手动安装K8s第七节：node节点部署-kube-proxy

Posted 2020-11-18

部署Kubernetes Proxy

vim CentOS-Base.repo

[base]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-7-11.noarch.rpm

rpm -ivh epel-release-7-11.noarch.rpm

1.配置kube-proxy使用LVS
[[email protected] ~]# yum install -y ipvsadm ipset conntrack

[[email protected] opt]# cd /usr/local/src/ssl/
[[email protected] ssl]# vim kube-proxy-csr.json

{
"CN": "system:kube-proxy",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}

3.生成证书
[[email protected] ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem
-ca-key=/opt/kubernetes/ssl/ca-key.pem
-config=/opt/kubernetes/ssl/ca-config.json
-profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

4.分发证书到所有节点
[[email protected] ssl]# cp kube-proxy.pem /opt/kubernetes/ssl/
[[email protected] ssl]# scp kube-proxy.pem k8snode1:/opt/kubernetes/ssl/
[[email protected] ssl]# scp kube-proxy*.pem k8snode2:/opt/kubernetes/ssl/

5.创建kube-proxy配置文件
[[email protected] ssl]# kubectl config set-cluster kubernetes
--certificate-authority=/opt/kubernetes/ssl/ca.pem
--embed-certs=true
--server=https://192.168.137.171:6443
--kubeconfig=kube-proxy.kubeconfig

[[email protected] ssl]# kubectl config set-credentials kube-proxy
--client-certificate=/opt/kubernetes/ssl/kube-proxy.pem
--client-key=/opt/kubernetes/ssl/kube-proxy-key.pem
--embed-certs=true
--kubeconfig=kube-proxy.kubeconfig
User "kube-proxy" set.

[[email protected] ssl]# kubectl config set-context default
--cluster=kubernetes
--user=kube-proxy
--kubeconfig=kube-proxy.kubeconfig
Context "default" created.

[[email protected] ssl]# kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
Switched to context "default".

6.分发kubeconfig配置文件
[[email protected] ssl]# cp kube-proxy.kubeconfig /opt/kubernetes/cfg/
[[email protected] ssl]# scp kube-proxy.kubeconfig k8snode1:/opt/kubernetes/cfg/
[[email protected] ssl]# scp kube-proxy.kubeconfig k8snode2:/opt/kubernetes/cfg/

7.创建kube-proxy服务配置（node节点）
[[email protected] ~]# mkdir /var/lib/kube-proxy
[[email protected] ~]# vim /usr/lib/systemd/system/kube-proxy.service

[Unit]
Description=Kubernetes Kube-Proxy Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
WorkingDirectory=/var/lib/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy
--bind-address=192.168.137.201
--hostname-override=192.168.137.201
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig
--masquerade-all
--feature-gates=SupportIPVSProxyMode=true
--proxy-mode=ipvs
--ipvs-min-sync-period=5s
--ipvs-sync-period=5s
--ipvs-scheduler=rr
--logtostderr=true
--v=2
--logtostderr=false
--log-dir=/opt/kubernetes/log

Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

9.查看服务状态 查看kube-proxy服务状态
[[email protected] ~]# systemctl daemon-reload
[[email protected] ~]# systemctl enable kube-proxy
[[email protected] ~]# systemctl start kube-proxy
[[email protected] ~]# systemctl status kube-proxy

在node节点查看LVS状态
[[email protected] ~]# ipvsadm -L -n
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.137.201:33246 rr
TCP 192.168.137.215:33246 rr
TCP 10.1.0.1:443 rr persistent 10800
-> 192.168.137.171:6443 Masq 1 0 0
TCP 10.1.0.2:53 rr
TCP 10.1.72.67:443 rr
TCP 10.1.233.95:80 rr
TCP 127.0.0.1:33246 rr
TCP 172.17.0.1:33246 rr
UDP 10.1.0.2:53 rr

master节点查看 node状态
[[email protected] ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8snode1 Ready <none> 1h v1.10.1
k8snode2 Ready <none> 1h v1.10.1