kubernetes核心组件
1.kubelet
kubelet运行于集群的所有节点上，包括master的节点。
kubelet用于处理master节点下发到本节点的任务，管理本节点上的pod以及pod中的容器。
每个kubelet会在APIServer上注册本节点的信息，并定期上报本节点的资源使用情况。
kubelet先于集群而存在于每个节点上的。
kubelet作为集群节点的后台守护进程，在节点启动时，由节点上的操作系统init进程（systemd）拉起。
分别是下面两个文件：
root@VM-16-6-ubuntu:~# ls /lib/systemd/system/kubelet.service /lib/systemd/system/kubelet.service root@VM-16-6-ubuntu:~# ls /etc/systemd/system/kubelet.service.d/10-kubeadm.conf /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
kubelet主要参数配置：
root@VM-16-6-ubuntu:~# cat /etc/systemd/system/kubelet.service.d/10-kubeadm.conf [Service] Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf" Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true" Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin" Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local" Environment="KUBELET_AUTHZ_ARGS=--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.crt" Environment="KUBELET_CADVISOR_ARGS=--cadvisor-port=0" Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki" ExecStart= ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_AUTHZ_ARGS $KUBELET_CADVISOR_ARGS $KUBELET_CERTIFICATE_ARGS $KUBELET_EXTRA_ARGS
bootstrap-kubeconfig用于在kubeconfig文件不存在的情况下，像APIServer获取client端的证书文件。
获取的证书文件将存储在cert-dir指定的目录下。同时数据也将写入一份到kubeconfig指定的目录里面。
pod-manifest-path是静态pod的manifest的存放路径。kubelet将启动这些pod，并维持这些pod处于运行状态。
KUBELET_NETWORK_ARGS是与节点上cni网络插件相关的配置。kubelet通过这个配置，来调用cni相关程序，配置容器中的相关网络。
KUBELET_DNS_ARGS是集群DNS相关的配置。
cadvisor-port默认值是4194，当配置为0的时候，表示不在节点上开始cadvisor服务。
cadvisor是一个分析容器资源使用率和性能特性的代理工具，默认情况下会在每个节点上安装Agent。
通过暴露cadvisor-port来提供服务。
多数情况下，不需要修改启动文件的参数。修改之后执行：
systemctl daemon-reload & systemctl restart kubelet
2.kube-apiserver
kube-apiserver是整个集群调用的入口，通过APIServer暴露的API实现对整个集群的对象和状态管理。
kubeadm引导建立的kubernetes集群的APIServer是以静态pod的形式运行的，由kubelet启动。
APIServer是一个庞大的单体程序。可以查看APIServer的配置yaml：
apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: kube-apiserver spec: containers: - command: - kube-apiserver - --insecure-port=0 #APIServer非安全服务端口,默认不开启 - --requestheader-username-headers=X-Remote-User - --client-ca-file=/etc/kubernetes/pki/ca.crt - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key #APIServer以client端身份访问kubelet所使用的私钥文件 - --secure-port=6443 - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt - --requestheader-extra-headers-prefix=X-Remote-Extra- - --service-cluster-ip-range=10.96.0.0/12 #设置无类别预见地址的分配范围.不能与pod地址有交集 - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt #APIServer以client端身份访问kubelet使用的数字公钥证书. - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt - --allow-privileged=true #是否允许启动特权容器 - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --requestheader-allowed-names=front-proxy-client - --service-account-key-file=/etc/kubernetes/pki/sa.pub - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key - --enable-bootstrap-token-auth=true #允许secret对象进行集群初始化 - --requestheader-group-headers=X-Remote-Group - --advertise-address=148.70.251.10 - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt #APIserver公钥证书文件 - --authorization-mode=Node,RBAC #设置用户授权模式列表 - --etcd-servers=https://127.0.0.1:2379 #服务地址 - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt #ca证书 - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key image: k8s.gcr.io/kube-apiserver-amd64:v1.10.2 livenessProbe: failureThreshold: 8 httpGet: host: 148.70.251.10 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/pki name: k8s-certs readOnly: true - mountPath: /etc/ssl/certs name: ca-certs readOnly: true hostNetwork: true volumes: - hostPath: path: /etc/kubernetes/pki type: DirectoryOrCreate name: k8s-certs - hostPath: path: /etc/ssl/certs type: DirectoryOrCreate name: ca-certs status: {}
kubelet监听/etc/kubernetes/manifests目录变化,自动重启配置发生变化的apiserver pod.
3.etcd
etcd用于存储整个集群的对象和状态.
kubeadm引导启动的集群默认只启动一个etcd节点和APIServer,etcd也是由kubelet启动的static pod.
如果要修改etcd的启动参数,直接修改etcd.yaml.保存之后kubelet会重启etcd的静态pod.
apiserver与etcd之间采用基于TLS的安全通信.
etcd挂载master节点本地路径/var/lib/etcd用于运行时的数据存储.
root@VM-16-6-ubuntu:~# tree /var/lib/etcd /var/lib/etcd └── member ├── snap │ ├── 0000000000000002-0000000000033465.snap │ ├── 0000000000000002-0000000000035b76.snap │ ├── 0000000000000002-0000000000038287.snap │ ├── 0000000000000002-000000000003a998.snap │ ├── 0000000000000002-000000000003d0a9.snap │ └── db └── wal ├── 0000000000000000-0000000000000000.wal ├── 0000000000000001-000000000000deb3.wal ├── 0000000000000002-000000000001b87f.wal ├── 0000000000000003-0000000000029249.wal ├── 0000000000000004-0000000000036c13.wal └── 0.tmp
如果需要做数据迁移和备份,只需要对这个目录进行操作就可以了.
4.controller-manager
负责集群内Node,Pod副本,服务的endpoint,命名空间,Service Account,资源配额管理等.
controller通过APIServer监控资源的状态,一旦状态发生变化,controller就会改变这个状态,使其恢复正常.
和APIServer一样,controller-manager由kubelet启动的static pod.
如果要修改controller-manager的启动参数,直接修改kube-controller-manager.yaml文件.
下面是controller-manager的启动参数配置:
apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager namespace: kube-system spec: containers: - command: - kube-controller-manager - --leader-elect=true #执行主业务逻辑前是否进行leader选举. - --controllers=*,bootstrapsigner,tokencleaner - --kubeconfig=/etc/kubernetes/controller-manager.conf - --service-account-private-key-file=/etc/kubernetes/pki/sa.key - --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt #证书文件 - --cluster-signing-key-file=/etc/kubernetes/pki/ca.key #签发集群范围内的其它证书 - --address=127.0.0.1 - --root-ca-file=/etc/kubernetes/pki/ca.crt #ca.crt会包含在service acount的对象参数中. - --use-service-account-credentials=true image: k8s.gcr.io/kube-controller-manager-amd64:v1.10.2 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 10252 scheme: HTTP initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager resources: requests: cpu: 200m volumeMounts: - mountPath: /etc/kubernetes/pki name: k8s-certs readOnly: true - mountPath: /etc/ssl/certs name: ca-certs readOnly: true - mountPath: /etc/kubernetes/controller-manager.conf name: kubeconfig readOnly: true hostNetwork: true volumes: - hostPath: path: /etc/kubernetes/pki type: DirectoryOrCreate name: k8s-certs - hostPath: path: /etc/ssl/certs type: DirectoryOrCreate name: ca-certs - hostPath: path: /etc/kubernetes/controller-manager.conf type: FileOrCreate name: kubeconfig status: {}
5.kube-scheduler
按照特定的调度算法和策略,将待调度pod绑定集群中某个适合的Node,并写入绑定信息.
由kubelet启动的static pod.
scheduler的配置参数:
apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: containers: - command: - kube-scheduler - --address=127.0.0.1 #服务地址,不对外提供服务 - --leader-elect=true #在主业务逻辑循环前,是否进行选主 - --kubeconfig=/etc/kubernetes/scheduler.conf #启动文件 image: k8s.gcr.io/kube-scheduler-amd64:v1.10.2 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 10251 scheme: HTTP initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-scheduler resources: requests: cpu: 100m volumeMounts: - mountPath: /etc/kubernetes/scheduler.conf name: kubeconfig readOnly: true hostNetwork: true volumes: - hostPath: path: /etc/kubernetes/scheduler.conf type: FileOrCreate name: kubeconfig status: {}
6.kube-proxy
service在创建的时候会分配一个虚拟的服务IP,对service访问会按照一定策略分发到后面的pod.
service并没有实体,让service起作用的是运行在kubernetes集群节点上的kube-proxy组件.
由于proxy的存在,在client调用的service时,调用者无需关心后端pod的数量,负载均衡和故障恢复.
kube-proxy由daemonset控制器在各个节点上启动唯一实例.
kube-proxy不是静态pod,它的配置放在kube-proxy配置里面.
我们可以查看kube-proxy的配置:
root@VM-16-6-ubuntu:~# kubectl exec kube-proxy-gnrc7 -n kube-system -- cat /var/lib/kube-proxy/config.conf apiVersion: kubeproxy.config.k8s.io/v1alpha1 bindAddress: 0.0.0.0 clientConnection: acceptContentTypes: "" burst: 10 contentType: application/vnd.kubernetes.protobuf kubeconfig: /var/lib/kube-proxy/kubeconfig.conf qps: 5 clusterCIDR: "" configSyncPeriod: 15m0s conntrack: max: null maxPerCore: 32768 min: 131072 tcpCloseWaitTimeout: 1h0m0s tcpEstablishedTimeout: 24h0m0s enableProfiling: false healthzBindAddress: 0.0.0.0:10256 hostnameOverride: "" iptables: masqueradeAll: false masqueradeBit: 14 minSyncPeriod: 0s syncPeriod: 30s ipvs: minSyncPeriod: 0s scheduler: "" syncPeriod: 30s kind: KubeProxyConfiguration metricsBindAddress: 127.0.0.1:10249 mode: "" nodePortAddresses: null oomScoreAdj: -999 portRange: "" resourceContainer: /kube-proxy
最重要的配置就是mode,kube-proxy支持三种mode.分别是:user-spece,iptables,ipvs.
如果配置文件的pod为空,那么将选择当前最好的mode(iptables),如果内核不支持将改为user-spece模式.
