k8s二进制安装包下载
cd /usr/local/srcwget https://dl.k8s.io/v1.10.8/kubernetes.tar.gzwget https://dl.k8s.io/v1.10.8/kubernetes-client-linux-amd64.tar.gzwget https://dl.k8s.io/v1.10.8/kubernetes-server-linux-arm64.tar.gzwget https://dl.k8s.io/v1.10.8/kubernetes-node-linux-amd64.tar.gz
tar xf kubernetes.tar.gztar xf kubernetes-client-linux-amd64.tar.gztar xf kubernetes-server-linux-arm64.tar.gztar xf kubernetes-node-linux-amd64.tar.gz
cd kubernetes #/usr/local/src/kubernetes/server/bincp server/bin/kube-apiserver /opt/kubernetes/bin/cp server/bin/kube-controller-manager /opt/kubernetes/bin/cp server/bin/kube-scheduler /opt/kubernetes/bin/
cd /usr/loca/src/ssl
vim kubernetes-csr.json{ "CN": "kubernetes", "hosts": [ "127.0.0.1", "192.168.56.11", "10.1.0.1", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ]}cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \ -ca-key=/opt/kubernetes/ssl/ca-key.pem \ -config=/opt/kubernetes/ssl/ca-config.json \ -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes cp kubernetes.pem kubernetes-key.pem /opt/kubernetes/ssl/ scp kubernetes.pem kubernetes-key.pem 192.168.56.11:/opt/kubernetes/ssl/ scp kubernetes.pem kubernetes-key.pem 192.168.56.12:/opt/kubernetes/ssl/ [root@k8s-master ssl]# vim /opt/kubernetes/ssl/bootstrap-token.csvad6d5bb607a186796d8861557df0d17f,kubelet-bootstrap,10001,"system:kubelet-bootstrap"[root@k8s-master ssl]# [root@k8s-master ssl]#vim /opt/kubernetes/ssl/basic-auth.csvadmin,admin,1readonly,readonly,2
api-servcer[root@k8s-master ssl]# vim /usr/lib/systemd/system/kube-apiserver.service[Unit]Description=Kubernetes API ServerDocumentation=https://github.com/GoogleCloudPlatform/kubernetesAfter=network.target[Service]ExecStart=/opt/kubernetes/bin/kube-apiserver \ --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \ --bind-address=192.168.56.10 \ --insecure-bind-address=127.0.0.1 \ --authorization-mode=Node,RBAC \ --runtime-config=rbac.authorization.k8s.io/v1 \ --kubelet-https=true \ --anonymous-auth=false \ --basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv \ --enable-bootstrap-token-auth \ --token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv \ --service-cluster-ip-range=10.1.0.0/16 \ --service-node-port-range=20000-40000 \ --tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem \ --tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem \ --client-ca-file=/opt/kubernetes/ssl/ca.pem \ --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \ --etcd-cafile=/opt/kubernetes/ssl/ca.pem \ --etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem \ --etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem \ --etcd-servers=https://192.168.56.10:2379,https://192.168.56.11:2379,https://192.168.56.12:2379 \ --enable-swagger-ui=true \ --allow-privileged=true \ --audit-log-maxage=30 \ --audit-log-maxbackup=3 \ --audit-log-maxsize=100 \ --audit-log-path=/opt/kubernetes/log/api-audit.log \ --event-ttl=1h \ --v=2 \ --logtostderr=false \ --log-dir=/opt/kubernetes/logRestart=on-failureRestartSec=5Type=notifyLimitNOFILE=65536[Install]WantedBy=multi-user.targetsystemctl daemon-reload systemctl enable kube-apiserversystemctl start kube-apiserver [root@k8s-master ssl]# systemctl status kube-apiserver● kube-apiserver.service - Kubernetes API Server Loaded: loaded (/usr/lib/systemd/system/kube-apiserver.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2018-09-13 21:14:13 CST; 2min 35s ago Docs: https://github.com/GoogleCloudPlatform/kubernetes Main PID: 3488 (kube-apiserver) Tasks: 7 Memory: 342.3M CGroup: /system.slice/kube-apiserver.service └─3488 /opt/kubernetes/bin/kube-apiserver --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction --bind-address=192.168.56.10 --insecure-bind-address=127.0.0.1 --authorization-mode=Node,RBAC --ru...Sep 13 21:14:06 k8s-master systemd[1]: Starting Kubernetes API Server...Sep 13 21:14:06 k8s-master kube-apiserver[3488]: Flag --admission-control has been deprecated, Use --enable-admission-plugins or --disable-admission-plugins instead. Will be removed in a future version.Sep 13 21:14:06 k8s-master kube-apiserver[3488]: Flag --insecure-bind-address has been deprecated, This flag will be removed in a future version.Sep 13 21:14:08 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:08 log.go:33: [restful/swagger] listing is available at https://192.168.56.10:6443/swaggerapiSep 13 21:14:08 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:08 log.go:33: [restful/swagger] https://192.168.56.10:6443/swaggerui/ is mapped to folder /swagger-ui/Sep 13 21:14:09 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:09 log.go:33: [restful/swagger] listing is available at https://192.168.56.10:6443/swaggerapiSep 13 21:14:09 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:09 log.go:33: [restful/swagger] https://192.168.56.10:6443/swaggerui/ is mapped to folder /swagger-ui/Sep 13 21:14:13 k8s-master systemd[1]: Started Kubernetes API Server.[root@k8s-master ssl]#
[root@k8s-master ~]# vim /usr/lib/systemd/system/kube-controller-manager.service[Unit]Description=Kubernetes Controller ManagerDocumentation=https://github.com/GoogleCloudPlatform/kubernetes[Service]ExecStart=/opt/kubernetes/bin/kube-controller-manager \ --address=127.0.0.1 \ --master=http://127.0.0.1:8080 \ --allocate-node-cidrs=true \ --service-cluster-ip-range=10.1.0.0/16 \ --cluster-cidr=10.2.0.0/16 \ --cluster-name=kubernetes \ --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \ --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \ --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \ --root-ca-file=/opt/kubernetes/ssl/ca.pem \ --leader-elect=true \ --v=2 \ --logtostderr=false \ --log-dir=/opt/kubernetes/logRestart=on-failureRestartSec=5[Install]WantedBy=multi-user.target systemctl enable kube-controller-manager systemctl start kube-controller-manager systemctl status kube-controller-manager
[root@k8s-master ssl]# vim /usr/lib/systemd/system/kube-scheduler.service[Unit]Description=Kubernetes SchedulerDocumentation=https://github.com/GoogleCloudPlatform/kubernetes[Service]ExecStart=/opt/kubernetes/bin/kube-scheduler \ --address=127.0.0.1 \ --master=http://127.0.0.1:8080 \ --leader-elect=true \ --v=2 \ --logtostderr=false \ --log-dir=/opt/kubernetes/logRestart=on-failureRestartSec=5[Install]WantedBy=multi-user.target systemctl start kube-scheduler systemctl status kube-scheduler systemctl enable kube-scheduler
~
部署kubectl 命令行工具
cd /usr/local/src/kubernetes/client/bincp kubectl /opt/kubernetes/bin/cd /usr/local/src/ssl/ vim admin-csr.json { "CN": "admin", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "system:masters", "OU": "System" } ]}cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \ -ca-key=/opt/kubernetes/ssl/ca-key.pem \ -config=/opt/kubernetes/ssl/ca-config.json \ -profile=kubernetes admin-csr.json | cfssljson -bare admin scp admin.pem admin-key.pem /opt/kubernetes/ssl/kubectl config set-cluster kubernetes \ --certificate-authority=/opt/kubernetes/ssl/ca.pem \ --embed-certs=true \ --server=https://192.168.56.10:6443 kubectl config set-credentials admin \ --client-certificate=/opt/kubernetes/ssl/admin.pem \ --embed-certs=true \ --client-key=/opt/kubernetes/ssl/admin-key.pem kubectl config set-context kubernetes \ --cluster=kubernetes \ --user=admin kubectl config use-context kubernetesc[root@k8s-master ssl]# kubectl get csNAME STATUS MESSAGE ERRORscheduler Healthy ok controller-manager Healthy ok etcd-0 Healthy {"health": "true"} etcd-1 Healthy {"health": "true"} etcd-2 Healthy {"health": "true"} [root@k8s-master ssl]#