二丫讲梵 二丫讲梵
首页
  • 最佳实践
  • 迎刃而解
  • Nginx
  • Php
  • Zabbix
  • AWS
  • Prometheus
  • Grafana
  • CentOS
  • Systemd
  • Docker
  • Rancher
  • Ansible
  • Ldap
  • Gitlab
  • GitHub
  • Etcd
  • Consul
  • RabbitMQ
  • Kafka
  • MySql
  • MongoDB
  • OpenVPN
  • KVM
  • VMware
  • Other
  • ELK
  • K8S
  • LLM
  • Nexus
  • Jenkins
  • 随写编年
  • 家人物语
  • 追忆青春
  • 父亲的朋友圈
  • 电影音乐
  • 效率工具
  • 博客相关
  • Shell
  • 前端实践
  • Vue学习笔记
  • Golang学习笔记
  • Golang编程技巧
  • 学习周刊
  • Obsidian插件周刊
关于
友链
  • 本站索引

    • 分类
    • 标签
    • 归档
  • 本站页面

    • 导航
    • 打赏
  • 我的工具

    • 备忘录清单 (opens new window)
    • json2go (opens new window)
    • gopher (opens new window)
    • 微信MD编辑 (opens new window)
    • 国内镜像 (opens new window)
    • 出口IP查询 (opens new window)
    • 代码高亮工具 (opens new window)
  • 外站页面

    • 开往 (opens new window)
    • ldapdoc (opens new window)
    • HowToStartOpenSource (opens new window)
    • vdoing-template (opens new window)
GitHub (opens new window)

二丫讲梵

行者常至,为者常成
首页
  • 最佳实践
  • 迎刃而解
  • Nginx
  • Php
  • Zabbix
  • AWS
  • Prometheus
  • Grafana
  • CentOS
  • Systemd
  • Docker
  • Rancher
  • Ansible
  • Ldap
  • Gitlab
  • GitHub
  • Etcd
  • Consul
  • RabbitMQ
  • Kafka
  • MySql
  • MongoDB
  • OpenVPN
  • KVM
  • VMware
  • Other
  • ELK
  • K8S
  • LLM
  • Nexus
  • Jenkins
  • 随写编年
  • 家人物语
  • 追忆青春
  • 父亲的朋友圈
  • 电影音乐
  • 效率工具
  • 博客相关
  • Shell
  • 前端实践
  • Vue学习笔记
  • Golang学习笔记
  • Golang编程技巧
  • 学习周刊
  • Obsidian插件周刊
关于
友链
  • 本站索引

    • 分类
    • 标签
    • 归档
  • 本站页面

    • 导航
    • 打赏
  • 我的工具

    • 备忘录清单 (opens new window)
    • json2go (opens new window)
    • gopher (opens new window)
    • 微信MD编辑 (opens new window)
    • 国内镜像 (opens new window)
    • 出口IP查询 (opens new window)
    • 代码高亮工具 (opens new window)
  • 外站页面

    • 开往 (opens new window)
    • ldapdoc (opens new window)
    • HowToStartOpenSource (opens new window)
    • vdoing-template (opens new window)
GitHub (opens new window)
  • Nexus系列文章

  • Jenkins系列文章

  • ELK笔记

  • Kubernetes笔记

    • 手动部署kubernetes-1-8-6集群

    • 其他姿势快速部署

    • 手动搭建k8s-1-10-4高可用集群(推荐版).md

      • 手动搭建k8s-1-10-4高可用集群(前言以及准备)
      • 手动搭建k8s-1-10-4之系统初始化
      • 手动搭建k8s-1-10-4之创建CA证书和秘钥
      • 手动搭建k8s-1-10-4之部署kubectl命令行工具
      • 手动搭建k8s-1-10-4之部署Etcd集群
      • 手动搭建k8s-1-10-4之部署flannel网络
      • 手动搭建k8s-1-10-4之部署master节点
      • 手动搭建k8s-1-10-4之部署高可用组件
      • 手动搭建k8s-1-10-4之部署kube-apiserver
      • 手动搭建k8s-1-10-4之部署kube-controller-manager
        • 1,创建 kube-controller-manager 证书和私钥
        • 2,创建和分发 kubeconfig 文件
        • 3,创建和分发 kube-controller-manager systemd unit 文件
        • 4,kube-controller-manager 的权限
        • 5,启动 kube-controller-manager 服务
        • 6,检查服务运行状态
        • 7,查看输出的 metric
        • 8,查看当前的 leader
        • 9,测试 kube-controller-manager 集群的高可用
        • 10,参考
        • 1,创建 kube-controller-manager 证书和私钥
        • 2,创建和分发 kubeconfig 文件
        • 3,创建和分发 kube-controller-manager systemd unit 文件
        • 4,kube-controller-manager 的权限
        • 5,启动 kube-controller-manager 服务
        • 6,检查服务运行状态
        • 7,查看输出的 metric
        • 8,查看当前的 leader
        • 9,测试 kube-controller-manager 集群的高可用
        • 10,参考
      • 手动搭建k8s-1-10-4之部署kube-scheduler
      • 手动搭建k8s-1-10-4之部署work节点
      • 手动搭建k8s-1-10-4之部署docker组件
      • 手动搭建k8s-1-10-4之部署kubelet组件
      • 手动搭建k8s-1-10-4之部署kube-proxy组件
      • 手动搭建k8s-1-10-4之验证集群功能
      • 手动搭建k8s-1-10-4集群插件之coredns
      • 手动搭建k8s-1-10-4集群插件之dashboard
      • 手动搭建k8s-1-10-4集群插件之heapster
      • 手动搭建k8s-1-10-4之一键部署脚本
    • 基础学习

    • 从新出发

  • LLM专题

  • 系列专题
  • Kubernetes笔记
  • 手动搭建k8s-1-10-4高可用集群(推荐版).md
二丫讲梵
2018-12-09
目录

手动搭建k8s-1-10-4之部署kube-controller-manager

文章发布较早,内容可能过时,阅读注意甄别。

本文档介绍部署高可用 kube-controller-manager 集群的步骤。

该集群包含 3 个节点,启动后将通过竞争选举机制产生一个 leader 节点,其它节点为阻塞状态。当 leader 节点不可用后,剩余节点将再次进行选举产生新的 leader 节点,从而保证服务的可用性。

本文档介绍部署高可用 kube-controller-manager 集群的步骤。

该集群包含 3 个节点,启动后将通过竞争选举机制产生一个 leader 节点,其它节点为阻塞状态。当 leader 节点不可用后,剩余节点将再次进行选举产生新的 leader 节点,从而保证服务的可用性。

为保证通信安全,本文档先生成 x509 证书和私钥,kube-controller-manager 在如下两种情况下使用该证书:

  1. 与 kube-apiserver 的安全端口通信时;
  2. 在安全端口 (https,10252) 输出 prometheus 格式的 metrics;

配置之前需要先安装 kubelet,flannel 等组件,不过前边已经安装,现在直接进入配置。

# 1,创建 kube-controller-manager 证书和私钥

创建证书签名请求:

cat > kube-controller-manager-csr.json <<EOF
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
      "127.0.0.1",
      "192.168.106.3",
      "192.168.106.4",
      "192.168.106.5"
    ],
    "names": [
      {
        "C": "CN",
        "ST": "BeiJing",
        "L": "BeiJing",
        "O": "system:kube-controller-manager",
        "OU": "4Paradigm"
      }
    ]
}
EOF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  • hosts 列表包含所有 kube-controller-manager 节点 IP;
  • CN 为 system:kube-controller-manager、O 为 system:kube-controller-manager,kubernetes 内置的 ClusterRoleBindings system:kube-controller-manager 赋予 kube-controller-manager 工作所需的权限。

生成证书和私钥:

$cfssl gencert -ca=/etc/kubernetes/cert/ca.pem \
  -ca-key=/etc/kubernetes/cert/ca-key.pem \
  -config=/etc/kubernetes/cert/ca-config.json \
  -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager
1
2
3
4

将生成的证书和私钥分发到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager*.pem k8s@${node_ip}:/etc/kubernetes/cert/
done
EOF
1
2
3
4
5
6
7
8
9

# 2,创建和分发 kubeconfig 文件

kubeconfig 文件包含访问 apiserver 的所有信息,如 apiserver 地址、CA 证书和自身使用的证书;

$source /opt/k8s/bin/environment.sh
$kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/cert/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-controller-manager.kubeconfig
$kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=kube-controller-manager.pem \
  --client-key=kube-controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-controller-manager.kubeconfig
$kubectl config set-context system:kube-controller-manager \
  --cluster=kubernetes \
  --user=system:kube-controller-manager \
  --kubeconfig=kube-controller-manager.kubeconfig
$kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

分发 kubeconfig 到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager.kubeconfig k8s@${node_ip}:/etc/kubernetes/
done
EOF
1
2
3
4
5
6
7
8
9

# 3,创建和分发 kube-controller-manager systemd unit 文件

$source /opt/k8s/bin/environment.sh
$cat > kube-controller-manager.service <<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/opt/k8s/bin/kube-controller-manager \\
  --port=0 \\
  --secure-port=10252 \\
  --bind-address=127.0.0.1 \\
  --kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\
  --service-cluster-ip-range=${SERVICE_CIDR} \\
  --cluster-name=kubernetes \\
  --cluster-signing-cert-file=/etc/kubernetes/cert/ca.pem \\
  --cluster-signing-key-file=/etc/kubernetes/cert/ca-key.pem \\
  --experimental-cluster-signing-duration=8760h \\
  --root-ca-file=/etc/kubernetes/cert/ca.pem \\
  --service-account-private-key-file=/etc/kubernetes/cert/ca-key.pem \\
  --leader-elect=true \\
  --feature-gates=RotateKubeletServerCertificate=true \\
  --controllers=*,bootstrapsigner,tokencleaner \\
  --horizontal-pod-autoscaler-use-rest-clients=true \\
  --horizontal-pod-autoscaler-sync-period=10s \\
  --tls-cert-file=/etc/kubernetes/cert/kube-controller-manager.pem \\
  --tls-private-key-file=/etc/kubernetes/cert/kube-controller-manager-key.pem \\
  --use-service-account-credentials=true \\
  --alsologtostderr=true \\
  --logtostderr=false \\
  --log-dir=/var/log/kubernetes \\
  --v=2
Restart=on
Restart=on-failure
RestartSec=5
User=k8s
[Install]
WantedBy=multi-user.target
EOF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
  • --port=0:关闭监听 http /metrics 的请求,同时 --address 参数无效,--bind-address 参数有效;
  • --secure-port=10252、--bind-address=0.0.0.0: 在所有网络接口监听 10252 端口的 https /metrics 请求;
  • --kubeconfig:指定 kubeconfig 文件路径,kube-controller-manager 使用它连接和验证 kube-apiserver;
  • --cluster-signing-*-file:签名 TLS Bootstrap 创建的证书;
  • --experimental-cluster-signing-duration:指定 TLS Bootstrap 证书的有效期;
  • --root-ca-file:放置到容器 ServiceAccount 中的 CA 证书,用来对 kube-apiserver 的证书进行校验;
  • --service-account-private-key-file:签名 ServiceAccount 中 Token 的私钥文件,必须和 kube-apiserver 的 --service-account-key-file 指定的公钥文件配对使用;
  • --service-cluster-ip-range :指定 Service Cluster IP 网段,必须和 kube-apiserver 中的同名参数一致;
  • --leader-elect=true:集群运行模式,启用选举功能;被选为 leader 的节点负责处理工作,其它节点为阻塞状态;
  • --feature-gates=RotateKubeletServerCertificate=true:开启 kublet server 证书的自动更新特性;
  • --controllers=*,bootstrapsigner,tokencleaner:启用的控制器列表,tokencleaner 用于自动清理过期的 Bootstrap token;
  • --horizontal-pod-autoscaler-*:custom metrics 相关参数,支持 autoscaling/v2alpha1;
  • --tls-cert-file、--tls-private-key-file:使用 https 输出 metrics 时使用的 Server 证书和秘钥;
  • --use-service-account-credentials=true:
  • User=k8s:使用 k8s 账户运行;

kube-controller-manager 不对请求 https metrics 的 Client 证书进行校验,故不需要指定 –tls-ca-file 参数,而且该参数已被淘汰。

分发 systemd unit 文件到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager.service root@${node_ip}:/etc/systemd/system/
done
EOF
1
2
3
4
5
6
7
8
9

# 4,kube-controller-manager 的权限

ClusteRole: system:kube-controller-manager 的权限很小,只能创建 secret、serviceaccount 等资源对象,各 controller 的权限分散到 ClusterRole system:controller:XXX 中。

需要在 kube-controller-manager 的启动参数中添加 、–use-service-account-credentials=true 参数,这样 main controller 会为各 controller 创建对应的 ServiceAccount XXX-controller。

内置的 ClusterRoleBinding system:controller:XXX 将赋予各 XXX-controller ServiceAccount 对应的 ClusterRole system:controller:XXX 权限。

# 5,启动 kube-controller-manager 服务

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p /var/log/kubernetes && chown -R k8s /var/log/kubernetes"
    ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl start kube-controller-manager"
done
EOF
1
2
3
4
5
6
7
8
9
10

# 6,检查服务运行状态

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    ssh k8s@${node_ip} "systemctl status kube-controller-manager|grep Active"
done
EOF
1
2
3
4
5
6
7
8
9

如果输出如下内容:

$bash magic.sh
>>> 192.168.106.3
   Active: active (running) since Fri 2018-11-23 18:23:11 CST; 6h ago
>>> 192.168.106.4
   Active: active (running) since Fri 2018-11-23 18:23:12 CST; 6h ago
>>> 192.168.106.5
   Active: active (running) since Fri 2018-11-23 18:23:12 CST; 6h ago
1
2
3
4
5
6
7

则为正常,否则,查看日志:

journalctl -xu kube-controller-manager
1

# 7,查看输出的 metric

注意:以下命令在 kube-controller-manager 节点上执行。

kube-controller-manager 监听 10252 端口,接收 https 请求:

$sudo netstat -lnpt|grep kube-controll
tcp        0      0 127.0.0.1:10252         0.0.0.0:*               LISTEN      14858/kube-controll
1
2
$curl -s --cacert /etc/kubernetes/cert/ca.pem https://127.0.0.1:10252/metrics |head
# HELP ClusterRoleAggregator_adds Total number of adds handled by workqueue: ClusterRoleAggregator
# TYPE ClusterRoleAggregator_adds counter
ClusterRoleAggregator_adds 17
# HELP ClusterRoleAggregator_depth Current depth of workqueue: ClusterRoleAggregator
# TYPE ClusterRoleAggregator_depth gauge
ClusterRoleAggregator_depth 0
# HELP ClusterRoleAggregator_queue_latency How long an item stays in workqueueClusterRoleAggregator before being requested.
# TYPE ClusterRoleAggregator_queue_latency summary
ClusterRoleAggregator_queue_latency{quantile="0.5"} NaN
ClusterRoleAggregator_queue_latency{quantile="0.9"} NaN
1
2
3
4
5
6
7
8
9
10
11
  • curl --cacert CA 证书用来验证 kube-controller-manager https server 证书;

# 8,查看当前的 leader

$kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"kube-node1_c79b4380-ef09-11e8-aa72-525400c7ba97","leaseDurationSeconds":15,"acquireTime":"2018-11-23T10:23:11Z","renewTime":"2018-11-23T16:50:16Z","leaderTransitions":0}'
  creationTimestamp: 2018-11-23T10:23:11Z
  name: kube-controller-manager
  namespace: kube-system
  resourceVersion: "29655"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-controller-manager
  uid: c79fb0ff-ef09-11e8-9670-525400c7ba97
1
2
3
4
5
6
7
8
9
10
11
12

可见,当前的 leader 为 kube-node1 节点。

# 9,测试 kube-controller-manager 集群的高可用

停掉一个或两个节点的 kube-controller-manager 服务,观察其它节点的日志,看是否获取了 leader 权限。

现在停掉 kube-node1 上的 kube-controller-manager。

$systemctl stop kube-controller-manager
$systemctl status kube-controller-manager |grep Active
   Active: inactive (dead) since Sat 2018-11-24 00:52:53 CST; 44s ago
1
2
3

再查看一下当前的 leader:

$kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"kube-node3_c809d2de-ef09-11e8-bfb1-525400b42484","leaseDurationSeconds":15,"acquireTime":"2018-11-23T16:53:10Z","renewTime":"2018-11-23T16:54:24Z","leaderTransitions":1}'
  creationTimestamp: 2018-11-23T10:23:11Z
  name: kube-controller-manager
  namespace: kube-system
  resourceVersion: "29971"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-controller-manager
  uid: c79fb0ff-ef09-11e8-9670-525400c7ba97
1
2
3
4
5
6
7
8
9
10
11
12

可以看到已经自动漂移到 kube-node3 上去了。

# 10,参考

  1. 关于 controller 权限和 use-service-account-credentials 参数:https://github.com/kubernetes/kubernetes/issues/48208
  2. kublet 认证和授权:https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization

为保证通信安全,本文档先生成 x509 证书和私钥,kube-controller-manager 在如下两种情况下使用该证书:

  1. 与 kube-apiserver 的安全端口通信时;
  2. 在安全端口 (https,10252) 输出 prometheus 格式的 metrics;

配置之前需要先安装 kubelet,flannel 等组件,不过前边已经安装,现在直接进入配置。

# 1,创建 kube-controller-manager 证书和私钥

创建证书签名请求:

cat > kube-controller-manager-csr.json <<EOF
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
      "127.0.0.1",
      "192.168.106.3",
      "192.168.106.4",
      "192.168.106.5"
    ],
    "names": [
      {
        "C": "CN",
        "ST": "BeiJing",
        "L": "BeiJing",
        "O": "system:kube-controller-manager",
        "OU": "4Paradigm"
      }
    ]
}
EOF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  • hosts 列表包含所有 kube-controller-manager 节点 IP;
  • CN 为 system:kube-controller-manager、O 为 system:kube-controller-manager,kubernetes 内置的 ClusterRoleBindings system:kube-controller-manager 赋予 kube-controller-manager 工作所需的权限。

生成证书和私钥:

$cfssl gencert -ca=/etc/kubernetes/cert/ca.pem \
  -ca-key=/etc/kubernetes/cert/ca-key.pem \
  -config=/etc/kubernetes/cert/ca-config.json \
  -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager
1
2
3
4

将生成的证书和私钥分发到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager*.pem k8s@${node_ip}:/etc/kubernetes/cert/
done
EOF
1
2
3
4
5
6
7
8
9

# 2,创建和分发 kubeconfig 文件

kubeconfig 文件包含访问 apiserver 的所有信息,如 apiserver 地址、CA 证书和自身使用的证书;

$source /opt/k8s/bin/environment.sh
$kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/cert/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-controller-manager.kubeconfig
$kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=kube-controller-manager.pem \
  --client-key=kube-controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-controller-manager.kubeconfig
$kubectl config set-context system:kube-controller-manager \
  --cluster=kubernetes \
  --user=system:kube-controller-manager \
  --kubeconfig=kube-controller-manager.kubeconfig
$kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

分发 kubeconfig 到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager.kubeconfig k8s@${node_ip}:/etc/kubernetes/
done
EOF
1
2
3
4
5
6
7
8
9

# 3,创建和分发 kube-controller-manager systemd unit 文件

$source /opt/k8s/bin/environment.sh
$cat > kube-controller-manager.service <<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
ExecStart=/opt/k8s/bin/kube-controller-manager \\
  --port=0 \\
  --secure-port=10252 \\
  --bind-address=127.0.0.1 \\
  --kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \\
  --service-cluster-ip-range=${SERVICE_CIDR} \\
  --cluster-name=kubernetes \\
  --cluster-signing-cert-file=/etc/kubernetes/cert/ca.pem \\
  --cluster-signing-key-file=/etc/kubernetes/cert/ca-key.pem \\
  --experimental-cluster-signing-duration=8760h \\
  --root-ca-file=/etc/kubernetes/cert/ca.pem \\
  --service-account-private-key-file=/etc/kubernetes/cert/ca-key.pem \\
  --leader-elect=true \\
  --feature-gates=RotateKubeletServerCertificate=true \\
  --controllers=*,bootstrapsigner,tokencleaner \\
  --horizontal-pod-autoscaler-use-rest-clients=true \\
  --horizontal-pod-autoscaler-sync-period=10s \\
  --tls-cert-file=/etc/kubernetes/cert/kube-controller-manager.pem \\
  --tls-private-key-file=/etc/kubernetes/cert/kube-controller-manager-key.pem \\
  --use-service-account-credentials=true \\
  --alsologtostderr=true \\
  --logtostderr=false \\
  --log-dir=/var/log/kubernetes \\
  --v=2
Restart=on
Restart=on-failure
RestartSec=5
User=k8s
[Install]
WantedBy=multi-user.target
EOF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
  • --port=0:关闭监听 http /metrics 的请求,同时 --address 参数无效,--bind-address 参数有效;
  • --secure-port=10252、--bind-address=0.0.0.0: 在所有网络接口监听 10252 端口的 https /metrics 请求;
  • --kubeconfig:指定 kubeconfig 文件路径,kube-controller-manager 使用它连接和验证 kube-apiserver;
  • --cluster-signing-*-file:签名 TLS Bootstrap 创建的证书;
  • --experimental-cluster-signing-duration:指定 TLS Bootstrap 证书的有效期;
  • --root-ca-file:放置到容器 ServiceAccount 中的 CA 证书,用来对 kube-apiserver 的证书进行校验;
  • --service-account-private-key-file:签名 ServiceAccount 中 Token 的私钥文件,必须和 kube-apiserver 的 --service-account-key-file 指定的公钥文件配对使用;
  • --service-cluster-ip-range :指定 Service Cluster IP 网段,必须和 kube-apiserver 中的同名参数一致;
  • --leader-elect=true:集群运行模式,启用选举功能;被选为 leader 的节点负责处理工作,其它节点为阻塞状态;
  • --feature-gates=RotateKubeletServerCertificate=true:开启 kublet server 证书的自动更新特性;
  • --controllers=*,bootstrapsigner,tokencleaner:启用的控制器列表,tokencleaner 用于自动清理过期的 Bootstrap token;
  • --horizontal-pod-autoscaler-*:custom metrics 相关参数,支持 autoscaling/v2alpha1;
  • --tls-cert-file、--tls-private-key-file:使用 https 输出 metrics 时使用的 Server 证书和秘钥;
  • --use-service-account-credentials=true:
  • User=k8s:使用 k8s 账户运行;

kube-controller-manager 不对请求 https metrics 的 Client 证书进行校验,故不需要指定 –tls-ca-file 参数,而且该参数已被淘汰。

分发 systemd unit 文件到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager.service root@${node_ip}:/etc/systemd/system/
done
EOF
1
2
3
4
5
6
7
8
9

# 4,kube-controller-manager 的权限

ClusteRole: system:kube-controller-manager 的权限很小,只能创建 secret、serviceaccount 等资源对象,各 controller 的权限分散到 ClusterRole system:controller:XXX 中。

需要在 kube-controller-manager 的启动参数中添加 、–use-service-account-credentials=true 参数,这样 main controller 会为各 controller 创建对应的 ServiceAccount XXX-controller。

内置的 ClusterRoleBinding system:controller:XXX 将赋予各 XXX-controller ServiceAccount 对应的 ClusterRole system:controller:XXX 权限。

# 5,启动 kube-controller-manager 服务

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p /var/log/kubernetes && chown -R k8s /var/log/kubernetes"
    ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl start kube-controller-manager"
done
EOF
1
2
3
4
5
6
7
8
9
10

# 6,检查服务运行状态

cat > magic.sh << "EOF"
#!/bin/bash
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    ssh k8s@${node_ip} "systemctl status kube-controller-manager|grep Active"
done
EOF
1
2
3
4
5
6
7
8
9

如果输出如下内容:

$bash magic.sh
>>> 192.168.106.3
   Active: active (running) since Fri 2018-11-23 18:23:11 CST; 6h ago
>>> 192.168.106.4
   Active: active (running) since Fri 2018-11-23 18:23:12 CST; 6h ago
>>> 192.168.106.5
   Active: active (running) since Fri 2018-11-23 18:23:12 CST; 6h ago
1
2
3
4
5
6
7

则为正常,否则,查看日志:

journalctl -xu kube-controller-manager
1

# 7,查看输出的 metric

注意:以下命令在 kube-controller-manager 节点上执行。

kube-controller-manager 监听 10252 端口,接收 https 请求:

$sudo netstat -lnpt|grep kube-controll
tcp        0      0 127.0.0.1:10252         0.0.0.0:*               LISTEN      14858/kube-controll
1
2
$curl -s --cacert /etc/kubernetes/cert/ca.pem https://127.0.0.1:10252/metrics |head
# HELP ClusterRoleAggregator_adds Total number of adds handled by workqueue: ClusterRoleAggregator
# TYPE ClusterRoleAggregator_adds counter
ClusterRoleAggregator_adds 17
# HELP ClusterRoleAggregator_depth Current depth of workqueue: ClusterRoleAggregator
# TYPE ClusterRoleAggregator_depth gauge
ClusterRoleAggregator_depth 0
# HELP ClusterRoleAggregator_queue_latency How long an item stays in workqueueClusterRoleAggregator before being requested.
# TYPE ClusterRoleAggregator_queue_latency summary
ClusterRoleAggregator_queue_latency{quantile="0.5"} NaN
ClusterRoleAggregator_queue_latency{quantile="0.9"} NaN
1
2
3
4
5
6
7
8
9
10
11
  • curl --cacert CA 证书用来验证 kube-controller-manager https server 证书;

# 8,查看当前的 leader

$kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"kube-node1_c79b4380-ef09-11e8-aa72-525400c7ba97","leaseDurationSeconds":15,"acquireTime":"2018-11-23T10:23:11Z","renewTime":"2018-11-23T16:50:16Z","leaderTransitions":0}'
  creationTimestamp: 2018-11-23T10:23:11Z
  name: kube-controller-manager
  namespace: kube-system
  resourceVersion: "29655"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-controller-manager
  uid: c79fb0ff-ef09-11e8-9670-525400c7ba97
1
2
3
4
5
6
7
8
9
10
11
12

可见,当前的 leader 为 kube-node1 节点。

# 9,测试 kube-controller-manager 集群的高可用

停掉一个或两个节点的 kube-controller-manager 服务,观察其它节点的日志,看是否获取了 leader 权限。

现在停掉 kube-node1 上的 kube-controller-manager。

$systemctl stop kube-controller-manager
$systemctl status kube-controller-manager |grep Active
   Active: inactive (dead) since Sat 2018-11-24 00:52:53 CST; 44s ago
1
2
3

再查看一下当前的 leader:

$kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"kube-node3_c809d2de-ef09-11e8-bfb1-525400b42484","leaseDurationSeconds":15,"acquireTime":"2018-11-23T16:53:10Z","renewTime":"2018-11-23T16:54:24Z","leaderTransitions":1}'
  creationTimestamp: 2018-11-23T10:23:11Z
  name: kube-controller-manager
  namespace: kube-system
  resourceVersion: "29971"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-controller-manager
  uid: c79fb0ff-ef09-11e8-9670-525400c7ba97
1
2
3
4
5
6
7
8
9
10
11
12

可以看到已经自动漂移到 kube-node3 上去了。

# 10,参考

  1. 关于 controller 权限和 use-service-account-credentials 参数:https://github.com/kubernetes/kubernetes/issues/48208
  2. kublet 认证和授权:https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization
微信 支付宝
上次更新: 2024/06/13, 22:13:45
手动搭建k8s-1-10-4之部署kube-apiserver
手动搭建k8s-1-10-4之部署kube-scheduler

← 手动搭建k8s-1-10-4之部署kube-apiserver 手动搭建k8s-1-10-4之部署kube-scheduler→

最近更新
01
学习周刊-总第216期-2025年第25周
06-20
02
睡着的人不关灯
06-12
03
学习周刊-总第215期-2025年第24周
06-12
更多文章>
Theme by Vdoing | Copyright © 2017-2025 | 点击查看十年之约 | 浙ICP备18057030号
  • 跟随系统
  • 浅色模式
  • 深色模式
  • 阅读模式