部署 node proxy

5.4 部署kube-proxy

1. 创建配置文件

cat > /opt/kubernetes/cfg/kube-proxy.conf << EOF 
KUBE_PROXY_OPTS="--logtostderr=false \\ 
--v=2 \\ 
--log-dir=/opt/kubernetes/logs \\ 
--config=/opt/kubernetes/cfg/kube-proxy-config.yml" 
EOF 

2. 配置参数文件 

cat > /opt/kubernetes/cfg/kube-proxy-config.yml << EOF 
kind: KubeProxyConfiguration 
apiVersion: kubeproxy.config.k8s.io/v1alpha1 
bindAddress: 0.0.0.0 
metricsBindAddress: 0.0.0.0:10249 
clientConnection: 
  kubeconfig: /opt/kubernetes/cfg/kube-proxy.kubeconfig 
hostnameOverride: k8s-master1 
clusterCIDR: 10.244.0.0/16 
EOF 

3. 生成kube-proxy.kubeconfig文件 

# 切换工作目录 
cd ~/TLS/k8s 
 
# 创建证书请求文件 
cat > kube-proxy-csr.json << EOF 
{ 
  "CN": "system:kube-proxy", 
  "hosts": [], 
  "key": { 
    "algo": "rsa", 
    "size": 2048 
  }, 
  "names": [ 
    { 
      "C": "CN", 
      "L": "BeiJing", 
      "ST": "BeiJing", 
      "O": "k8s", 
      "OU": "System" 
    } 
  ] 
} 
EOF 
 
# 生成证书 
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy 

生成kubeconfig文件： 

KUBE_CONFIG="/opt/kubernetes/cfg/kube-proxy.kubeconfig" 
KUBE_APISERVER="https://192.168.0.152:6443" 
 

kubectl config set-cluster kubernetes \ 
 --certificate-authority=/opt/kubernetes/ssl/ca.pem \ 
 --embed-certs=true \ 
 --server=${KUBE_APISERVER} \ 
 --kubeconfig=${KUBE_CONFIG} 
kubectl config set-credentials kube-proxy \ 
 --client-certificate=./kube-proxy.pem \ 
 --client-key=./kube-proxy-key.pem \ 
 --embed-certs=true \ 
 --kubeconfig=${KUBE_CONFIG} 
kubectl config set-context default \ 
 --cluster=kubernetes \ 
 --user=kube-proxy \ 
 --kubeconfig=${KUBE_CONFIG} 
kubectl config use-context default --kubeconfig=${KUBE_CONFIG} 

4. systemd管理kube-proxy

cat > /usr/lib/systemd/system/kube-proxy.service << EOF 
[Unit] 
Description=Kubernetes Proxy 
After=network.target 
 
[Service] 
EnvironmentFile=/opt/kubernetes/cfg/kube-proxy.conf 
ExecStart=/opt/kubernetes/bin/kube-proxy \$KUBE_PROXY_OPTS 
Restart=on-failure 
LimitNOFILE=65536 
 
[Install] 
WantedBy=multi-user.target 
EOF 

5. 启动并设置开机启动

systemctl daemon-reload systemctl start kube-proxy systemctl enable kube-proxy