1.hdss7-21安装
[root@hdss7-21 ~]# yum install ipset -y [root@hdss7-21 conf]# yum -y install ipvsadm [root@hdss7-21 ~]# cd /opt/kubernetes/server/bin/cert/ [root@hdss7-21 cert]# scp hdss7-200:/opt/certs/kube-proxy-client-key.pem ./ root@hdss7-200's password: kube-proxy-client-key.pem 100% 1679 1.2MB/s 00:00 [root@hdss7-21 cert]# scp hdss7-200:/opt/certs/kube-proxy-client.pem ./ root@hdss7-200's password: kube-proxy-client.pem [root@hdss7-21 cert]# cd /opt/kubernetes/server/bin/conf kubectl config set-cluster myk8s \ --certificate-authority=/opt/kubernetes/server/bin/cert/ca.pem \ --embed-certs=true \ --server=https://192.168.12.10:7443 \ --kubeconfig=kube-proxy.kubeconfig [root@hdss7-21 conf]# kubectl config set-credentials kube-proxy \ --client-certificate=/opt/kubernetes/server/bin/cert/kube-proxy-client.pem \ --client-key=/opt/kubernetes/server/bin/cert/kube-proxy-client-key.pem \ --embed-certs=true \ --kubeconfig=kube-proxy.kubeconfig [root@hdss7-21 conf]# kubectl config set-context myk8s-context \ --cluster=myk8s \ --user=kube-proxy \ --kubeconfig=kube-proxy.kubeconfig [root@hdss7-21 conf]# kubectl config use-context myk8s-context --kubeconfig=kube-proxy.kubeconfig [root@hdss7-21 conf]# cat /root/ipvs.sh 编辑开启ipvs内核的脚本： #!/bin/bash ipvs_mods_dir="/usr/lib/modules/$(uname -r)/kernel/net/netfilter/ipvs" for i in $(ls $ipvs_mods_dir|grep -o "^[^.]*") do /sbin/modinfo -F filename $i &>/dev/null if [ $? -eq 0 ];then /sbin/modprobe $i fi done [root@hdss7-21 conf]# chmod +x /root/ipvs.sh [root@hdss7-21 conf]# sh /root/ipvs.sh [root@hdss7-21 conf]# cat /opt/kubernetes/server/bin/kube-proxy.sh #!/bin/sh ./kube-proxy \ --cluster-cidr 172.7.0.0/16 \ --hostname-override hdss7-21.host.com \ --proxy-mode=ipvs \ --ipvs-scheduler=nq \ --kubeconfig ./conf/kube-proxy.kubeconfig [root@hdss7-21 conf]# chmod +x /opt/kubernetes/server/bin/kube-proxy.sh [root@hdss7-21 conf]# mkdir -p /data/logs/kubernetes/kube-proxy [root@hdss7-21 conf]# vi /etc/supervisord.d/kube-proxy.ini [root@hdss7-21 conf]# cat /etc/supervisord.d/kube-proxy.ini [program:kube-proxy-7-21] command=/opt/kubernetes/server/bin/kube-proxy.sh ; the program (relative uses PATH, can take args) numprocs=1 ; number of processes copies to start (def 1) directory=/opt/kubernetes/server/bin ; directory to cwd to before exec (def no cwd) autostart=true ; start at supervisord start (default: true) autorestart=true ; retstart at unexpected quit (default: true) startsecs=30 ; number of secs prog must stay running (def. 1) startretries=3 ; max # of serial start failures (default 3) exitcodes=0,2 ; 'expected' exit codes for process (default 0,2) stopsignal=QUIT ; signal used to kill process (default TERM) stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10) user=root ; setuid to this UNIX account to run the program redirect_stderr=true ; redirect proc stderr to stdout (default false) stdout_logfile=/data/logs/kubernetes/kube-proxy/proxy.stdout.log ; stderr log path, NONE for none; default AUTO stdout_logfile_maxbytes=64MB ; max # logfile bytes b4 rotation (default 50MB) stdout_logfile_backups=4 ; # of stdout logfile backups (default 10) stdout_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0) stdout_events_enabled=false ; emit events on stdout writes (default false) [root@hdss7-21 conf]# supervisorctl status etcd-server-7-21 RUNNING pid 1297, uptime 4:27:30 kube-apiserver-7-21 RUNNING pid 48809, uptime 0:40:56 kube-controller-manager-7-21 RUNNING pid 48870, uptime 0:40:44 kube-kubelet-7-21 RUNNING pid 28120, uptime 2:23:34 kube-proxy-7-21 RUNNING pid 55497, uptime 0:00:32 kube-scheduler-7-21 RUNNING pid 48860, uptime 0:40:45 [root@hdss7-21 conf]# vi /root/nginx-ds.yaml [root@hdss7-21 conf]# kubectl create -f /root/nginx-ds.yaml 只需在21机器创建即可
2.hdss7-22安装
[root@hdss7-22 ~]# yum install ipset -y [root@hdss7-22 conf]# yum -y install ipvsadm [root@hdss7-22 ~]# cd /opt/kubernetes/server/bin/cert/ [root@hdss7-22 cert]# scp hdss7-200:/opt/certs/kube-proxy-client-key.pem ./ root@hdss7-200's password: kube-proxy-client-key.pem 100% 1679 1.0MB/s 00:00 [root@hdss7-22 cert]# scp hdss7-200:/opt/certs/kube-proxy-client.pem ./ root@hdss7-200's password: kube-proxy-client.pem [root@hdss7-22 cert]# cd /opt/kubernetes/server/bin/conf [root@hdss7-22 conf]# ll total 16 -rw-r--r-- 1 root root 2223 Jun 6 16:01 audit.yaml -rw-r--r-- 1 root root 258 Jun 6 19:32 k8s-node.yaml -rw------- 1 root root 6175 Jun 7 10:55 kubelet.kubeconfig [root@hdss7-22 conf]# kubectl config set-cluster myk8s \ > --certificate-authority=/opt/kubernetes/server/bin/cert/ca.pem \ > --embed-certs=true \ > --server=https://192.168.12.10:7443 \ > --kubeconfig=kube-proxy.kubeconfig Cluster "myk8s" set. [root@hdss7-22 conf]# kubectl config set-credentials kube-proxy \ > --client-certificate=/opt/kubernetes/server/bin/cert/kube-proxy-client.pem \ > --client-key=/opt/kubernetes/server/bin/cert/kube-proxy-client-key.pem \ > --embed-certs=true \ > --kubeconfig=kube-proxy.kubeconfig User "kube-proxy" set. [root@hdss7-22 conf]# kubectl config set-context myk8s-context \ > --cluster=myk8s \ > --user=kube-proxy \ > --kubeconfig=kube-proxy.kubeconfig Context "myk8s-context" created. [root@hdss7-22 conf]# kubectl config use-context myk8s-context --kubeconfig=kube-proxy.kubeconfig Switched to context "myk8s-context". [root@hdss7-22 conf]# vi /root/ipvs.sh [root@hdss7-22 conf]# cat /root/ipvs.sh #!/bin/bash ipvs_mods_dir="/usr/lib/modules/$(uname -r)/kernel/net/netfilter/ipvs" for i in $(ls $ipvs_mods_dir|grep -o "^[^.]*") do /sbin/modinfo -F filename $i &>/dev/null if [ $? -eq 0 ];then /sbin/modprobe $i fi done [root@hdss7-22 conf]# chmod +x /root/ipvs.sh [root@hdss7-22 conf]# sh /root/ipvs.sh [root@hdss7-22 conf]# vi /opt/kubernetes/server/bin/kube-proxy.sh [root@hdss7-22 conf]# cat /opt/kubernetes/server/bin/kube-proxy.sh #!/bin/sh ./kube-proxy \ --cluster-cidr 172.7.0.0/16 \ --hostname-override hdss7-22.host.com \ --proxy-mode=ipvs \ --ipvs-scheduler=nq \ --kubeconfig ./conf/kube-proxy.kubeconfig [root@hdss7-22 conf]# mkdir -p /data/logs/kubernetes/kube-proxy [root@hdss7-22 conf]# vi /etc/supervisord.d/kube-proxy.ini [root@hdss7-22 conf]# cat /etc/supervisord.d/kube-proxy.ini [program:kube-proxy-7-22] command=/opt/kubernetes/server/bin/kube-proxy.sh ; the program (relative uses PATH, can take args) numprocs=1 ; number of processes copies to start (def 1) directory=/opt/kubernetes/server/bin ; directory to cwd to before exec (def no cwd) autostart=true ; start at supervisord start (default: true) autorestart=true ; retstart at unexpected quit (default: true) startsecs=30 ; number of secs prog must stay running (def. 1) startretries=3 ; max # of serial start failures (default 3) exitcodes=0,2 ; 'expected' exit codes for process (default 0,2) stopsignal=QUIT ; signal used to kill process (default TERM) stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10) user=root ; setuid to this UNIX account to run the program redirect_stderr=true ; redirect proc stderr to stdout (default false) stdout_logfile=/data/logs/kubernetes/kube-proxy/proxy.stdout.log ; stderr log path, NONE for none; default AUTO stdout_logfile_maxbytes=64MB ; max # logfile bytes b4 rotation (default 50MB) stdout_logfile_backups=4 ; # of stdout logfile backups (default 10) stdout_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0) stdout_events_enabled=false ; emit events on stdout writes (default false) [root@hdss7-22 conf]# [root@hdss7-22 conf]# supervisorctl update kube-proxy-7-22: added process group
3 hdss7-200申请证书
[root@hdss7-200 certs]# cat /opt/certs/kube-proxy-csr.json { "CN": "system:kube-proxy", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "beijing", "L": "beijing", "O": "od", "OU": "ops" } ] } [root@hdss7-200 certs]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client kube-proxy-csr.json |cfssl-json -bare kube-proxy-client
