二進(jìn)制安裝K8s之部署kube-scheduler

1剃执、創(chuàng)建配置文件

cat > /data/k8s/config/kube-scheduler.conf << EOF
KUBE_SCHEDULER_OPTS="--logtostderr=false \\
--v=2 \\
--log-dir=/data/k8s/kubernetes/logs \\
--leader-elect \\
--kubeconfig=/data/k8s/config/kube-scheduler.kubeconfig \\
--bind-address=127.0.0.1"
EOF

• –leader-elect：當(dāng)該組件啟動(dòng)多個(gè)時(shí)誓禁，自動(dòng)選舉（HA）

2、生成kube-scheduler 證書(shū)：

cat > /data/docker/TSL/k8s/kube-scheduler-csr.json <<EOF
{
    "CN": "system:kube-scheduler",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "system:masters",
            "OU": "System"
        }
    ]
}
EOF

• 生成證書(shū)

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

#拷貝生成的.pem證書(shū)

cp /data/docker/TSL/k8s/kube-scheduler*.pem /data/k8s/ssl/

3肾档、生成kube-scheduler.kubeconfig 配置文件

#在shell 命令行執(zhí)行

KUBE_CONFIG="/data/k8s/config/kube-scheduler.kubeconfig"
KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \
--certificate-authority=/data/k8s/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials kube-scheduler \
--client-certificate=/data/k8s/ssl/kube-scheduler.pem \
--client-key=/data/k8s/ssl/kube-scheduler-key.pem \
--embed-certs=true \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \
--cluster=kubernetes \
--user=kube-scheduler \
--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}


#生成 kube-controller-manager.kubeconfig 文件
##查看摹恰，文件里會(huì)有密鑰辫继，這里忽略,server: 地址就是k8s master 地址
 cat /data/k8s/config/kube-controller-manager.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: =
    server: https://192.168.100.170:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kube-scheduler
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: kube-scheduler
  user:
    client-certificate-data: 
    client-key-data: =

4、systemd管理scheduler

cat > /usr/lib/systemd/system/kube-scheduler.service << EOF
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/kubernetes/kubernetes
[Service]
EnvironmentFile=/data/k8s/config/kube-scheduler.conf
ExecStart=/data/k8s/bin/kube-scheduler \$KUBE_SCHEDULER_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF

5俗慈、啟動(dòng)并設(shè)置開(kāi)機(jī)啟動(dòng)

systemctl daemon-reload
systemctl start kube-scheduler
systemctl enable kube-scheduler

6骇两、生成admin證書(shū)

cat > /data/docker/TSL/k8s/admin-csr.json <<EOF
{
    "CN": "admin",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "system:masters",
            "OU": "System"
        }
    ]
}
EOF

• 生成證書(shū)

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

#拷貝證書(shū)

cp /data/docker/TSL/k8s/admin*.pem /data/k8s/ssl/

• 生成 kuconfig文件

#在shell命令行執(zhí)行

KUBE_CONFIG="/data/k8s/config/config"
KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \
--certificate-authority=/data/k8s/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials cluster-admin \
--client-certificate=/data/k8s/ssl/admin.pem \
--client-key=/data/k8s/ssl/admin-key.pem \
--embed-certs=true \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-context default \
--cluster=kubernetes \
--user=cluster-admin \
--kubeconfig=${KUBE_CONFIG} 

kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成的文件在/data/k8s/config/config
#k8s 默認(rèn)配置文件位置：/root/.kube/ 
#創(chuàng)建目錄
mkdir /root/.kube/ 

#復(fù)制文件
cp /data/k8s/config/config /root/.kube/config

#查看授權(quán)文件
cat config/config
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: =
    server: https://192.168.0.170:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kube-controller-manager
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: cluster-admin
  user:
    client-certificate-data: ==
    client-key-data: =

7、 測(cè)試

#1.21
[root@master01 k8s]# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME                 STATUS    MESSAGE                         ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-2               Healthy   {"health":"true","reason":""}
etcd-0               Healthy   {"health":"true","reason":""}
etcd-1               Healthy   {"health":"true","reason":""}


#1.20
[root@k8s-master01 k8s]# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME                 STATUS    MESSAGE             ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-1               Healthy   {"health":"true"}
etcd-0               Healthy   {"health":"true"}
etcd-2               Healthy   {"health":"true"}

8姜盈、創(chuàng)建集群角色綁定，后面用

將apiserver-config 配置里的token 文件用戶名綁定

/data/k8s/config/token.csv

kubectl create clusterrolebinding kubelet-bootstrap \
--clusterrole=system:node-bootstrapper \
--user=kubelet-bootstrap