技術標籤：k8skubernetes

部署k8s master

1.下載kubernetes-server包

wget https://dl.k8s.io/v1.20.1/kubernetes-server-linux-arm.tar.gz

2.解壓

mkdir -p /opt/kubernetes/{bin,cfg,ssl,logs}
tar -zxvf kubernetes-server-linux-amd64.tar.gz
cd kubernetes/server/bin
cp kube-apiserver kube-scheduler kube-controller-manager /opt/kubernetes/bin
cp
 
 kubectl /usr/bin/

3.將執行檔案移動到/usr/bin

mv flanneld /usr/bin
mv mk-docker-opts.sh /usr/bin

4.建立kube-apiserver配置檔案

cat > /opt/kubernetes/cfg/kube-apiserver.conf << EOF
KUBE_APISERVER_OPTS="--logtostderr=false \
--v=2 \
--log-dir=/opt/kubernetes/logs \
--etcd-servers=https://192.168.221.128:2379,https://192.168.221.129:2379,https://192.168.221.130:2379 \
--bind-address=192.168.221.128 \
--secure-port=6443 \
--advertise-address=192.168.221.128 \
--allow-privileged=true \
--service-cluster-ip-range=10.0.0.0/24 \
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction \
--authorization-mode=RBAC,Node \
--enable-bootstrap-token-auth=true \
--token-auth-file=/opt/kubernetes/cfg/token.csv \
--service-node-port-range=30000-32767 \
--kubelet-client-certificate=/opt/kubernetes/ssl/server.pem \
--kubelet-client-key=/opt/kubernetes/ssl/server-key.pem \
--tls-cert-file=/opt/kubernetes/ssl/server.pem  \
--tls-private-key-file=/opt/kubernetes/ssl/server-key.pem \
--client-ca-file=/opt/kubernetes/ssl/ca.pem \
--service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \
--service-account-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \
--service-account-issuer=kubernetes.default.svc \
--etcd-cafile=/opt/etcd/ssl/ca.pem \
--etcd-certfile=/opt/etcd/ssl/server.pem \
--etcd-keyfile=/opt/etcd/ssl/server-key.pem \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path=/opt/kubernetes/logs/k8s-audit.log"
EOF
 

備註

–logtostderr：啟用日誌

—v：日誌等級

–log-dir：日誌目錄

–etcd-servers：etcd叢集地址

–bind-address：監聽地址

–secure-port：https安全埠

–advertise-address：叢集通告地址

–allow-privileged：啟用授權

–service-cluster-ip-range：Service虛擬IP地址段

–enable-admission-plugins：准入控制模組

–authorization-mode：認證授權，啟用RBAC授權和節點自管理

–enable-bootstrap-token-auth：啟用TLS bootstrap機制

–token-auth-file：bootstrap token檔案

–service-node-port-range：Service nodeport型別預設分配埠範圍

–kubelet-client-xxx：apiserver訪問kubelet客戶端證書

–tls-xxx-file：apiserver https證書

–etcd-xxxfile：連線Etcd叢集證書

–audit-log-xxx：審計日誌

5.拷貝k8s證書

cp ca*pem server*pem /opt/kubernetes/ssl