溫馨提示×
您好，登錄后才能下訂單哦！
點擊 登錄注冊 即表示同意《億速云用戶服務條款》
您好，登錄后才能下訂單哦！
kube-controller-manager屬于master節點組件，kube-controller-manager集群包含 3 個節點，啟動后將通過競爭選舉機制產生一個 leader 節點，其它節點為阻塞狀態。當 leader 節點不可用后，剩余節點將再次進行選舉產生新的 leader 節點，從而保證服務的高可用性。
特別說明：這里所有的操作都是在devops這臺機器上通過ansible工具執行；kube-controller-manager 在如下兩種情況下使用證書：
#################### Variable parameter setting ######################
KUBE_NAME=kube-controller-manager
K8S_INSTALL_PATH=/data/apps/k8s/kubernetes
K8S_BIN_PATH=${K8S_INSTALL_PATH}/sbin
K8S_LOG_DIR=${K8S_INSTALL_PATH}/logs
K8S_CONF_PATH=/etc/k8s/kubernetes
KUBE_CONFIG_PATH=/etc/k8s/kubeconfig
CA_DIR=/etc/k8s/ssl
SOFTWARE=/root/software
VERSION=v1.14.2
PACKAGE="kubernetes-server-${VERSION}-linux-amd64.tar.gz"
DOWNLOAD_URL=“”https://github.com/devops-apps/download/raw/master/kubernetes/${PACKAGE}"
ETH_INTERFACE=eth2
LISTEN_IP=$(ifconfig | grep -A 1 ${ETH_INTERFACE} |grep inet |awk '{print $2}')
USER=k8s
SERVICE_CIDR=10.254.0.0/22訪問kubernetes github 官方地址下載穩定的 realease 包至本機；
wget $DOWNLOAD_URL -P $SOFTWARE將kubernetes 軟件包分發到各個master節點服務器；
sudo ansible master_k8s_vgs -m copy -a "src=${SOFTWARE}/$PACKAGE dest=${SOFTWARE}/" -b### 1.Check if the install directory exists.
if [ ! -d "$K8S_BIN_PATH" ]; then
mkdir -p $K8S_BIN_PATH
fi
if [ ! -d "$K8S_LOG_DIR/$KUBE_NAME" ]; then
mkdir -p $K8S_LOG_DIR/$KUBE_NAME
fi
if [ ! -d "$K8S_CONF_PATH" ]; then
mkdir -p $K8S_CONF_PATH
fi
if [ ! -d "$KUBE_CONFIG_PATH" ]; then
mkdir -p $KUBE_CONFIG_PATH
fi
### 2.Install kube-apiserver binary of kubernetes.
if [ ! -f "$SOFTWARE/kubernetes-server-${VERSION}-linux-amd64.tar.gz" ]; then
wget $DOWNLOAD_URL -P $SOFTWARE >>/tmp/install.log 2>&1
fi
cd $SOFTWARE && tar -xzf kubernetes-server-${VERSION}-linux-amd64.tar.gz -C ./
cp -fp kubernetes/server/bin/$KUBE_NAME $K8S_BIN_PATH
ln -sf $K8S_BIN_PATH/$KUBE_NAM /usr/local/bin
chown -R $USER:$USER $K8S_INSTALL_PATH
chmod -R 755 $K8S_INSTALL_PATHcd ${CA_DIR}
sudo ansible master_k8s_vgs -m copy -a "src=ca.pem dest=${CA_DIR}/" -b
sudo ansible master_k8s_vgs -m copy -a "src=ca-key.pem dest=${CA_DIR}/" -b
sudo ansible master_k8s_vgs -m copy -a \
"src=kubecontroller-manager.pem dest=${CA_DIR}/" -b
sudo ansible master_k8s_vgs -m copy -a \
"src=kubecontroller-manager-key.pem dest=${CA_DIR}/" -bkube-controller-manager使用 kubeconfig文件連接訪問 apiserver服務，該文件提供了 apiserver 地址、嵌入的 CA 證書和 kube-scheduler證書：
cd $KUBE_CONFIG_PATH
sudo ansible master_k8s_vgs -m copy -a \
"src=kube-controller-manager.kubeconfig dest=$KUBE_CONFIG_PATH/" -b備注： 如果在前面小節已經同步過各組件kubeconfig和證書文件，此處可以不必執行此操作；
cat >/usr/lib/systemd/system/${KUBE_NAME}.service<<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
[Service]
User=${USER}
WorkingDirectory=${K8S_INSTALL_PATH}
ExecStart=${K8S_BIN_PATH}/${KUBE_NAME} \\
--port=10252 \\
--secure-port=10257 \\
--bind-address=${LISTEN_IP} \\
--address=127.0.0.1 \\
--kubeconfig=${KUBE_CONFIG_PATH}/${KUBE_NAME}.kubeconfig \\
--authentication-kubeconfig=${KUBE_CONFIG_PATH}/${KUBE_NAME}.kubeconfig \\
--authorization-kubeconfig=${KUBE_CONFIG_PATH}/${KUBE_NAME}.kubeconfig \\
--client-ca-file=${CA_DIR}/ca.pem \\
--service-cluster-ip-range=${SERVICE_CIDR} \\
--cluster-name=kubernetes \\
--cluster-signing-cert-file=${CA_DIR}/ca.pem \\
--cluster-signing-key-file=${CA_DIR}/ca-key.pem \\
--root-ca-file=${CA_DIR}/ca.pem \\
--service-account-private-key-file=${CA_DIR}/ca-key.pem \\
--leader-elect=true \\
--feature-gates=RotateKubeletServerCertificate=true \\
--horizontal-pod-autoscaler-use-rest-clients=true \\
--horizontal-pod-autoscaler-sync-period=10s \\
--concurrent-service-syncs=2 \\
--kube-api-qps=1000 \\
--kube-api-burst=2000 \\
--concurrent-gc-syncs=30 \\
--concurrent-deployment-syncs=10 \\
--terminated-pod-gc-threshold=10000 \\
--controllers=*,bootstrapsigner,tokencleaner \\
--requestheader-allowed-names="" \\
--requestheader-client-ca-file=${CA_DIR}/ca.pem \\
--requestheader-extra-headers-prefix="X-Remote-Extra-" \\
--requestheader-group-headers=X-Remote-Group \\
--requestheader-username-headers=X-Remote-User \\
--tls-cert-file=${CA_DIR}/kube-controller-manager.pem \\
--tls-private-key-file=${CA_DIR}/kube-controller-manager-key.pem \\
--use-service-account-credentials=true \\
--alsologtostderr=true \\
--logtostderr=false \\
--log-dir=${K8S_LOG_DIR}/${KUBE_NAME} \\
--flex-volume-plugin-dir=${K8S_INSTALL_PATH}/libexec/kubernetes \\
--v=2
Restart=on
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
EOFkube-controller-manager監聽10252和10257端口，兩個接口都對外提供 /metrics 和 /healthz 的訪問。
sudo netstat -ntlp | grep kube-con
tcp 0 0 127.0.0.1:10252 0.0.0.0:* LISTEN 2450/kube-controlle
tcp 0 0 10.10.10.22:10257 0.0.0.0:* LISTEN 2450/kube-controlle 注意：很多安裝文檔都是關閉了非安全端口，將安全端口改為10250，這會導致查看集群狀態是報如下錯誤，執行 kubectl get cs命令時，apiserver 默認向 127.0.0.1 發送請求。當controller-manager、scheduler以集群模式運行時，有可能和kube-apiserver不在一臺機器上，且訪問方式為https，則 controller-manager或scheduler 的狀態為 Unhealthy，但實際上它們工作正常。則會導致上述error，但實際集群是安全狀態；
kubectl get componentstatuses
NAME STATUS MESSAGE ERROR
controller-manager Unhealthy dial tcp 127.0.0.1:10252: connect: connection refused
scheduler Unhealthy dial tcp 127.0.0.1:10251: connect: connection refused
etcd-0 Healthy {"health":"true"}
etcd-2 Healthy {"health":"true"}
etcd-1 Healthy {"health":"true"}
正常輸出應該為：
NAME STATUS MESSAGE ERROR
scheduler Healthy ok
controller-manager Healthy ok
etcd-2 Healthy {"health":"true"}
etcd-1 Healthy {"health":"true"}
etcd-0 Healthy {"health":"true"} 查看服務是否運行
systemctl status kube-controller-manager|grep Active確保狀態為 active (running)，否則查看日志，確認原因：
sudo journalctl -u kube-controller-manager注意：以下命令在 kube-controller-manager 節點上執行。
https方式訪問
curl -s --cacert /opt/k8s/work/ca.pem \
--cert /opt/k8s/work/admin.pem \
--key /opt/k8s/work/admin-key.pem \
https://10.10.10.22:10257/metrics |head
http方式訪問
curl -s http://127.0.0.1:10252/metrics |headClusteRole system:kube-controller-manager 的權限很小，只能創建 secret、serviceaccount 等資源對象，各 controller 的權限分散到 ClusterRole system:controller:XXX 中：
$ kubectl describe clusterrole system:kube-controller-manager
Name: system:kube-controller-manager
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
secrets [] [] [create delete get update]
endpoints [] [] [create get update]
serviceaccounts [] [] [create get update]
events [] [] [create patch update]
tokenreviews.authentication.k8s.io [] [] [create]
subjectacce***eviews.authorization.k8s.io [] [] [create]
configmaps [] [] [get]
namespaces [] [] [get]
*.* [] [] [list watch]需要在kube-controller-manager的啟動參數中添加"--use-service-account-credentials=true"參數,這樣main controller將會為各controller創建對應的ServiceAccount XXX-controller。然后內置的 ClusterRoleBinding system:controller:XXX則將賦予各XXX-controller ServiceAccount對應的ClusterRole system:controller:XXX 權限。
$ kubectl get clusterrole|grep controller
system:controller:attachdetach-controller 17d
system:controller:certificate-controller 17d
system:controller:clusterrole-aggregation-controller 17d
system:controller:cronjob-controller 17d
system:controller:daemon-set-controller 17d
system:controller:deployment-controller 17d
system:controller:disruption-controller 17d
system:controller:endpoint-controller 17d
system:controller:expand-controller 17d
system:controller:generic-garbage-collector 17d
system:controller:horizontal-pod-autoscaler 17d
system:controller:job-controller 17d
system:controller:namespace-controller 17d
system:controller:node-controller 17d
system:controller:persistent-volume-binder 17d
system:controller:pod-garbage-collector 17d
system:controller:pv-protection-controller 17d
system:controller:pvc-protection-controller 17d
system:controller:replicaset-controller 17d
system:controller:replication-controller 17d
system:controller:resourcequota-controller 17d
system:controller:route-controller 17d
system:controller:service-account-controller 17d
system:controller:service-controller 17d
system:controller:statefulset-controller 17d
system:controller:ttl-controller 17d
system:kube-controller-manager 17d以 deployment controller 為例：
$ kubectl describe clusterrole system:controller:deployment-controller
Name: system:controller:deployment-controller
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
replicasets.apps [] [] [create delete get list patch update watch]
replicasets.extensions [] [] [create delete get list patch update watch]
events [] [] [create patch update]
pods [] [] [get list update watch]
deployments.apps [] [] [get list update watch]
deployments.extensions [] [] [get list update watch]
deployments.apps/finalizers [] [] [update]
deployments.apps/status [] [] [update]
deployments.extensions/finalizers[] [] [update]
deployments.extensions/status [] [] [update]kubectl get endpoints kube-controller-manager --namespace=kube-system -o yaml隨機找一個或兩個 master 節點，停掉kube-controller-manager服務，看其它節點是否獲取了 leader 權限.
關于 controller 權限和 use-service-account-credentials 參數：
https://github.com/kubernetes/kubernetes/issues/48208
kubelet 認證和授權：
https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization
安裝完成kube-controller-manager后，還需要安裝kube-scheduler，請參考：kubernetes集群安裝指南：kube-scheduler組件集群部署。關于kube-controller-manager腳本請此處獲取
免責聲明：本站發布的內容（圖片、視頻和文字）以原創、轉載和分享為主，文章觀點不代表本網站立場，如果涉及侵權請聯系站長郵箱：is@yisu.com進行舉報，并提供相關證據，一經查實，將立刻刪除涉嫌侵權內容。
