kubernetes集群之kube-controller-manager

编写证书请求文件

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

[root@master-1 work]# vim kube-controller-manager-csr.json   {     "CN": "system:kube-controller-manager",     "key": {         "algo": "rsa",         "size": 2048     },     "hosts": [       "127.0.0.1",       "192.168.10.28",       "192.168.10.29",       "192.168.10.30",       "192.168.10.31"     ],     "names": [       {         "C": "CN",         "ST": "Hubei",         "L": "Wuhan",         "O": "system:kube-controller-manager",         "OU": "system"       }     ] }

　　签发证书

?

1 2 3 4 5 6 7 8 9 10

[root@master-1 work]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager 2022/01/15 10:45:21 [INFO] generate received request 2022/01/15 10:45:21 [INFO] received CSR 2022/01/15 10:45:21 [INFO] generating key: rsa-2048 2022/01/15 10:45:21 [INFO] encoded CSR 2022/01/15 10:45:21 [INFO] signed certificate with serial number 511951674798984195538527015611202564940649002918 2022/01/15 10:45:21 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for websites. For more information see the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org); specifically, section 10.2.3 ("Information Requirements").

　　#创建kube-controller-manager的kubeconfig

1.设置集群参数

?

1 2 3 4 5 6 7 8 9 10

[root@master-1 work]# kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=https://192.168.10.29:6443 --kubeconfig=kube-controller-manager.kubeconfig Cluster "kubernetes" set. 您在 /var/spool/mail/root 中有新邮件 [root@master-1 work]# kubectl config set-credentials system:kube-controller-manager --client-certificate=kube-controller-manager.pem --client-key=kube-controller-manager-key.pem --embed-certs=true --kubeconfig=kube-controller-manager.kubeconfig User "system:kube-controller-manager" set. [root@master-1 work]#  kubectl config set-context system:kube-controller-manager --cluster=kubernetes --user=system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig Context "system:kube-controller-manager" created. [root@master-1 work]# kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig Switched to context "system:kube-controller-manager". 您在 /var/spool/mail/root 中有新邮件

　　

　　#创建配置文件kube-controller-manager.conf

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

[root@master-1 work]# vim kube-controller-manager.conf   KUBE_CONTROLLER_MANAGER_OPTS="--secure-port=10257 \   --bind-address=127.0.0.1 \   --kubeconfig=/etc/kubernetes/kube-controller-manager.kubeconfig \   --service-cluster-ip-range=10.255.0.0/16 \   --cluster-name=kubernetes \   --cluster-signing-cert-file=/etc/kubernetes/ssl/ca.pem \   --cluster-signing-key-file=/etc/kubernetes/ssl/ca-key.pem \   --allocate-node-cidrs=true \   --cluster-cidr=10.0.0.0/16 \   --experimental-cluster-signing-duration=87600h \   --root-ca-file=/etc/kubernetes/ssl/ca.pem \   --service-account-private-key-file=/etc/kubernetes/ssl/ca-key.pem \   --leader-elect=true \   --feature-gates=RotateKubeletServerCertificate=true \   --controllers=*,bootstrapsigner,tokencleaner \   --horizontal-pod-autoscaler-use-rest-clients=true \   --horizontal-pod-autoscaler-sync-period=10s \   --tls-cert-file=/etc/kubernetes/ssl/kube-controller-manager.pem \   --tls-private-key-file=/etc/kubernetes/ssl/kube-controller-manager-key.pem \   --use-service-account-credentials=true \   --alsologtostderr=true \   --logtostderr=false \   --log-dir=/var/log/kubernetes \   --v=2"

　创建启动文件

?

1 2 3 4 5 6 7 8 9 10 11

cat /usr/lib/systemd/system/kube-controller-manager.service [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/kubernetes/kubernetes [Service] EnvironmentFile=-/etc/kubernetes/kube-controller-manager.conf ExecStart=/usr/local/bin/kube-controller-manager $KUBE_CONTROLLER_MANAGER_OPTS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target

　　拷贝文件

　

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

[root@master-1 work]# cp kube-controller-manager*.pem /etc/kubernetes/ssl/ [root@xianchaomaster1 work]# cp kube-controller-manager.kubeconfig /etc/kubernetes/ [root@master-1 work]# cp kube-controller-manager.conf /etc/kubernetes/ [root@master-1 work]# cp kube-controller-manager.service /usr/lib/systemd/system/ [root@master-1 work]# rsync -vaz kube-controller-manager*.pem master-2:/etc/kubernetes/ssl/ sending incremental file list   sent 88 bytes  received 12 bytes  200.00 bytes/sec total size is 3,184  speedup is 31.84 您在 /var/spool/mail/root 中有新邮件 [root@master-1 work]# rsync -vaz kube-controller-manager*.pem master-3:/etc/kubernetes/ssl/ sending incremental file list kube-controller-manager-key.pem kube-controller-manager.pem   sent 2,505 bytes  received 54 bytes  5,118.00 bytes/sec total size is 3,184  speedup is 1.24 [root@master-1 work]# rsync -vaz kube-controller-manager.kubeconfig kube-controller-manager.conf master-2:/etc/kubernetes sending incremental file list kube-controller-manager.conf kube-controller-manager.kubeconfig   sent 624 bytes  received 114 bytes  1,476.00 bytes/sec total size is 7,581  speedup is 10.27 您在 /var/spool/mail/root 中有新邮件 [root@master-1 work]# rsync -vaz kube-controller-manager.kubeconfig kube-controller-manager.conf master-3:/etc/kubernetes sending incremental file list kube-controller-manager.conf kube-controller-manager.kubeconfig   sent 624 bytes  received 114 bytes  1,476.00 bytes/sec total size is 7,581  speedup is 10.27 [root@master-1 work]# rsync -vaz kube-controller-manager.service master-2:/usr/lib/systemd/system/ sending incremental file list kube-controller-manager.service   sent 111 bytes  received 41 bytes  304.00 bytes/sec total size is 324  speedup is 2.13 [root@master-1 work]# rsync -vaz kube-controller-manager.service master-3:/usr/lib/systemd/system/ sending incremental file list kube-controller-manager.service   sent 111 bytes  received 41 bytes  304.00 bytes/sec total size is 324  speedup is 2.13 [root@master-1 work]#

　　

　启动

?

1 2 3 4

systemctl daemon-reload systemctl enable kube-controller-manager systemctl start kube-controller-manager systemctl status kube-controller-manager