如无法下载可执行该步 https://k8s.io.ipaddress.com/dl.k8s.io ===> /etc/hosts
# 下载k8s的安装包 [root@master01 ssl]# cd [root@master01 ~]# pwd /k8s/k8s [root@master01 ~]# wget https://dl.k8s.io/v1.18.19/kubernetes-server-linux-amd64.tar.gz [root@master01 ~]# tar -zxvf kubernetes-server-linux-amd64.tar.gz [root@master01 ~]# cp kubernetes/server/bin/{kube-apiserver,kube-scheduler,kube-controller-manager} /k8s/k8s/bin/ [root@master01 ~]# cp kubernetes/server/bin/kubectl /usr/local/bin/ 部署kube-apiserver 1、创建配置文件 [root@master01 ~]# cat > /k8s/k8s/cfg/kube-apiserver.cfg << EOF KUBE_APISERVER_OPTS="--logtostderr=false \\ --v=2 \\ --log-dir=http://www.likecs.com/k8s/k8s/logs \\ --etcd-servers=https://192.168.1.21:2379,https://192.168.1.22:2379,https://192.168.1.23:2379 \\ --bind-address=192.168.1.21 \\ --secure-port=6443 \\ --advertise-address=192.168.1.21 \\ --allow-privileged=true \ --service-cluster-ip-range=10.0.0.0/24 \\ --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction \\ --authorization-mode=RBAC,Node \\ --enable-bootstrap-token-auth=true \\ --token-auth-file=http://www.likecs.com/k8s/k8s/cfg/token.csv \\ --service-node-port-range=30000-32767 \\ --kubelet-client-certificate=http://www.likecs.com/k8s/k8s/ssl/server.pem \\ --kubelet-client-key=http://www.likecs.com/k8s/k8s/ssl/server-key.pem \\ --tls-cert-file=http://www.likecs.com/k8s/k8s/ssl/server.pem \\ --tls-private-key-file=http://www.likecs.com/k8s/k8s/ssl/server-key.pem \\ --client-ca-file=http://www.likecs.com/k8s/k8s/ssl/ca.pem \\ --service-account-key-file=http://www.likecs.com/k8s/k8s/ssl/ca-key.pem \\ --etcd-cafile=http://www.likecs.com/k8s/etcd/ssl/ca.pem \\ --etcd-certfile=http://www.likecs.com/k8s/etcd/ssl/server.pem \\ --etcd-keyfile=http://www.likecs.com/k8s/etcd/ssl/server-key.pem \\ --audit-log-maxage=30 \\ --audit-log-maxbackup=3 \\ --audit-log-maxsize=100 \\ --audit-log-path=http://www.likecs.com/k8s/k8s/logs/k8s-audit.log" EOF # 参数说明 --logtostderr：启用日志 ---v：日志等级 --log-dir：日志目录 --etcd-servers：etcd集群地址 --bind-address：监听地址 --secure-port：https安全端口 --advertise-address：集群通告地址 --allow-privileged：启用授权 --service-cluster-ip-range：Service虚拟IP地址段 --enable-admission-plugins：准入控制模块 --authorization-mode：认证授权，启用RBAC授权和节点自管理 --enable-bootstrap-token-auth：启用TLS bootstrap机制 --token-auth-file：bootstrap token文件 --service-node-port-range：Service nodeport类型默认分配端口范围 --kubelet-client-xxx：apiserver访问kubelet客户端证书 --tls-xxx-file：apiserver https证书 --etcd-xxxfile：连接Etcd集群证书 --audit-log-xxx：审计日志 启用 TLS Bootstrapping 机制 1、首先生成自己的token [root@master01 ~]# head -c 16 /dev/urandom | od -An -t x | tr -d \' \' 12c940e938c533cf294ac01370cde146 2、创建上述配置文件中token文件 [root@master01 k8s]# cat > /k8s/k8s/cfg/token.csv << EOF 12c940e938c533cf294ac01370cde146,kubelet-bootstrap,10001,"system:node-bootstrapper" EOF # 格式：token，用户名，UID，用户组 systemd管理apiserver [root@master01 ~]# cat > /usr/lib/systemd/system/kube-apiserver.service << EOF [Unit] Description=Kubernetes API Server Documentation=https://github.com/kubernetes/kubernetes [Service] EnvironmentFile=http://www.likecs.com/k8s/k8s/cfg/kube-apiserver.cfg ExecStart=http://www.likecs.com/k8s/k8s/bin/kube-apiserver \$KUBE_APISERVER_OPTS Restart=on-failure [Install] WantedBy=multi-user.target EOF 启动并设置开机启动 [root@master01 ~]# systemctl daemon-reload systemctl enable kube-apiserver systemctl start kube-apiserver 注意:这里启动时可能会失败! 并且有时不会给出提示,所以要确认kube-apiserver是否启动成功 [root@master01 ~]# systemctl status kube-apiserver ● kube-apiserver.service - Kubernetes API Server Loaded: loaded (/usr/lib/systemd/system/kube-apiserver.service; enabled; vendor preset: disabled) Active: active (running) since 三 2021-07-07 22:06:13 EDT; 11s ago Docs: https://github.com/kubernetes/kubernetes Main PID: 2459 (kube-apiserver) Tasks: 10 Memory: 317.2M CGroup: /system.slice/kube-apiserver.service └─2459 /k8s/k8s/bin/kube-apiserver --logtostderr=false --v=2 --log-dir=http://www.likecs.com/k8s/k8s/log... 7月 07 22:06:13 master01 systemd[1]: Started Kubernetes API Server. 7月 07 22:06:17 master01 kube-apiserver[2459]: E0707 22:06:17.350834 2459 controller.go:...g: Hint: Some lines were ellipsized, use -l to show in full. Tips: 1、如启动失败需使用下面或逐行检查/var/log/messages cat /var/log/messages|grep kube-apiserver|egrep \'(error|no such)\' 2、多次执行systemctl status kube-apiserver命令会看到如下提示，这里没有影响 Unable to remove old endpoints from kubernetes service: StorageError: key not found, Code: 1, Key: /registry/masterleases/172.16.186.111, ResourceVersion: 0, AdditionalErrorMsg: [root@master01 ~]# netstat -anpt | egrep \'(8080|6443)\' tcp 0 0 192.168.1.21:6443 0.0.0.0:* LISTEN 2459/kube-apiserver tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 2459/kube-apiserver tcp 0 0 192.168.1.21:6443 192.168.1.21:57568 ESTABLISHED 2459/kube-apiserver tcp 0 0 192.168.1.21:57568 192.168.1.21:6443 ESTABLISHED 2459/kube-apiserver 授权kubelet-bootstrap用户允许请求证书 [root@master01 ~]# kubectl create clusterrolebinding kubelet-bootstrap \ --clusterrole=system:node-bootstrapper \ --user=kubelet-bootstrap 回显： clusterrolebinding.rbac.authorization.k8s.io/kubelet-bootstrap created 部署kube-controller-manager 1、创建配置文件 [root@master01 ~]# cat > /k8s/k8s/cfg/kube-controller-manager.conf << EOF KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=false \\ --v=2 \\ --log-dir=http://www.likecs.com/k8s/k8s/logs \\ --leader-elect=true \\ --master=127.0.0.1:8080 \\ --bind-address=127.0.0.1 \\ --allocate-node-cidrs=true \\ --cluster-cidr=10.244.0.0/16 \\ --service-cluster-ip-range=10.0.0.0/24 \\ --cluster-signing-cert-file=http://www.likecs.com/k8s/k8s/ssl/ca.pem \\ --cluster-signing-key-file=http://www.likecs.com/k8s/k8s/ssl/ca-key.pem \\ --root-ca-file=http://www.likecs.com/k8s/k8s/ssl/ca.pem \\ --service-account-private-key-file=http://www.likecs.com/k8s/k8s/ssl/ca-key.pem \\ --experimental-cluster-signing-duration=87600h0m0s" EOF 注： --master：通过本地非安全本地端口8080连接apiserver。 --leader-elect：当该组件启动多个时，自动选举（HA） --cluster-signing-cert-file/--cluster-signing-key-file：自动为kubelet颁发证书的CA，与apiserver 保持一致 systemd管理controller-manager [root@master01 ~]# cat > /usr/lib/systemd/system/kube-controller-manager.service << EOF [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/kubernetes/kubernetes [Service] EnvironmentFile=http://www.likecs.com/k8s/k8s/cfg/kube-controller-manager.conf ExecStart=http://www.likecs.com/k8s/k8s/bin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS Restart=on-failure [Install] WantedBy=multi-user.target EOF 启动并设置开机启动 [root@master01 ~]# systemctl daemon-reload systemctl enable kube-controller-manager systemctl start kube-controller-manager 存在的问题