二进制安装K8s 之 部署kube-controller-manager

1、创建配置文件

cat > /data/k8s/config/kube-controller-manager.conf << EOF
KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=false \\
--v=2 \\
--log-dir=/data/k8s/logs \\
--leader-elect=true \\
--kubeconfig=/data/k8s/config/kube-controller-manager.kubeconfig \\
--bind-address=127.0.0.1 \\
--allocate-node-cidrs=true \\
--cluster-cidr=10.244.0.0/16 \\
--service-cluster-ip-range=10.0.0.0/24 \\
--cluster-signing-cert-file=/data/k8s/ssl/ca.pem \\
--cluster-signing-key-file=/data/k8s/ssl/ca-key.pem  \\
--root-ca-file=/data/k8s/ssl/ca.pem \\
--service-account-private-key-file=/data/k8s/ssl/ca-key.pem \\
--experimental-cluster-signing-duration=87600h0m0s"
EOF

• –master：通过本地非安全本地端口8080连接apiserver。
• –leader-elect：当该组件启动多个时，自动选举（HA）
• –cluster-signing-cert-file/–cluster-signing-key-file：自动为kubelet颁发证书的CA，与apiserver保持一致

2、生成kube-controller-manage 证书：

cat >/data/docker/TSL/k8s/kube-controller-manager-csr.json <<EOF
{
    "CN": "system:kube-controller-manager",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "system:masters",
            "OU": "System"
        }
    ]
}
EOF

• 生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

#拷贝生成的.pem证书到k8s证书目录
cp kube-controller-manager*.pem /data/k8s/ssl/

3、生成kubeconfig文件：

# 在 shell 命令行直接执

KUBE_CONFIG="/data/k8s/config/kube-controller-manager.kubeconfig"
KUBE_APISERVER="https://192.168.100.170:6443"

kubectl config set-cluster kubernetes \
--certificate-authority=/data/k8s/ssl/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=${KUBE_CONFIG} 

kubectl config set-credentials kube-controller-manager \
--client-certificate=/data/k8s/ssl/kube-controller-manager.pem \
--client-key=/data/k8s/ssl/kube-controller-manager-key.pem \
--embed-certs=true \
--kubeconfig=${KUBE_CONFIG} 


kubectl config set-context default \
--cluster=kubernetes \
--user=kube-controller-manager \
--kubeconfig=${KUBE_CONFIG} 


kubectl config use-context default --kubeconfig=${KUBE_CONFIG}

#生成的 kube-controller-manager.kubeconfig 文件
#查看，文件里会有密钥，这里忽略，server: 地址就是k8s master 地址
cat /data/k8s/config/kube-controller-manager.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: =
    server: https://192.168.100.170:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kube-controller-manager
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: kube-controller-manager
  user:
    client-certificate-data:   
    client-key-data: 

4、systemd管理controller-manager

cat > /usr/lib/systemd/system/kube-controller-manager.service << EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes
[Service]
EnvironmentFile=/data/k8s/config/kube-controller-manager.conf
ExecStart=/data/k8s/bin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF

4、启动并设置开机启动

systemctl daemon-reload
systemctl start kube-controller-manager
systemctl enable kube-controller-manager