部署k8s Node

1.移动kubelet bin文件

cp kubelet /opt/kubernetes/bin
scp kubelet root@192.168.201.129:/opt/kubernetes/bin
scp kubelet root@192.168.201.130:/opt/kubernetes/bin

2.创建kubelet kubeconfig文件

kubectl config set-cluster kubernetes --certificate-authority=/opt/kubernetes/ssl/ca.pem --embed-certs=true --server=https://192.168.201.128:6443 --kubeconfig=kubelet-bootstrap.kubeconfig

# token 为 token.csv文件中的token
kubectl config set-credentials kubelet-bootstrap --token=7170af4e8962c07460b5dfbbeab0b7fc --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl config set-context default --cluster=kubernetes --user=kubelet-bootstrap --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl config use-context default --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

scp kubelet-bootstrap.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg
scp kubelet-bootstrap.kubeconfig root@192.168.201.129:/opt/kubernetes/cfg

3.创建kubelet配置文件

vi kubelet.json

# # 如果docker的驱动为systemd，cgroupDriver处修改为systemd。此处设置很重要，否则后面node节点无法加入到集群
{
  "kind": "KubeletConfiguration",
  "apiVersion": "kubelet.config.k8s.io/v1beta1",
  "authentication": {
    "x509": {
      "clientCAFile": "/opt/kubernetes/ssl/ca.pem"
    },
    "webhook": {
      "enabled": true,
      "cacheTTL": "2m0s"
    },
    "anonymous": {
      "enabled": false
    }
  },
  "authorization": {
    "mode": "Webhook",
    "webhook": {
      "cacheAuthorizedTTL": "5m0s",
      "cacheUnauthorizedTTL": "30s"
    }
  },
  "address": "192.168.201.128",
  "port": 10250,
  "readOnlyPort": 10255,
  "cgroupDriver": "cgroupfs",                     
  "hairpinMode": "promiscuous-bridge",
  "serializeImagePulls": false,
  "featureGates": {
    "RotateKubeletClientCertificate": true,
    "RotateKubeletServerCertificate": true
  },
  "clusterDomain": "cluster.local.",
  "clusterDNS": ["10.255.0.1"]
}

scp kubelet.json root@192.168.201.129:/opt/kubernetes/cfg
scp kubelet.json root@192.168.201.130:/opt/kubernetes/cfg

4.创建kubelet启动文件

vi /usr/lib/systemd/system/kubelet.service

[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/kubernetes/kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/opt/kubernetes/bin/kubelet \
  --bootstrap-kubeconfig=/opt/kubernetes/cfg/kubelet-bootstrap.kubeconfig \
  --cert-dir=/opt/kubernetes/ssl \
  --kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \
  --config=/opt/kubernetes/cfg/kubelet.json \
  --network-plugin=cni \
  --pod-infra-container-image=k8s.gcr.io/pause:3.2 \
  --alsologtostderr=true \
  --logtostderr=false \
  --log-dir=/var/log/kubernetes \
  --v=2
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

–hostname-override：显示名称，集群中唯一
–network-plugin：启用CNI
–kubeconfig：空路径，会自动生成，后面用于连接apiserver
–bootstrap-kubeconfig：首次启动向apiserver申请证书
–config：配置参数文件
–cert-dir：kubelet证书生成目录
–pod-infra-container-image：管理Pod网络容器的镜像

scp /usr/lib/systemd/system/kubelet.service root@192.168.201.129:/usr/lib/systemd/system
scp /usr/lib/systemd/system/kubelet.service root@192.168.201.130:/usr/lib/systemd/system

5.配置docker

# 配置镜像源
vi /etc/docker/daemon.json

{
    "exec-opts": ["native.cgroupdriver=systemd"],
    "registry-mirrors": [
        "https://1nj0zren.mirror.aliyuncs.com",
        "https://kfwkfulq.mirror.aliyuncs.com",
        "https://2lqq34jg.mirror.aliyuncs.com",
        "https://pee6w651.mirror.aliyuncs.com",
        "http://hub-mirror.c.163.com",
        "https://docker.mirrors.ustc.edu.cn",
        "http://f1361db2.m.daocloud.io",
        "https://registry.docker-cn.com"
    ]
}

systemctl restart docker

# 根据结果修改kubelet.json中的cgroupDriver字段
docker info | grep "Cgroup Driver"

# 配置依赖镜像
docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2 k8s.gcr.io/pause:3.2
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2

docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0 k8s.gcr.io/coredns:1.7.0
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.7.0

6.启动kubelet

swapoff -a

systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet
systemctl status kubelet

7.node节点申请证书及处理

kubectl get csr

# 同意node节点申请
kubectl certificate approve node-csr-5HUR2owmeLoopO_z2dFoQuax7ZkHeyEpB4_ZQI9xKg4

kubectl certificate approve node-csr-8hOsOouGK0elW7U9cc9AKF3iHDu0XJDQrqKeg_b6ftw

kubectl certificate approve node-csr-i3f0Zblr-c9Fn--OoRBTxZt_4W6y9CrL-UjKWDqo71k