二进制安装K8s之部署kube-scheduler

1、创建配置文件

cat > /data/k8s/config/kube-scheduler.conf << EOF

KUBE_SCHEDULER_OPTS="--logtostderr=false \\

--v=2 \\

--log-dir=/data/k8s/kubernetes/logs \\

--leader-elect \\

--kubeconfig=/data/k8s/config/kube-scheduler.kubeconfig \\

--bind-address=127.0.0.1"

EOF

• –leader-elect：当该组件启动多个时，自动选举（HA）

2、生成kube-scheduler 证书：

cat > /data/docker/TSL/k8s/kube-scheduler-csr.json <<EOF

{

    "CN": "system:kube-scheduler",

    "hosts": [],

    "key": {

        "algo": "rsa",

        "size": 2048

    },

    "names": [

        {

            "C": "CN",

            "L": "Beijing",

            "ST": "Beijing",

            "O": "system:masters",

            "OU": "System"

        }

    ]

}

EOF

• 生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

#拷贝生成的.pem证书

cp /data/docker/TSL/k8s/kube-scheduler*.pem /data/k8s/ssl/

3、生成kube-scheduler.kubeconfig 配置文件

#在shell 命令行执行

KUBE_CONFIG="/data/k8s/config/kube-scheduler.kubeconfig"

KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \

--certificate-authority=/data/k8s/ssl/ca.pem \

--embed-certs=true \

--server=${KUBE_APISERVER} \

--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials kube-scheduler \

--client-certificate=/data/k8s/ssl/kube-scheduler.pem \

--client-key=/data/k8s/ssl/kube-scheduler-key.pem \

--embed-certs=true \

--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \

--cluster=kubernetes \

--user=kube-scheduler \

--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成 kube-controller-manager.kubeconfig 文件

##查看，文件里会有密钥，这里忽略,server: 地址就是k8s master 地址

 cat /data/k8s/config/kube-controller-manager.kubeconfig

apiVersion: v1

clusters:

- cluster:

    certificate-authority-data: =

    server: https://192.168.100.170:6443

  name: kubernetes

contexts:

- context:

    cluster: kubernetes

    user: kube-scheduler

  name: default

current-context: default

kind: Config

preferences: {}

users:

- name: kube-scheduler

  user:

    client-certificate-data:

    client-key-data: =

4、systemd管理scheduler

cat > /usr/lib/systemd/system/kube-scheduler.service << EOF

[Unit]

Description=Kubernetes Scheduler

Documentation=https://github.com/kubernetes/kubernetes

[Service]

EnvironmentFile=/data/k8s/config/kube-scheduler.conf

ExecStart=/data/k8s/bin/kube-scheduler \$KUBE_SCHEDULER_OPTS

Restart=on-failure

[Install]

WantedBy=multi-user.target

EOF

5、启动并设置开机启动

systemctl daemon-reload

systemctl start kube-scheduler

systemctl enable kube-scheduler

---

6、生成admin证书

cat > /data/docker/TSL/k8s/admin-csr.json <<EOF

{

    "CN": "admin",

    "hosts": [],

    "key": {

        "algo": "rsa",

        "size": 2048

    },

    "names": [

        {

            "C": "CN",

            "L": "Beijing",

            "ST": "Beijing",

            "O": "system:masters",

            "OU": "System"

        }

    ]

}

EOF

• 生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

#拷贝证书

cp /data/docker/TSL/k8s/admin*.pem /data/k8s/ssl/

• 生成 kuconfig文件

#在shell命令行执行

KUBE_CONFIG="/data/k8s/config/config"

KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \

--certificate-authority=/data/k8s/ssl/ca.pem \

--embed-certs=true \

--server=${KUBE_APISERVER} \

--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials cluster-admin \

--client-certificate=/data/k8s/ssl/admin.pem \

--client-key=/data/k8s/ssl/admin-key.pem \

--embed-certs=true \

--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \

--cluster=kubernetes \

--user=cluster-admin \

--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成的文件在/data/k8s/config/config

#k8s 默认配置文件位置：/root/.kube/

#创建目录

mkdir /root/.kube/ 

#复制文件

cp /data/k8s/config/config /root/.kube/config

#查看授权文件

cat config/config

apiVersion: v1

clusters:

- cluster:

    certificate-authority-data: =

    server: https://192.168.0.170:6443

  name: kubernetes

contexts:

- context:

    cluster: kubernetes

    user: kube-controller-manager

  name: default

current-context: default

kind: Config

preferences: {}

users:

- name: cluster-admin

  user:

    client-certificate-data: ==

    client-key-data: =

7、 测试

#1.21

[root@master01 k8s]# kubectl get cs

Warning: v1 ComponentStatus is deprecated in v1.19+

NAME                 STATUS    MESSAGE                         ERROR

controller-manager   Healthy   ok

scheduler            Healthy   ok

etcd-2               Healthy   {"health":"true","reason":""}

etcd-0               Healthy   {"health":"true","reason":""}

etcd-1               Healthy   {"health":"true","reason":""}

#1.20

[root@k8s-master01 k8s]# kubectl get cs

Warning: v1 ComponentStatus is deprecated in v1.19+

NAME                 STATUS    MESSAGE             ERROR

controller-manager   Healthy   ok

scheduler            Healthy   ok

etcd-1               Healthy   {"health":"true"}

etcd-0               Healthy   {"health":"true"}

etcd-2               Healthy   {"health":"true"}

8、创建集群角色绑定，后面用

将apiserver-config 配置里的token 文件用户名绑定

/data/k8s/config/token.csv

kubectl create clusterrolebinding kubelet-bootstrap \

--clusterrole=system:node-bootstrapper \

--user=kubelet-bootstrap