-
Notifications
You must be signed in to change notification settings - Fork 1
/
deploykubelet2.sh
executable file
·200 lines (180 loc) · 5.88 KB
/
deploykubelet2.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
source env.sh
# 创建kubelet证书签名请求
echo "=========创建kubelet证书签名请求========"
cat > ${KUBELET_PATH}/kubelet-csr.json <<EOF
{
"CN": "kubelet",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "Shanghai",
"L": "Shanghai",
"O": "system:masters",
"OU": "kubelet"
}
]
}
EOF
cat ${KUBELET_PATH}/kubelet-csr.json
# 创建kubelet证书和私钥
echo "=======创建kubelet证书和私钥======="
cfssl gencert \
-ca=/etc/kubernetes/cert/ca.pem \
-ca-key=/etc/kubernetes/cert/ca-key.pem \
-config=/etc/kubernetes/cert/ca-config.json \
-profile=kubernetes \
${KUBELET_PATH}/kubelet-csr.json | \
cfssljson -bare ${KUBELET_PATH}/kubelet
if [ $? -ne 0 ];then echo "生成kubelet证书和私钥失败,退出脚本";exit 1;fi
ls ${KUBELET_PATH}/kubelet*.pem
# 创建kubelet kubeconfig文件
echo "=========创建kubelet kubeconfig文件========="
# 配置要访问的集群cluster1(ip和证书)
kubectl config set-cluster cluster1 \
--certificate-authority=/etc/kubernetes/cert/ca.pem \
--server=${KUBE_APISERVER} \
--kubeconfig=${KUBELET_PATH}/kubelet.kubeconfig
# 配置kubelet1用户(证书和私钥)
kubectl config set-credentials kubelet1 \
--client-certificate=/etc/kubernetes/cert/kubelet.pem \
--client-key=/etc/kubernetes/cert/kubelet-key.pem \
--kubeconfig=${KUBELET_PATH}/kubelet.kubeconfig
# 配置context1
kubectl config set-context context1 \
--cluster=cluster1 \
--user=kubelet1 \
--kubeconfig=${KUBELET_PATH}/kubelet.kubeconfig
# 设置context1为当前的context
kubectl config use-context context1 \
--kubeconfig=${KUBELET_PATH}/kubelet.kubeconfig
cat ${KUBELET_PATH}/kubelet.kubeconfig
# 创建kubelet参数配置模板文件
echo "========创建kubelet参数配置模板文件======="
cat > ${KUBELET_PATH}/kubelet.config.json.template <<EOF
{
"kind": "KubeletConfiguration",
"apiVersion": "kubelet.config.k8s.io/v1beta1",
"authentication": {
"x509": {
"clientCAFile": "/etc/kubernetes/cert/ca.pem"
},
"webhook": {
"enabled": true,
"cacheTTL": "2m0s"
},
"anonymous": {
"enabled": false
}
},
"authorization": {
"mode": "Webhook",
"webhook": {
"cacheAuthorizedTTL": "5m0s",
"cacheUnauthorizedTTL": "30s"
}
},
"address": "##NODE_IP##",
"port": 10250,
"readOnlyPort": 0,
"cgroupDriver": "cgroupfs",
"hairpinMode": "promiscuous-bridge",
"serializeImagePulls": false,
"featureGates": {
"RotateKubeletClientCertificate": true,
"RotateKubeletServerCertificate": true
},
"clusterDomain": "${CLUSTER_DNS_DOMAIN}",
"clusterDNS": ["${CLUSTER_DNS_SVC_IP}"]
}
EOF
ls ${KUBELET_PATH}/kubelet.config.json.template
# 创建kubelet参数配置文件
echo "========创建kubelet参数配置文件========="
for node_ip in ${NODE_IPS[@]}
do
echo ">>> ${node_ip}"
sed -e "s/##NODE_IP##/${node_ip}/" \
${KUBELET_PATH}/kubelet.config.json.template > \
${KUBELET_PATH}/kubelet.config-${node_ip}.json
cat ${KUBELET_PATH}/kubelet.config-${node_ip}.json
done
# 创建kubelet systemd service模板文件
echo "========创建kubelet systemd service模板文件======="
cat > ${KUBELET_PATH}/kubelet.service.template <<EOF
[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service
Requires=docker.service
[Service]
WorkingDirectory=/var/lib/kubelet
ExecStart=/usr/local/bin/kubelet \\
--cert-dir=/etc/kubernetes/cert \\
--kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\
--config=/etc/kubernetes/kubelet.config.json \\
--hostname-override=##NODE_NAME## \\
--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest \\
--allow-privileged=true \\
--alsologtostderr=true \\
--logtostderr=false \\
--log-dir=/var/log/kubernetes \\
--v=2
Restart=on-failure
RestartSec=60
[Install]
WantedBy=multi-user.target
EOF
ls ${KUBELET_PATH}/kubelet.service.template
# 创建kubelet systemd service文件
echo "=========创建kubelet systemd service文件========="
for ((i=0; i<3; i++))
do
echo ">>> ${NODE_IPS[i]}"
sed -e "s/##NODE_NAME##/${NODE_NAMES[i]}/" \
${KUBELET_PATH}/kubelet.service.template > \
${KUBELET_PATH}/kubelet-${NODE_IPS[i]}.service
cat ${KUBELET_PATH}/kubelet-${NODE_IPS[i]}.service
done
# 分发并启动kubelet
echo "=========分发并启动kubelet======="
for node_ip in ${NODE_IPS[@]}
do
echo ">>> ${node_ip}"
echo "分发kubelet二进制文件"
ssh root@${node_ip} "
if [ -f /usr/local/bin/kubelet ];then
systemctl stop kubelet
rm -f /usr/local/bin/kubelet
fi"
scp ${KUBELET_PATH}//kubelet root@${node_ip}:/usr/local/bin/
echo "分发kubelet证书和私钥"
ssh root@${node_ip} "mkdir -p /etc/kubernetes/cert"
scp ${KUBELET_PATH}/kubelet*.pem \
root@${node_ip}:/etc/kubernetes/cert/
echo "分发kubelet kubeconfig文件"
ssh root@${node_ip} "mkdir -p /etc/kubernetes"
scp ${KUBELET_PATH}/kubelet.kubeconfig \
root@${node_ip}:/etc/kubernetes/kubelet.kubeconfig
echo "分发kubelet参数配置文件"
scp ${KUBELET_PATH}/kubelet.config-${node_ip}.json \
root@${node_ip}:/etc/kubernetes/kubelet.config.json
echo "分发kubelet systemd service文件"
scp ${KUBELET_PATH}/kubelet-${node_ip}.service \
root@${node_ip}:/usr/lib/systemd/system/kubelet.service
echo "启动kubelet"
ssh root@${node_ip} "
mkdir -p /var/lib/kubelet
mkdir -p /var/log/kubernetes
systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet
echo 'wait 5s for kubelet up'
sleep 5
systemctl status kubelet | grep Active
netstat -lnpt | grep kubelet"
if [ $? -ne 0 ];then echo "启动kubelet失败,退出脚本";exit 1;fi
done