随缘更新

二进制安装k8s集群-部署kube-proxy(十)

37次阅读
没有评论

共计 6111 个字符，预计需要花费 16 分钟才能阅读完成。

Kube-proxy 是一个简单的网络代理和负载均衡器，它的作用主要是负责 Service 的实现，具体来说，就是实现了内部从 Pod 到 Service 和外部的从 NodePort 向 Service 的访问，每台机器上都运行一个 kube-proxy 服务，它监听 API server 中 service 和 endpoint 的变化情况，并通过 iptables 等来为服务配置负载均衡（仅支持 TCP 和 UDP）。

kube-proxy 可以直接运行在物理机上，也可以以 static pod 或者 daemonset 的方式运行。

主机名 角色 ip
hdss7-21.host.com kube-proxy 10.4.7.21
hdss7-22.host.com kube-proxy 10.4.7.21

# 签发并拷贝证书
[root@hdss7-200 certs]# vim kube-proxy-csr.json
{
    "CN": "system:kube-proxy",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "beijing",
            "L": "beijing",
            "O": "od",
            "OU": "ops"
        }
    ]
}

[root@hdss7-200 certs]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client kube-proxy-csr.json |cfssl-json -bare kube-proxy-client


cd /usr/local/kubernetes/server/bin/cert
scp hdss7-200:/opt/certs/kube-proxy-client.pem .
scp hdss7-200:/opt/certs/kube-proxy-client-key.pem .
cd /usr/local/kubernetes/server/bin/conf
###set-cluster
[root@hdss7-21 conf]# kubectl config set-cluster myk8s \
--certificate-authority=/usr/local/kubernetes/server/bin/cert/ca.pem \
--embed-certs=true \
--server=https://10.4.7.10:7443 \
--kubeconfig=kube-proxy.kubeconfig


###set-credentials
kubectl config set-credentials kube-proxy \
--client-certificate=/usr/local/kubernetes/server/bin/cert/kube-proxy-client.pem \
--client-key=/usr/local/kubernetes/server/bin/cert/kube-proxy-client-key.pem \
--embed-certs=true \
--kubeconfig=kube-proxy.kubeconfig

###set-context
kubectl config set-context myk8s-context \
--cluster=myk8s \
--user=kube-proxy \
--kubeconfig=kube-proxy.kubeconfig

###use-context
kubectl config use-context myk8s-context --kubeconfig=kube-proxy.kubeconfig


[root@hdss7-22 conf]# scp hdss7-21:/usr/local/kubernetes/server/bin/conf/kube-proxy.kubeconfig .

开启 ipvs

yum install ipvsadm -y
ipvsadm -Ln

[root@hdss7-21 bin]# lsmod |grep ip_vs
[root@hdss7-21 bin]# vim /data/script/ipvs.sh
#!/bin/bash
ipvs_mods_dir="/usr/lib/modules/$(uname -r)/kernel/net/netfilter/ipvs"
for i in $(ls $ipvs_mods_dir|grep -o "^[^.]*")
do
  /sbin/modinfo -F filename $i &>/dev/null
  if [$? -eq 0];then
    /sbin/modprobe $i
  fi
done    

[root@hdss7-21 bin]# chmod +x /data/script/ipvs.sh
[root@hdss7-21 bin]# sh /data/script/ipvs.sh

[root@hdss7-21 bin]# lsmod |grep ip_vs
ip_vs_wrr              12697  0
ip_vs_wlc              12519  0
ip_vs_sh               12688  0
ip_vs_sed              12519  0

配置启动脚本 

[root@hdss7-21 bin]# vim /usr/local/kubernetes/server/bin/kube-proxy.sh
#!/bin/sh
./kube-proxy \
  --cluster-cidr 172.7.0.0/16 \
  --hostname-override hdss7-21.host.com \
  --proxy-mode=ipvs \
  --ipvs-scheduler=nq \
  --kubeconfig ./conf/kube-proxy.kubeconfig


[root@hdss7-22 bin]# chmod +x /usr/local/kubernetes/server/bin/kube-proxy.sh
[root@hdss7-22 bin]# mkdir -p /data/logs/kubernetes/kube-proxy


[root@hdss7-21 bin]# vim /etc/supervisord.d/kube-proxy.ini
[program:kube-proxy-7-21]
command=/usr/local/kubernetes/server/bin/kube-proxy.sh               ; the program (relative uses PATH, can take args)
numprocs=1                                                           ; number of processes copies to start (def 1)
directory=/usr/local/kubernetes/server/bin                           ; directory to cwd to before exec (def no cwd)
autostart=true                                                       ; start at supervisord start (default: true)
autorestart=true                                                     ; retstart at unexpected quit (default: true)
startsecs=30                                                         ; number of secs prog must stay running (def. 1)
startretries=3                                                       ; max # of serial start failures (default 3)
exitcodes=0,2                                                        ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT                                                      ; signal used to kill process (default TERM)
stopwaitsecs=10                                                      ; max num secs to wait b4 SIGKILL (default 10)
user=root                                                            ; setuid to this UNIX account to run the program
redirect_stderr=true                                                 ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/kubernetes/kube-proxy/proxy.stdout.log     ; stderr log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB                                         ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4                                             ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB                                          ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false                                          ; emit events on stdout writes (default false)

supervisorctl update
supervisorctl status


[root@hdss7-22 bin]# vim /usr/local/kubernetes/server/bin/kube-proxy.sh
#!/bin/sh
./kube-proxy \
  --cluster-cidr 172.7.0.0/16 \
  --hostname-override hdss7-22.host.com \
  --proxy-mode=ipvs \
  --ipvs-scheduler=nq \
  --kubeconfig ./conf/kube-proxy.kubeconfig


[root@hdss7-22 bin]# vim /etc/supervisord.d/kube-proxy.ini
[program:kube-proxy-7-22]
command=/usr/local/kubernetes/server/bin/kube-proxy.sh               ; the program (relative uses PATH, can take args)
numprocs=1                                                           ; number of processes copies to start (def 1)
directory=/usr/local/kubernetes/server/bin                           ; directory to cwd to before exec (def no cwd)
autostart=true                                                       ; start at supervisord start (default: true)
autorestart=true                                                     ; retstart at unexpected quit (default: true)
startsecs=30                                                         ; number of secs prog must stay running (def. 1)
startretries=3                                                       ; max # of serial start failures (default 3)
exitcodes=0,2                                                        ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT                                                      ; signal used to kill process (default TERM)
stopwaitsecs=10                                                      ; max num secs to wait b4 SIGKILL (default 10)
user=root                                                            ; setuid to this UNIX account to run the program
redirect_stderr=true                                                 ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/kubernetes/kube-proxy/proxy.stdout.log     ; stderr log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB                                         ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4                                             ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB                                          ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false                                          ; emit events on stdout writes (default false)


supervisorctl update
supervisorctl status

[root@hdss7-22 bin]# chmod +x /usr/local/kubernetes/server/bin/kube-proxy.sh
[root@hdss7-22 bin]# mkdir -p /data/logs/kubernetes/kube-proxy

检查集群是否配置好 

[root@hdss7-21 bin]# kubectl get cs
NAME                 STATUS    MESSAGE              ERROR
controller-manager   Healthy   ok                  
scheduler            Healthy   ok                  
etcd-1               Healthy   {"health": "true"}  
etcd-2               Healthy   {"health": "true"}  
etcd-0               Healthy   {"health": "true"}


[root@hdss7-21 bin]# kubectl get node
NAME                STATUS   ROLES         AGE   VERSION
hdss7-21.host.com   Ready    master,node   9h    v1.15.2
hdss7-22.host.com   Ready    master,node   10h   v1.15.2

配置 nginx 的 yaml

[root@hdss7-21 ~]# vim /data/script/nginx-ds.yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: nginx-ds
spec:
  template:
    metadata:
      labels:
        app: nginx-ds
    spec:
      containers:
      - name: my-nginx
        image: harbor.od.com/public/nginx:v1.7.9
        ports:
        - containerPort: 80

kubectl apply -f nginx-ds.yaml

[root@hdss7-21 ~]# kubectl get pod -A -o wide
NAMESPACE   NAME             READY   STATUS    RESTARTS   AGE   IP           NODE                NOMINATED NODE   READINESS GATES
default     nginx-ds-2tb4c   1/1     Running   1          18h   172.7.22.2   hdss7-22.host.com   <none>           <none>
default     nginx-ds-2w2nx   1/1     Running   1          18h   172.7.21.2   hdss7-21.host.com   <none>           <none>


curl 172.7.21.2 

22 不能通是因为还没有安装网络组件，所有不能跨节点通信。

kube-proxy 安装完成

正文完
o
发表至： 运维
2022-05-06
 0
yx
版权声明：本站原创文章，由 yx 于2022-05-06发表，共计6111字。
转载说明：除特殊说明外本站文章皆由CC-4.0协议发布，转载请注明出处。
docker部署java应用
jenkins结合helm及harbor部署java应用
jenkins pipeline使用SonarQube代码质量检测
ubuntu20安装最新版本nodejs并打包第三方开源chatgpt项目
评论（没有评论）
验证码
文章搜索
一言一句话
-「」
随机文章
jumpserver2无法链接ubuntu24解决办法

jumpserver2无法链接ubuntu24解决办法

问题背景 使用了老版本的 jumpserver2 然后添加资产 ubunut24 普通账号密码推送都是成功的，...
prometheus使用blackbox_exporter监控网站状态并实现报警

prometheus使用blackbox_exporter监控网站状态并实现报警

背景需求：公司网站因状态码异常或 SSL 证书过期等问题，导致需要人工介入处理， 效率低且对客户影响较大。因此...
es修改默认分片数为1000的限制

es修改默认分片数为1000的限制

问题背景：新搭建了一个 es, 但是发现写入到一定索引后发现不会在写入，由于代码没有异常返回，进行了断点打印日...
redis批量删除大量key脚本

redis批量删除大量key脚本

redis 批量删除大量 key 脚本 因为 redis 没有设置过期时间导致 redis 内存满了，key ...
prometheus监控自建redis并实现报警

prometheus监控自建redis并实现报警

prometheus 监控自建 redis 并实现报警 周末因为一台 redis 代码链接 redis oom...
标签云
09:47:3310:46:2310:46:2411.0.159.6.0addraffinityalbertalpineansibleapachedsAPPaptapt-getashawkbalancebcomparebinblackbox_exporterbytesbytesmaxcertcleanupcleanwscodecolcolumncompareconfigcorednscreatedcurldatadatedate_timedbeaverdebdebiandebin