Kubernetes 1.8.4 手动安装教程-安装Node（四）

末蓝、 2022-01-15 23:01 241阅读 0赞

[2019独角兽企业重金招聘Python工程师标准>>> ][2019_Python_] ![hot3.png][]

Node 是主要执行容器实例的节点，可视为工作节点。在这步骤我们会下载 Kubernetes binary 文件，并创建 node 的 certificate 来提供给节点注册认证用。Kubernetes 使用Node Authorizer来提供Authorization mode，这种授权模式会替 Kubelet 生成 API request。

*  在开始前，我们先在master将需要的 ca 与 cert 复制到 Node 节点上
    
        for NODE in node163 node164; do
            ssh ${NODE} "mkdir -p /etc/kubernetes/pki/"
            ssh ${NODE} "mkdir -p /etc/etcd/ssl"
            # Etcd ca and cert
            for FILE in etcd-ca.pem etcd.pem etcd-key.pem; do
              scp /etc/etcd/ssl/${FILE} ${NODE}:/etc/etcd/ssl/${FILE}
            done
            # Kubernetes ca and cert
            for FILE in pki/ca.pem pki/ca-key.pem bootstrap.conf; do
              scp /etc/kubernetes/${FILE} ${NODE}:/etc/kubernetes/${FILE}
            done
          done
 *  下载所有需要的执行文件
    
        # Download Kubernetes
        export KUBE_URL="https://storage.googleapis.com/kubernetes-release/release/v1.8.4/bin/linux/amd64"
        wget "${KUBE_URL}/kubelet" -O /usr/local/bin/kubelet
        chmod +x /usr/local/bin/kubelet
        
        # Download CNI
        mkdir -p /opt/cni/bin && cd /opt/cni/bin
        export CNI_URL="https://github.com/containernetworking/plugins/releases/download"
        wget -qO- "${CNI_URL}/v0.6.0/cni-plugins-amd64-v0.6.0.tgz" | tar -zx
    
    注意：需要翻墙，后续我上传到百度网盘
 *  生成Kubernetes 相关文件，包含 drop-in file、systemd service 等  
    创建文件夹
    
        mkdir -p /etc/systemd/system/kubelet.service.d
    
    生成kubelet.service
    
        cat <<EOF > /lib/systemd/system/kubelet.service
        [Unit]
        Description=kubelet: The Kubernetes Node Agent
        Documentation=http://kubernetes.io/docs/
        
        [Service]
        ExecStart=/usr/local/bin/kubelet
        Restart=on-failure
        StartLimitInterval=0
        RestartSec=10
        
        [Install]
        WantedBy=multi-user.target
        EOF
    
    生成10-kubelet.conf
    
        cat <<EOF > /etc/systemd/system/kubelet.service.d/10-kubelet.conf
        [Service]
        Environment="KUBELET_KUBECONFIG_ARGS=--address=0.0.0.0 --port=10250 --kubeconfig=/etc/kubernetes/kubelet.conf"
        Environment="KUBE_LOGTOSTDERR=--logtostderr=true --v=0"
        Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true --anonymous-auth=false"
        Environment="KUBELET_POD_CONTAINER=--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google_containers/pause-amd64:3.0"
        Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin"
        Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local"
        Environment="KUBELET_AUTHZ_ARGS=--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.pem"
        Environment="KUBELET_CADVISOR_ARGS=--cadvisor-port=0"
        Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki"
        Environment="KUBELET_EXTRA_ARGS=--fail-swap-on=false --serialize-image-pulls=false"
        Environment="KUBE_NODE_LABEL=--node-labels=node-role.kubernetes.io/master=true"
        ExecStart=
        ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBE_LOGTOSTDERR $KUBELET_POD_CONTAINER $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_AUTHZ_ARGS $KUBELET_EXTRA_ARGS $KUBE_NODE_LABEL
        EOF
 *  创建 var 存放信息，然后启动 kubelet 服务
    
        mkdir -p /var/lib/kubelet /var/log/kubernetes && systemctl enable kubelet.service && systemctl start kubelet.service
    
    **P.S. 重复一样动作来完成其他节点。**
 *  **授权 Kubernetes Node，**当所有节点都完成后，在master节点，因为我们采用 TLS Bootstrapping  
    创建一个 ClusterRoleBinding
    
        kubectl create clusterrolebinding kubelet-bootstrap \
            --clusterrole=system:node-bootstrapper \
            --user=kubelet-bootstrap
    
    在master通过简单指令验证，会看到节点处于pending
    
        kubectl get csr
    
    通过 kubectl 来允许节点加入集群
    
        kubectl get csr | awk '/Pending/ {print $1}' | xargs kubectl certificate approve
        kubectl get csr
        kubectl get node
    
    ##  ##

转载于:https://my.oschina.net/ytqvip/blog/1603911

[2019_Python_]: https://my.oschina.net/u/2663968/blog/3061667
[hot3.png]: /images/20220115/e98c37f251164dcfa07e1eb798e99e3c.png