二进制安装K8s 之 部署kube-controller-manager

1、创建配置文件

cat > /data/k8s/config/kube-controller-manager.conf << EOF

KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=false \\

--v=2 \\

--log-dir=/data/k8s/logs \\

--leader-elect=true \\

--kubeconfig=/data/k8s/config/kube-controller-manager.kubeconfig \\

--bind-address=127.0.0.1 \\

--allocate-node-cidrs=true \\

--cluster-cidr=10.244.0.0/16 \\

--service-cluster-ip-range=10.0.0.0/24 \\

--cluster-signing-cert-file=/data/k8s/ssl/ca.pem \\

--cluster-signing-key-file=/data/k8s/ssl/ca-key.pem  \\

--root-ca-file=/data/k8s/ssl/ca.pem \\

--service-account-private-key-file=/data/k8s/ssl/ca-key.pem \\

--experimental-cluster-signing-duration=87600h0m0s"

EOF

• –master：通过本地非安全本地端口8080连接apiserver。
• –leader-elect：当该组件启动多个时，自动选举（HA）
• –cluster-signing-cert-file/–cluster-signing-key-file：自动为kubelet颁发证书的CA，与apiserver保持一致

2、生成kube-controller-manage 证书：

cat >/data/docker/TSL/k8s/kube-controller-manager-csr.json <<EOF

{

    "CN": "system:kube-controller-manager",

    "hosts": [],

    "key": {

        "algo": "rsa",

        "size": 2048

    },

    "names": [

        {

            "C": "CN",

            "L": "Beijing",

            "ST": "Beijing",

            "O": "system:masters",

            "OU": "System"

        }

    ]

}

EOF

• 生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

#拷贝生成的.pem证书到k8s证书目录

cp kube-controller-manager*.pem /data/k8s/ssl/

3、生成kubeconfig文件：

# 在 shell 命令行直接执

KUBE_CONFIG="/data/k8s/config/kube-controller-manager.kubeconfig"

KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \

--certificate-authority=/data/k8s/ssl/ca.pem \

--embed-certs=true \

--server=${KUBE_APISERVER} \

--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials kube-controller-manager \

--client-certificate=/data/k8s/ssl/kube-controller-manager.pem \

--client-key=/data/k8s/ssl/kube-controller-manager-key.pem \

--embed-certs=true \

--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \

--cluster=kubernetes \

--user=kube-controller-manager \

--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成的 kube-controller-manager.kubeconfig 文件

#查看，文件里会有密钥，这里忽略，server: 地址就是k8s master 地址

cat /data/k8s/config/kube-controller-manager.kubeconfig

apiVersion: v1

clusters:

- cluster:

    certificate-authority-data: =

    server: https://192.168.100.170:6443

  name: kubernetes

contexts:

- context:

    cluster: kubernetes

    user: kube-controller-manager

  name: default

current-context: default

kind: Config

preferences: {}

users:

- name: kube-controller-manager

  user:

    client-certificate-data:

    client-key-data:

4、systemd管理controller-manager

cat > /usr/lib/systemd/system/kube-controller-manager.service << EOF

[Unit]

Description=Kubernetes Controller Manager

Documentation=https://github.com/kubernetes/kubernetes

[Service]

EnvironmentFile=/data/k8s/config/kube-controller-manager.conf

ExecStart=/data/k8s/bin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS

Restart=on-failure

[Install]

WantedBy=multi-user.target

EOF

4、启动并设置开机启动

systemctl daemon-reload

systemctl start kube-controller-manager

systemctl enable kube-controller-manager