03-k8s-master

1. k8s二进制安装包下载

cd /usr/local/src

wget https://dl.k8s.io/v1.10.8/kubernetes.tar.gz

wget https://dl.k8s.io/v1.10.8/kubernetes-client-linux-amd64.tar.gz

wget https://dl.k8s.io/v1.10.8/kubernetes-server-linux-arm64.tar.gz

wget https://dl.k8s.io/v1.10.8/kubernetes-node-linux-amd64.tar.gz

tar xf  kubernetes.tar.gz

tar xf kubernetes-client-linux-amd64.tar.gz

tar xf  kubernetes-server-linux-arm64.tar.gz

tar xf  kubernetes-node-linux-amd64.tar.gz

cd  kubernetes        #/usr/local/src/kubernetes/server/bin

 cp server/bin/kube-apiserver /opt/kubernetes/bin/

 cp server/bin/kube-controller-manager /opt/kubernetes/bin/

 cp server/bin/kube-scheduler /opt/kubernetes/bin/

cd /usr/loca/src/ssl

vim kubernetes-csr.json
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "192.168.56.11",
    "10.1.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
   -ca-key=/opt/kubernetes/ssl/ca-key.pem \
   -config=/opt/kubernetes/ssl/ca-config.json \
   -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
   
   
 cp  kubernetes.pem   kubernetes-key.pem   /opt/kubernetes/ssl/
 scp  kubernetes.pem   kubernetes-key.pem   192.168.56.11:/opt/kubernetes/ssl/
 scp  kubernetes.pem   kubernetes-key.pem   192.168.56.12:/opt/kubernetes/ssl/

[root@k8s-master ssl]# vim /opt/kubernetes/ssl/bootstrap-token.csv
ad6d5bb607a186796d8861557df0d17f,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
[root@k8s-master ssl]# 
[root@k8s-master ssl]#vim /opt/kubernetes/ssl/basic-auth.csv
admin,admin,1
readonly,readonly,2

api-servcer
[root@k8s-master ssl]# vim   /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target
[Service]
ExecStart=/opt/kubernetes/bin/kube-apiserver \
  --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \
  --bind-address=192.168.56.10 \
  --insecure-bind-address=127.0.0.1 \
  --authorization-mode=Node,RBAC \
  --runtime-config=rbac.authorization.k8s.io/v1 \
  --kubelet-https=true \
  --anonymous-auth=false \
  --basic-auth-file=/opt/kubernetes/ssl/basic-auth.csv \
  --enable-bootstrap-token-auth \
  --token-auth-file=/opt/kubernetes/ssl/bootstrap-token.csv \
  --service-cluster-ip-range=10.1.0.0/16 \
  --service-node-port-range=20000-40000 \
  --tls-cert-file=/opt/kubernetes/ssl/kubernetes.pem \
  --tls-private-key-file=/opt/kubernetes/ssl/kubernetes-key.pem \
  --client-ca-file=/opt/kubernetes/ssl/ca.pem \
  --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \
  --etcd-cafile=/opt/kubernetes/ssl/ca.pem \
  --etcd-certfile=/opt/kubernetes/ssl/kubernetes.pem \
  --etcd-keyfile=/opt/kubernetes/ssl/kubernetes-key.pem \
  --etcd-servers=https://192.168.56.10:2379,https://192.168.56.11:2379,https://192.168.56.12:2379 \
  --enable-swagger-ui=true \
  --allow-privileged=true \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=3 \
  --audit-log-maxsize=100 \
  --audit-log-path=/opt/kubernetes/log/api-audit.log \
  --event-ttl=1h \
  --v=2 \
  --logtostderr=false \
  --log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
Type=notify
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target


systemctl daemon-reload    
systemctl enable kube-apiserver
systemctl start kube-apiserver 
[root@k8s-master ssl]# systemctl status kube-apiserver
● kube-apiserver.service - Kubernetes API Server
   Loaded: loaded (/usr/lib/systemd/system/kube-apiserver.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2018-09-13 21:14:13 CST; 2min 35s ago
     Docs: https://github.com/GoogleCloudPlatform/kubernetes
 Main PID: 3488 (kube-apiserver)
    Tasks: 7
   Memory: 342.3M
   CGroup: /system.slice/kube-apiserver.service
           └─3488 /opt/kubernetes/bin/kube-apiserver --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction --bind-address=192.168.56.10 --insecure-bind-address=127.0.0.1 --authorization-mode=Node,RBAC --ru...

Sep 13 21:14:06 k8s-master systemd[1]: Starting Kubernetes API Server...
Sep 13 21:14:06 k8s-master kube-apiserver[3488]: Flag --admission-control has been deprecated, Use --enable-admission-plugins or --disable-admission-plugins instead. Will be removed in a future version.
Sep 13 21:14:06 k8s-master kube-apiserver[3488]: Flag --insecure-bind-address has been deprecated, This flag will be removed in a future version.
Sep 13 21:14:08 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:08 log.go:33: [restful/swagger] listing is available at https://192.168.56.10:6443/swaggerapi
Sep 13 21:14:08 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:08 log.go:33: [restful/swagger] https://192.168.56.10:6443/swaggerui/ is mapped to folder /swagger-ui/
Sep 13 21:14:09 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:09 log.go:33: [restful/swagger] listing is available at https://192.168.56.10:6443/swaggerapi
Sep 13 21:14:09 k8s-master kube-apiserver[3488]: [restful] 2018/09/13 21:14:09 log.go:33: [restful/swagger] https://192.168.56.10:6443/swaggerui/ is mapped to folder /swagger-ui/
Sep 13 21:14:13 k8s-master systemd[1]: Started Kubernetes API Server.
[root@k8s-master ssl]#

[root@k8s-master ~]# vim /usr/lib/systemd/system/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/kubernetes/bin/kube-controller-manager \
  --address=127.0.0.1 \
  --master=http://127.0.0.1:8080 \
  --allocate-node-cidrs=true \
  --service-cluster-ip-range=10.1.0.0/16 \
  --cluster-cidr=10.2.0.0/16 \
  --cluster-name=kubernetes \
  --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \
  --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \
  --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem \
  --root-ca-file=/opt/kubernetes/ssl/ca.pem \
  --leader-elect=true \
  --v=2 \
  --logtostderr=false \
  --log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
 systemctl enable kube-controller-manager
 systemctl start   kube-controller-manager
 systemctl status kube-controller-manager

[root@k8s-master ssl]# vim /usr/lib/systemd/system/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/opt/kubernetes/bin/kube-scheduler \
  --address=127.0.0.1 \
  --master=http://127.0.0.1:8080 \
  --leader-elect=true \
  --v=2 \
  --logtostderr=false \
  --log-dir=/opt/kubernetes/log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target


 systemctl start  kube-scheduler
 systemctl status  kube-scheduler
 systemctl enable  kube-scheduler

~