将不能再被用来 boostrap kubelet,且会被 kube-controller-manager 的 tokencleaner 清理;
  • kube-apiserver 接收 kubelet 的 bootstrap token 后,将请求的 user 设置为 system:bootstrap:<Token ID>,group 设置为 system:bootstrappers,后续将为这个 group 设置 ClusterRoleBinding;

查看各 token 关联的 Secret:

  1. $ kubectl get secrets -n kube-system|grep bootstrap-token
  2. bootstrap-token-3gzd53 bootstrap.kubernetes.io/token 7 33s
  3. bootstrap-token-82jfrm bootstrap.kubernetes.io/token 7 34s
  4. bootstrap-token-b1f7np bootstrap.kubernetes.io/token 7 33s

分发 bootstrap kubeconfig 文件到所有 worker 节点

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_name in ${NODE_NAMES[@]}
  4. do
  5. echo ">>> ${node_name}"
  6. scp kubelet-bootstrap-${node_name}.kubeconfig root@${node_name}:/etc/kubernetes/kubelet-bootstrap.kubeconfig
  7. done

创建和分发 kubelet 参数配置文件

从 v1.10 开始,部分 kubelet 参数需在配置文件中配置,kubelet --help 会提示:

  1. DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag

创建 kubelet 参数配置文件模板(可配置项参考代码中注释 ):

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. cat > kubelet-config.yaml.template <<EOF
  4. kind: KubeletConfiguration
  5. apiVersion: kubelet.config.k8s.io/v1beta1
  6. address: "##NODE_IP##"
  7. staticPodPath: ""
  8. syncFrequency: 1m
  9. fileCheckFrequency: 20s
  10. httpCheckFrequency: 20s
  11. staticPodURL: ""
  12. port: 10250
  13. readOnlyPort: 0
  14. rotateCertificates: true
  15. serverTLSBootstrap: true
  16. authentication:
  17. anonymous:
  18. enabled: false
  19. webhook:
  20. enabled: true
  21. x509:
  22. clientCAFile: "/etc/kubernetes/cert/ca.pem"
  23. authorization:
  24. mode: Webhook
  25. registryPullQPS: 0
  26. registryBurst: 20
  27. eventRecordQPS: 0
  28. eventBurst: 20
  29. enableDebuggingHandlers: true
  30. enableContentionProfiling: true
  31. healthzPort: 10248
  32. healthzBindAddress: "##NODE_IP##"
  33. clusterDomain: "${CLUSTER_DNS_DOMAIN}"
  34. clusterDNS:
  35. - "${CLUSTER_DNS_SVC_IP}"
  36. nodeStatusUpdateFrequency: 10s
  37. nodeStatusReportFrequency: 1m
  38. imageMinimumGCAge: 2m
  39. imageGCHighThresholdPercent: 85
  40. imageGCLowThresholdPercent: 80
  41. volumeStatsAggPeriod: 1m
  42. kubeletCgroups: ""
  43. systemCgroups: ""
  44. cgroupRoot: ""
  45. cgroupsPerQOS: true
  46. cgroupDriver: cgroupfs
  47. runtimeRequestTimeout: 10m
  48. hairpinMode: promiscuous-bridge
  49. maxPods: 220
  50. podCIDR: "${CLUSTER_CIDR}"
  51. podPidsLimit: -1
  52. resolvConf: /etc/resolv.conf
  53. maxOpenFiles: 1000000
  54. kubeAPIQPS: 1000
  55. kubeAPIBurst: 2000
  56. serializeImagePulls: false
  57. evictionHard:
  58. memory.available: "100Mi"
  59. nodefs.available: "10%"
  60. nodefs.inodesFree: "5%"
  61. imagefs.available: "15%"
  62. evictionSoft: {}
  63. enableControllerAttachDetach: true
  64. failSwapOn: true
  65. containerLogMaxSize: 20Mi
  66. containerLogMaxFiles: 10
  67. systemReserved: {}
  68. kubeReserved: {}
  69. systemReservedCgroup: ""
  70. kubeReservedCgroup: ""
  71. enforceNodeAllocatable: ["pods"]
  72. EOF
  • address:kubelet 安全端口(https,10250)监听的地址,不能为 127.0.0.1,否则 kube-apiserver、heapster 等不能调用 kubelet 的 API;
  • readOnlyPort=0:关闭只读端口(默认 10255),等效为未指定;
  • authentication.anonymous.enabled:设置为 false,不允许匿名访问 10250 端口;
  • authentication.x509.clientCAFile:指定签名客户端证书的 CA 证书,开启 HTTP 证书认证;
  • authentication.webhook.enabled=true:开启 HTTPs bearer token 认证;
  • 对于未通过 x509 证书和 webhook 认证的请求(kube-apiserver 或其他客户端),将被拒绝,提示 Unauthorized;
  • authroization.mode=Webhook:kubelet 使用 SubjectAccessReview API 查询 kube-apiserver 某 user、group 是否具有操作资源的权限(RBAC);
  • featureGates.RotateKubeletClientCertificate、featureGates.RotateKubeletServerCertificate:自动 rotate 证书,证书的有效期取决于 kube-controller-manager 的 —experimental-cluster-signing-duration 参数;
  • 需要 root 账户运行;

为各节点创建和分发 kubelet 配置文件:

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_ip in ${NODE_IPS[@]}
  4. do
  5. echo ">>> ${node_ip}"
  6. sed -e "s/##NODE_IP##/${node_ip}/" kubelet-config.yaml.template > kubelet-config-${node_ip}.yaml.template
  7. scp kubelet-config-${node_ip}.yaml.template root@${node_ip}:/etc/kubernetes/kubelet-config.yaml
  8. done

创建和分发 kubelet systemd unit 文件

创建 kubelet systemd unit 文件模板:

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. cat > kubelet.service.template <<EOF
  4. [Unit]
  5. Description=Kubernetes Kubelet
  6. Documentation=https://github.com/GoogleCloudPlatform/kubernetes
  7. After=docker.service
  8. Requires=docker.service
  9. [Service]
  10. WorkingDirectory=${K8S_DIR}/kubelet
  11. ExecStart=/opt/k8s/bin/kubelet \\
  12. --allow-privileged=true \\
  13. --bootstrap-kubeconfig=/etc/kubernetes/kubelet-bootstrap.kubeconfig \\
  14. --cert-dir=/etc/kubernetes/cert \\
  15. --cni-conf-dir=/etc/cni/net.d \\
  16. --container-runtime=docker \\
  17. --container-runtime-endpoint=unix:///var/run/dockershim.sock \\
  18. --root-dir=${K8S_DIR}/kubelet \\
  19. --kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\
  20. --config=/etc/kubernetes/kubelet-config.yaml \\
  21. --hostname-override=##NODE_NAME## \\
  22. --pod-infra-container-image=registry.cn-beijing.aliyuncs.com/images_k8s/pause-amd64:3.1 \\
  23. --image-pull-progress-deadline=15m \\
  24. --volume-plugin-dir=${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/ \\
  25. --logtostderr=true \\
  26. --v=2
  27. Restart=always
  28. RestartSec=5
  29. StartLimitInterval=0
  30. [Install]
  31. WantedBy=multi-user.target
  32. EOF
  • 如果设置了 --hostname-override 选项,则 kube-proxy 也需要设置该选项,否则会出现找不到 Node 的情况;
  • --bootstrap-kubeconfig:指向 bootstrap kubeconfig 文件,kubelet 使用该文件中的用户名和 token 向 kube-apiserver 发送 TLS Bootstrapping 请求;
  • K8S approve kubelet 的 csr 请求后,在 --cert-dir 目录创建证书和私钥文件,然后写入 --kubeconfig 文件;
  • --pod-infra-container-image 不使用 redhat 的 pod-infrastructure:latest 镜像,它不能回收容器的僵尸;

为各节点创建和分发 kubelet systemd unit 文件:

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_name in ${NODE_NAMES[@]}
  4. do
  5. echo ">>> ${node_name}"
  6. sed -e "s/##NODE_NAME##/${node_name}/" kubelet.service.template > kubelet-${node_name}.service
  7. scp kubelet-${node_name}.service root@${node_name}:/etc/systemd/system/kubelet.service
  8. done

Bootstrap Token Auth 和授予权限

kubelet 启动时查找 --kubeletconfig 参数对应的文件是否存在,如果不存在则使用 --bootstrap-kubeconfig 指定的 kubeconfig 文件向 kube-apiserver 发送证书签名请求 (CSR)。

kube-apiserver 收到 CSR 请求后,对其中的 Token 进行认证,认证通过后将请求的 user 设置为 system:bootstrap:<Token ID>,group 设置为 system:bootstrappers,这一过程称为 Bootstrap Token Auth。

默认情况下,这个 user 和 group 没有创建 CSR 的权限,kubelet 启动失败,错误日志如下:

  1. $ sudo journalctl -u kubelet -a |grep -A 2 'certificatesigningrequests'
  2. May 26 12:13:41 zhangjun-k8s01 kubelet[128468]: I0526 12:13:41.798230 128468 certificate_manager.go:366] Rotating certificates
  3. May 26 12:13:41 zhangjun-k8s01 kubelet[128468]: E0526 12:13:41.801997 128468 certificate_manager.go:385] Failed while requesting a signed certificate from the master: cannot cre
  4. ate certificate signing request: certificatesigningrequests.certificates.k8s.io is forbidden: User "system:bootstrap:82jfrm" cannot create resource "certificatesigningrequests" i
  5. n API group "certificates.k8s.io" at the cluster scope
  6. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.044828 128468 kubelet.go:2244] node "zhangjun-k8s01" not found
  7. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.078658 128468 reflector.go:126] k8s.io/kubernetes/pkg/kubelet/kubelet.go:442: Failed to list *v1.Service: Unauthor
  8. ized
  9. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.079873 128468 reflector.go:126] k8s.io/kubernetes/pkg/kubelet/kubelet.go:451: Failed to list *v1.Node: Unauthorize
  10. d
  11. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.082683 128468 reflector.go:126] k8s.io/client-go/informers/factory.go:133: Failed to list *v1beta1.CSIDriver: Unau
  12. thorized
  13. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.084473 128468 reflector.go:126] k8s.io/kubernetes/pkg/kubelet/config/apiserver.go:47: Failed to list *v1.Pod: Unau
  14. thorized
  15. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.088466 128468 reflector.go:126] k8s.io/client-go/informers/factory.go:133: Failed to list *v1beta1.RuntimeClass: U
  16. nauthorized

解决办法是:创建一个 clusterrolebinding,将 group system:bootstrappers 和 clusterrole system:node-bootstrapper 绑定:

  1. $ kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --group=system:bootstrappers

启动 kubelet 服务

  1. source /opt/k8s/bin/environment.sh
  2. for node_ip in ${NODE_IPS[@]}
  3. do
  4. echo ">>> ${node_ip}"
  5. ssh root@${node_ip} "mkdir -p ${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/"
  6. ssh root@${node_ip} "/usr/sbin/swapoff -a"
  7. ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kubelet && systemctl restart kubelet"
  8. done
  • 启动服务前必须先创建工作目录;
  • 关闭 swap 分区,否则 kubelet 会启动失败;
  1. $ journalctl -u kubelet |tail
  2. 8 15 12:16:49 zhangjun-k8s01 kubelet[7807]: I0815 12:16:49.578598 7807 feature_gate.go:230] feature gates: &{map[RotateKubeletClientCertificate:true RotateKubeletServerCertificate:true]}
  3. 8 15 12:16:49 zhangjun-k8s01 kubelet[7807]: I0815 12:16:49.578698 7807 feature_gate.go:230] feature gates: &{map[RotateKubeletClientCertificate:true RotateKubeletServerCertificate:true]}
  4. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.205871 7807 mount_linux.go:214] Detected OS with systemd
  5. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.205939 7807 server.go:408] Version: v1.11.2
  6. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206013 7807 feature_gate.go:230] feature gates: &{map[RotateKubeletClientCertificate:true RotateKubeletServerCertificate:true]}
  7. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206101 7807 feature_gate.go:230] feature gates: &{map[RotateKubeletServerCertificate:true RotateKubeletClientCertificate:true]}
  8. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206217 7807 plugins.go:97] No cloud provider specified.
  9. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206237 7807 server.go:524] No cloud provider specified: "" from the config file: ""
  10. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206264 7807 bootstrap.go:56] Using bootstrap kubeconfig to generate TLS client cert, key and kubeconfig file
  11. 8 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.208628 7807 bootstrap.go:86] No valid private key and/or certificate found, reusing existing private key or creating a new one

kubelet 启动后使用 —bootstrap-kubeconfig 向 kube-apiserver 发送 CSR 请求,当这个 CSR 被 approve 后,kube-controller-manager 为 kubelet 创建 TLS 客户端证书、私钥和 —kubeletconfig 文件。

注意:kube-controller-manager 需要配置 --cluster-signing-cert-file--cluster-signing-key-file 参数,才会为 TLS Bootstrap 创建证书和私钥。

  1. $ kubectl get csr
  2. NAME AGE REQUESTOR CONDITION
  3. csr-5f4vh 31s system:bootstrap:82jfrm Pending
  4. csr-5rw7s 29s system:bootstrap:b1f7np Pending
  5. csr-m29fm 31s system:bootstrap:3gzd53 Pending
  6. $ kubectl get nodes
  7. No resources found.
  • 三个 worker 节点的 csr 均处于 pending 状态;

自动 approve CSR 请求

创建三个 ClusterRoleBinding,分别用于自动 approve client、renew client、renew server 证书:

  1. cd /opt/k8s/work
  2. cat > csr-crb.yaml <<EOF
  3. # Approve all CSRs for the group "system:bootstrappers"
  4. kind: ClusterRoleBinding
  5. apiVersion: rbac.authorization.k8s.io/v1
  6. metadata:
  7. name: auto-approve-csrs-for-group
  8. subjects:
  9. - kind: Group
  10. name: system:bootstrappers
  11. apiGroup: rbac.authorization.k8s.io
  12. roleRef:
  13. kind: ClusterRole
  14. name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
  15. apiGroup: rbac.authorization.k8s.io
  16. ---
  17. # To let a node of the group "system:nodes" renew its own credentials
  18. kind: ClusterRoleBinding
  19. apiVersion: rbac.authorization.k8s.io/v1
  20. metadata:
  21. name: node-client-cert-renewal
  22. subjects:
  23. - kind: Group
  24. name: system:nodes
  25. apiGroup: rbac.authorization.k8s.io
  26. roleRef:
  27. kind: ClusterRole
  28. name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
  29. apiGroup: rbac.authorization.k8s.io
  30. ---
  31. # A ClusterRole which instructs the CSR approver to approve a node requesting a
  32. # serving cert matching its client cert.
  33. kind: ClusterRole
  34. apiVersion: rbac.authorization.k8s.io/v1
  35. metadata:
  36. name: approve-node-server-renewal-csr
  37. rules:
  38. - apiGroups: ["certificates.k8s.io"]
  39. resources: ["certificatesigningrequests/selfnodeserver"]
  40. verbs: ["create"]
  41. ---
  42. # To let a node of the group "system:nodes" renew its own server credentials
  43. kind: ClusterRoleBinding
  44. apiVersion: rbac.authorization.k8s.io/v1
  45. metadata:
  46. name: node-server-cert-renewal
  47. subjects:
  48. - kind: Group
  49. name: system:nodes
  50. apiGroup: rbac.authorization.k8s.io
  51. roleRef:
  52. kind: ClusterRole
  53. name: approve-node-server-renewal-csr
  54. apiGroup: rbac.authorization.k8s.io
  55. EOF
  56. kubectl apply -f csr-crb.yaml
  • auto-approve-csrs-for-group:自动 approve node 的第一次 CSR; 注意第一次 CSR 时,请求的 Group 为 system:bootstrappers;
  • node-client-cert-renewal:自动 approve node 后续过期的 client 证书,自动生成的证书 Group 为 system:nodes;
  • node-server-cert-renewal:自动 approve node 后续过期的 server 证书,自动生成的证书 Group 为 system:nodes;

查看 kubelet 的情况

等待一段时间(1-10 分钟),三个节点的 CSR 都被自动 approved:

  1. $ kubectl get csr
  2. NAME AGE REQUESTOR CONDITION
  3. csr-5f4vh 7m59s system:bootstrap:82jfrm Approved,Issued
  4. csr-5r7j7 4m45s system:node:zhangjun-k8s03 Pending
  5. csr-5rw7s 7m57s system:bootstrap:b1f7np Approved,Issued
  6. csr-9snww 6m37s system:bootstrap:82jfrm Approved,Issued
  7. csr-c7z56 4m46s system:node:zhangjun-k8s02 Pending
  8. csr-j55lh 4m46s system:node:zhangjun-k8s01 Pending
  9. csr-m29fm 7m59s system:bootstrap:3gzd53 Approved,Issued
  10. csr-rc8w7 6m37s system:bootstrap:3gzd53 Approved,Issued
  11. csr-vd52r 6m36s system:bootstrap:b1f7np Approved,Issued
  • Pending 的 CSR 用于创建 kubelet server 证书,需要手动 approve,参考后文。

所有节点均 ready:

  1. $ kubectl get nodes
  2. NAME STATUS ROLES AGE VERSION
  3. zhangjun-k8s01 Ready <none> 5m5s v1.14.2
  4. zhangjun-k8s02 Ready <none> 5m5s v1.14.2
  5. zhangjun-k8s03 Ready <none> 5m4s v1.14.2

kube-controller-manager 为各 node 生成了 kubeconfig 文件和公私钥:

  1. $ ls -l /etc/kubernetes/kubelet.kubeconfig
  2. -rw------- 1 root root 2306 May 26 12:17 /etc/kubernetes/kubelet.kubeconfig
  3. $ ls -l /etc/kubernetes/cert/|grep kubelet
  4. -rw------- 1 root root 1281 May 26 12:19 kubelet-client-2019-05-26-12-19-25.pem
  5. lrwxrwxrwx 1 root root 59 May 26 12:19 kubelet-client-current.pem -> /etc/kubernetes/cert/kubelet-client-2019-05-26-12-19-25.pem
  • 没有自动生成 kubelet server 证书;

手动 approve server cert csr

基于安全性考虑,CSR approving controllers 不会自动 approve kubelet server 证书签名请求,需要手动 approve:

  1. $ kubectl get csr
  2. NAME AGE REQUESTOR CONDITION
  3. csr-5f4vh 9m25s system:bootstrap:82jfrm Approved,Issued
  4. csr-5r7j7 6m11s system:node:zhangjun-k8s03 Pending
  5. csr-5rw7s 9m23s system:bootstrap:b1f7np Approved,Issued
  6. csr-9snww 8m3s system:bootstrap:82jfrm Approved,Issued
  7. csr-c7z56 6m12s system:node:zhangjun-k8s02 Pending
  8. csr-j55lh 6m12s system:node:zhangjun-k8s01 Pending
  9. csr-m29fm 9m25s system:bootstrap:3gzd53 Approved,Issued
  10. csr-rc8w7 8m3s system:bootstrap:3gzd53 Approved,Issued
  11. csr-vd52r 8m2s system:bootstrap:b1f7np Approved,Issued
  12. $ kubectl certificate approve csr-5r7j7
  13. certificatesigningrequest.certificates.k8s.io/csr-5r7j7 approved
  14. $ kubectl certificate approve csr-c7z56
  15. certificatesigningrequest.certificates.k8s.io/csr-c7z56 approved
  16. $ kubectl certificate approve csr-j55lh
  17. certificatesigningrequest.certificates.k8s.io/csr-j55lh approved
  18. $ ls -l /etc/kubernetes/cert/kubelet-*
  19. -rw------- 1 root root 1281 May 26 12:19 /etc/kubernetes/cert/kubelet-client-2019-05-26-12-19-25.pem
  20. lrwxrwxrwx 1 root root 59 May 26 12:19 /etc/kubernetes/cert/kubelet-client-current.pem -> /etc/kubernetes/cert/kubelet-client-2019-05-26-12-19-25.pem
  21. -rw------- 1 root root 1326 May 26 12:26 /etc/kubernetes/cert/kubelet-server-2019-05-26-12-26-39.pem
  22. lrwxrwxrwx 1 root root 59 May 26 12:26 /etc/kubernetes/cert/kubelet-server-current.pem -> /etc/kubernetes/cert/kubelet-server-2019-05-26-12-26-39.pem

kubelet 提供的 API 接口

kubelet 启动后监听多个端口,用于接收 kube-apiserver 或其它客户端发送的请求:

  1. $ sudo netstat -lnpt|grep kubelet
  2. tcp 0 0 127.0.0.1:46571 0.0.0.0:* LISTEN 129697/kubelet
  3. tcp 0 0 172.27.137.240:10248 0.0.0.0:* LISTEN 129697/kubelet
  4. tcp 0 0 172.27.137.240:10250 0.0.0.0:* LISTEN 129697/kubelet
  • 10248: healthz http 服务;
  • 10250: https 服务,访问该端口时需要认证和授权(即使访问 /healthz 也需要);
  • 未开启只读端口 10255;
  • 从 K8S v1.10 开始,去除了 --cadvisor-port 参数(默认 4194 端口),不支持访问 cAdvisor UI & API。

例如执行 kubectl exec -it nginx-ds-5rmws -- sh 命令时,kube-apiserver 会向 kubelet 发送如下请求:

  1. POST /exec/default/nginx-ds-5rmws/my-nginx?command=sh&input=1&output=1&tty=1

kubelet 接收 10250 端口的 https 请求,可以访问如下资源:

  • /pods、/runningpods
  • /metrics、/metrics/cadvisor、/metrics/probes
  • /spec
  • /stats、/stats/container
  • /logs
  • /run/、/exec/, /attach/, /portForward/, /containerLogs/

详情参考:https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/server/server.go#L434:3

由于关闭了匿名认证,同时开启了 webhook 授权,所有访问 10250 端口 https API 的请求都需要被认证和授权。

预定义的 ClusterRole system:kubelet-api-admin 授予访问 kubelet 所有 API 的权限(kube-apiserver 使用的 kubernetes 证书 User 授予了该权限):

  1. $ kubectl describe clusterrole system:kubelet-api-admin
  2. Name: system:kubelet-api-admin
  3. Labels: kubernetes.io/bootstrapping=rbac-defaults
  4. Annotations: rbac.authorization.kubernetes.io/autoupdate=true
  5. PolicyRule:
  6. Resources Non-Resource URLs Resource Names Verbs
  7. --------- ----------------- -------------- -----
  8. nodes [] [] [get list watch proxy]
  9. nodes/log [] [] [*]
  10. nodes/metrics [] [] [*]
  11. nodes/proxy [] [] [*]
  12. nodes/spec [] [] [*]
  13. nodes/stats [] [] [*]

kubelet api 认证和授权

kubelet 配置了如下认证参数:

  • authentication.anonymous.enabled:设置为 false,不允许匿名访问 10250 端口;
  • authentication.x509.clientCAFile:指定签名客户端证书的 CA 证书,开启 HTTPs 证书认证;
  • authentication.webhook.enabled=true:开启 HTTPs bearer token 认证;

同时配置了如下授权参数:

  • authroization.mode=Webhook:开启 RBAC 授权;

kubelet 收到请求后,使用 clientCAFile 对证书签名进行认证,或者查询 bearer token 是否有效。如果两者都没通过,则拒绝请求,提示 Unauthorized:

  1. $ curl -s --cacert /etc/kubernetes/cert/ca.pem https://172.27.137.240:10250/metrics
  2. Unauthorized
  3. $ curl -s --cacert /etc/kubernetes/cert/ca.pem -H "Authorization: Bearer 123456" https://172.27.137.240:10250/metrics
  4. Unauthorized

通过认证后,kubelet 使用 SubjectAccessReview API 向 kube-apiserver 发送请求,查询证书或 token 对应的 user、group 是否有操作资源的权限(RBAC);

证书认证和授权

  1. $ # 权限不足的证书;
  2. $ curl -s --cacert /etc/kubernetes/cert/ca.pem --cert /etc/kubernetes/cert/kube-controller-manager.pem --key /etc/kubernetes/cert/kube-controller-manager-key.pem https://172.27.137.240:10250/metrics
  3. Forbidden (user=system:kube-controller-manager, verb=get, resource=nodes, subresource=metrics)
  4. $ # 使用部署 kubectl 命令行工具时创建的、具有最高权限的 admin 证书;
  5. $ curl -s --cacert /etc/kubernetes/cert/ca.pem --cert /opt/k8s/work/admin.pem --key /opt/k8s/work/admin-key.pem https://172.27.137.240:10250/metrics|head
  6. # HELP apiserver_audit_event_total Counter of audit events generated and sent to the audit backend.
  7. # TYPE apiserver_audit_event_total counter
  8. apiserver_audit_event_total 0
  9. # HELP apiserver_audit_requests_rejected_total Counter of apiserver requests rejected due to an error in audit logging backend.
  10. # TYPE apiserver_audit_requests_rejected_total counter
  11. apiserver_audit_requests_rejected_total 0
  12. # HELP apiserver_client_certificate_expiration_seconds Distribution of the remaining lifetime on the certificate used to authenticate a request.
  13. # TYPE apiserver_client_certificate_expiration_seconds histogram
  14. apiserver_client_certificate_expiration_seconds_bucket{le="0"} 0
  15. apiserver_client_certificate_expiration_seconds_bucket{le="1800"} 0
  • --cacert--cert--key 的参数值必须是文件路径,如上面的 ./admin.pem 不能省略 ./,否则返回 401 Unauthorized

bear token 认证和授权

创建一个 ServiceAccount,将它和 ClusterRole system:kubelet-api-admin 绑定,从而具有调用 kubelet API 的权限:

  1. kubectl create sa kubelet-api-test
  2. kubectl create clusterrolebinding kubelet-api-test --clusterrole=system:kubelet-api-admin --serviceaccount=default:kubelet-api-test
  3. SECRET=$(kubectl get secrets | grep kubelet-api-test | awk '{print $1}')
  4. TOKEN=$(kubectl describe secret ${SECRET} | grep -E '^token' | awk '{print $2}')
  5. echo ${TOKEN}
  1. $ curl -s --cacert /etc/kubernetes/cert/ca.pem -H "Authorization: Bearer ${TOKEN}" https://172.27.137.240:10250/metrics|head
  2. # HELP apiserver_audit_event_total Counter of audit events generated and sent to the audit backend.
  3. # TYPE apiserver_audit_event_total counter
  4. apiserver_audit_event_total 0
  5. # HELP apiserver_audit_requests_rejected_total Counter of apiserver requests rejected due to an error in audit logging backend.
  6. # TYPE apiserver_audit_requests_rejected_total counter
  7. apiserver_audit_requests_rejected_total 0
  8. # HELP apiserver_client_certificate_expiration_seconds Distribution of the remaining lifetime on the certificate used to authenticate a request.
  9. # TYPE apiserver_client_certificate_expiration_seconds histogram
  10. apiserver_client_certificate_expiration_seconds_bucket{le="0"} 0
  11. apiserver_client_certificate_expiration_seconds_bucket{le="1800"} 0

cadvisor 和 metrics

cadvisor 是内嵌在 kubelet 二进制中的,统计所在节点各容器的资源(CPU、内存、磁盘、网卡)使用情况的服务。

浏览器访问 https://172.27.137.240:10250/metricshttps://172.27.137.240:10250/metrics/cadvisor 分别返回 kubelet 和 cadvisor 的 metrics。

kubelet-metrics cadvisor-metrics

注意:

  • kubelet.config.json 设置 authentication.anonymous.enabled 为 false,不允许匿名证书访问 10250 的 https 服务;
  • 参考A.浏览器访问kube-apiserver安全端口.md,创建和导入相关证书,然后访问上面的 10250 端口;

获取 kubelet 的配置

从 kube-apiserver 获取各节点 kubelet 的配置:

  1. $ # 使用部署 kubectl 命令行工具时创建的、具有最高权限的 admin 证书;
  2. $ source /opt/k8s/bin/environment.sh
  3. $ sudo curl -sSL --cacert /etc/kubernetes/cert/ca.pem --cert /opt/k8s/work/admin.pem --key /opt/k8s/work/admin-key.pem ${KUBE_APISERVER}/api/v1/nodes/zhangjun-k8s01/proxy/configz | jq \
  4. '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"'
  5. {
  6. "syncFrequency": "1m0s",
  7. "fileCheckFrequency": "20s",
  8. "httpCheckFrequency": "20s",
  9. "address": "172.27.137.240",
  10. "port": 10250,
  11. "rotateCertificates": true,
  12. "serverTLSBootstrap": true,
  13. "authentication": {
  14. "x509": {
  15. "clientCAFile": "/etc/kubernetes/cert/ca.pem"
  16. },
  17. "webhook": {
  18. "enabled": true,
  19. "cacheTTL": "2m0s"
  20. },
  21. "anonymous": {
  22. "enabled": false
  23. }
  24. },
  25. "authorization": {
  26. "mode": "Webhook",
  27. "webhook": {
  28. "cacheAuthorizedTTL": "5m0s",
  29. "cacheUnauthorizedTTL": "30s"
  30. }
  31. },
  32. "registryPullQPS": 0,
  33. "registryBurst": 20,
  34. "eventRecordQPS": 0,
  35. "eventBurst": 20,
  36. "enableDebuggingHandlers": true,
  37. "enableContentionProfiling": true,
  38. "healthzPort": 10248,
  39. "healthzBindAddress": "172.27.137.240",
  40. "oomScoreAdj": -999,
  41. "clusterDomain": "cluster.local",
  42. "clusterDNS": [
  43. "10.254.0.2"
  44. ],
  45. "streamingConnectionIdleTimeout": "4h0m0s",
  46. "nodeStatusUpdateFrequency": "10s",
  47. "nodeStatusReportFrequency": "1m0s",
  48. "nodeLeaseDurationSeconds": 40,
  49. "imageMinimumGCAge": "2m0s",
  50. "imageGCHighThresholdPercent": 85,
  51. "imageGCLowThresholdPercent": 80,
  52. "volumeStatsAggPeriod": "1m0s",
  53. "cgroupsPerQOS": true,
  54. "cgroupDriver": "cgroupfs",
  55. "cpuManagerPolicy": "none",
  56. "cpuManagerReconcilePeriod": "10s",
  57. "runtimeRequestTimeout": "10m0s",
  58. "hairpinMode": "promiscuous-bridge",
  59. "maxPods": 220,
  60. "podCIDR": "172.30.0.0/16",
  61. "podPidsLimit": -1,
  62. "resolvConf": "/etc/resolv.conf",
  63. "cpuCFSQuota": true,
  64. "cpuCFSQuotaPeriod": "100ms",
  65. "maxOpenFiles": 1000000,
  66. "contentType": "application/vnd.kubernetes.protobuf",
  67. "kubeAPIQPS": 1000,
  68. "kubeAPIBurst": 2000,
  69. "serializeImagePulls": false,
  70. "evictionHard": {
  71. "memory.available": "100Mi"
  72. },
  73. "evictionPressureTransitionPeriod": "5m0s",
  74. "enableControllerAttachDetach": true,
  75. "makeIPTablesUtilChains": true,
  76. "iptablesMasqueradeBit": 14,
  77. "iptablesDropBit": 15,
  78. "failSwapOn": true,
  79. "containerLogMaxSize": "20Mi",
  80. "containerLogMaxFiles": 10,
  81. "configMapAndSecretChangeDetectionStrategy": "Watch",
  82. "enforceNodeAllocatable": [
  83. "pods"
  84. ],
  85. "kind": "KubeletConfiguration",
  86. "apiVersion": "kubelet.config.k8s.io/v1beta1"
  87. }

或者参考代码中的注释

参考

  1. kubelet 认证和授权:https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/