二进制安装K8s之部署kube-proxy

1、创建配置文件

cat > /data/k8s/config/kube-proxy.conf << EOF

KUBE_PROXY_OPTS="--logtostderr=false \\

--v=2 \\

--log-dir=/data/k8s/logs \\

--config=/data/k8s/config/kube-proxy-config.yml"

EOF

2、配置参数文件

cat > /data/k8s/config/kube-proxy-config.yml << EOF

kind: KubeProxyConfiguration

apiVersion: kubeproxy.config.k8s.io/v1alpha1

address: 0.0.0.0

metricsBindAddress: 0.0.0.0:10249

clientConnection:

  kubeconfig: /data/k8s/config/kube-proxy.kubeconfig

hostnameOverride: k8s-master01

clusterCIDR: 10.0.0.0/24

EOF

• hostnameOverride 当前k8s 集群显示的当前自己名字
• clusterCIDR 后面CNI网络的IP段，不能与任何网络重复，否则获报错

3、生成kube-proxy.kubeconfig文件

• 生成kube-proxy证书：

cat > /data/docker/TSL/k8s/kube-proxy-csr.json <<EOF

{

    "CN": "system:kube-proxy",

    "hosts": [],

    "key": {

        "algo": "rsa",

        "size": 2048

    },

    "names": [

        {

            "C": "CN",

            "L": "Beijing",

            "ST": "Beijing",

            "O": "k8s",

            "OU": "System"

        }

    ]

}

EOF

#生成

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

#复制

cp  kube-proxy*.pem /data/k8s/ssl/

• 生成kubeconfig文件：
  
  KUBE_APISERVER k8s-matser api 地址

KUBE_APISERVER="https://192.168.100.170:6443"

KUBE_PROXTCONFIG="/data/k8s/config/kube-proxy.kubeconfig"

kubectl config set-cluster kubernetes \

--certificate-authority=/data/k8s/ssl/ca.pem \

--embed-certs=true \

--server=${KUBE_APISERVER} \

--kubeconfig=${KUBE_PROXTCONFIG}

kubectl config set-credentials kube-proxy \

--client-certificate=/data/k8s/ssl/kube-proxy.pem \

--client-key=/data/k8s/ssl/kube-proxy-key.pem \

--embed-certs=true \

--kubeconfig=${KUBE_PROXTCONFIG}

kubectl config set-context default \

--cluster=kubernetes \

--user=kube-proxy \

--kubeconfig=${KUBE_PROXTCONFIG}

kubectl config use-context default --kubeconfig=${KUBE_PROXTCONFIG}

• 拷贝到配置文件指定路径：

cp kube-proxy.kubeconfig /data/k8s/kubernetes/config/

4、systemd管理kube-proxy

cat > /usr/lib/systemd/system/kube-proxy.service << EOF

[Unit]

Description=Kubernetes Proxy

After=network.target

[Service]

EnvironmentFile=/data/k8s/config/kube-proxy.conf

ExecStart=/data/k8s/bin/kube-proxy \$KUBE_PROXY_OPTS

Restart=on-failure

LimitNOFILE=65536

[Install]

WantedBy=multi-user.target

EOF

5、启动并设置开机启动

systemctl daemon-reload

systemctl start kube-proxy

systemctl enable kube-proxy

6、授权apiserver访问kubelet

cat > /root/apiserver-to-kubelet-rbac.yaml << EOF

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  annotations:

    rbac.authorization.kubernetes.io/autoupdate: "true"

  labels:

    kubernetes.io/bootstrapping: rbac-defaults

  name: system:kube-apiserver-to-kubelet

rules:

  - apiGroups:

      - ""

    resources:

      - nodes/proxy

      - nodes/stats

      - nodes/log

      - nodes/spec

      - nodes/metrics

      - pods/log

    verbs:

      - "*"

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: system:kube-apiserver

  namespace: ""

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: system:kube-apiserver-to-kubelet

subjects:

  - apiGroup: rbac.authorization.k8s.io

    kind: User

    name: kubernetes

EOF

kubectl apply -f /root/apiserver-to-kubelet-rbac.yaml