2-3.2 安装和配置kubectl

3.2.1 创建 admin 证书和私钥

在 pg60-200.k8s.host.com 虚机实例上操作

• 创建生成证书签名请求（csr）的 json 配置文件

shell> cat > admin-csr.json << EOF
{
    "CN": "admin",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "BeiJing",
            "L": "BeiJing",
            "O": "system:masters",
            "OU": "ops"
        }
    ]
}
EOF

• 生成client证书和私钥

shell> cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client admin-csr.json | cfssl-json -bare admin
2020/05/09 12:51:36 [INFO] generate received request
2020/05/09 12:51:36 [INFO] received CSR
2020/05/09 12:51:36 [INFO] generating key: rsa-2048
2020/05/09 12:51:37 [INFO] encoded CSR
2020/05/09 12:51:37 [INFO] signed certificate with serial number 401229144308676946860009337123703016454826971073
2020/05/09 12:51:37 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

• 将生成的证书和私钥文件拷贝到所有 master 和 node 节点：

shell> scp admin*.pem root@${master_ip}:/etc/kubernetes/pki/
shell> scp admin*.pem root@${note_ip}:/etc/kubernetes/pki/

3.2.2 下载并安装 kubectl 二进制文件

在 pg60-21.k8s.host.com 虚机实例上操作

shell> cd /usr/local/src/
shell> wget http://dlsw.91donkey.com/software/source/k8s/v1.18.2/kubernetes-client-linux-amd64.tar.gz
shell> tar zxf kubernetes-client-linux-amd64.tar.gz -C /opt/

3.2.3 创建 kubeconfig 文件

# 设置集群参数
shell> /opt/kubernetes/client/bin/kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/pki/ca.pem \
  --embed-certs=true \
  --server=https://10.20.60.10:6443 \
  --kubeconfig=kubectl.kubeconfig

# 设置客户端认证参数
shell> /opt/kubernetes/client/bin/kubectl config set-credentials admin \
  --client-certificate=/etc/kubernetes/pki/admin.pem \
  --client-key=/etc/kubernetes/pki/admin-key.pem \
  --embed-certs=true \
  --kubeconfig=kubectl.kubeconfig

# 设置上下文参数
shell> /opt/kubernetes/client/bin/kubectl config set-context kubernetes \
  --cluster=kubernetes \
  --user=admin \
  --kubeconfig=kubectl.kubeconfig

# 设置默认上下文
shell> /opt/kubernetes/client/bin/kubectl config use-context kubernetes --kubeconfig=kubectl.kubeconfig

3.2.4 配置环境变量

分发到所有使用 kubectl 命令的节点：

shell> mkdir ~/.kube
shell> cp /usr/local/src/kubectl.kubeconfig ~/.kube/config