{"id":1572,"date":"2020-06-09T15:37:38","date_gmt":"2020-06-09T07:37:38","guid":{"rendered":"http:\/\/39.97.231.10\/?p=1572"},"modified":"2020-06-09T15:37:38","modified_gmt":"2020-06-09T07:37:38","slug":"kubernetes-master-node%e9%80%9a%e4%bf%a1","status":"publish","type":"post","link":"http:\/\/www.weijing.co\/?p=1572","title":{"rendered":"Kubernetes Master-Node\u901a\u4fe1"},"content":{"rendered":"<header class=\\\"entry-header\\\">\n<h1 class=\\\"entry-title\\\">Kubernetes Master-Node\u901a\u4fe1<\/h1>\n<\/header>\n<div class=\\\"entry-content\\\">\n<div id=\\\"toc_container\\\" class=\\\"no_bullets\\\">\n<ul class=\\\"toc_list\\\">\n<li><span class=\\\"toc_number toc_depth_1\\\">1<\/span>\u00a0\u6982\u8ff0<\/li>\n<li><span class=\\\"toc_number toc_depth_1\\\">2<\/span>\u00a0Cluster -&gt; Master<\/li>\n<li><span class=\\\"toc_number toc_depth_1\\\">3<\/span>\u00a0Master -&gt; Cluster\n<ul>\n<li><span class=\\\"toc_number toc_depth_2\\\">3.1<\/span>\u00a0apiserver &#8211; &gt; kubelet<\/li>\n<li><span class=\\\"toc_number toc_depth_2\\\">3.2<\/span>\u00a0apiserver -&gt; nodes\u3001pods\u3001services<\/li>\n<li><span class=\\\"toc_number toc_depth_2\\\">3.3<\/span>\u00a0SSH Tunnels<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<h2 id=\\\"overview\\\"><span id=\\\"i\\\">\u6982\u8ff0<\/span><\/h2>\n<p>\u672c\u6587\u4e3b\u8981\u4ecb\u7ecdmaster\u548cKubernetes\u96c6\u7fa4\u4e4b\u95f4\u901a\u4fe1\u8def\u5f84\u3002\u5176\u76ee\u7684\u662f\u5141\u8bb8\u7528\u6237\u81ea\u5b9a\u4e49\u5b89\u88c5\uff0c\u4ee5\u589e\u5f3a\u7f51\u7edc\u914d\u7f6e\uff0c\u4f7f\u96c6\u7fa4\u53ef\u4ee5\u5728\u4e0d\u53d7\u4fe1\u4efb\uff08untrusted\uff09\u7684\u7f51\u7edc\u4e0a\u8fd0\u884c\u3002<\/p>\n<h2 id=\\\"cluster---master\\\"><span id=\\\"Cluster_-gt_Master\\\">Cluster -&gt; Master<\/span><\/h2>\n<p>\u4ece\u96c6\u7fa4\u5230Master\u8282\u70b9\u7684\u6240\u6709\u901a\u4fe1\u8def\u5f84\u90fd\u5728apiserver\u4e2d\u7ec8\u6b62\u3002\u4e00\u4e2a\u5178\u578b\u7684deployment \uff0c\u5982\u679capiserver\u914d\u7f6e\u4e3a\u76d1\u542c\u8fd0\u7a0b\u8fde\u63a5\u4e0a\u7684HTTPS 443\u7aef\u53e3\uff0c\u5e94\u542f\u7528\u4e00\u79cd\u6216\u591a\u79cdclient\u00a0authentication\uff0c\u7279\u522b\u662f\u5982\u679c\u5141\u8bb8anonymous requests\u6216service account tokens\u00a0\u3002<br \/>\nNode\u8282\u70b9\u5e94\u8be5\u914d\u7f6e\u4e3a\u96c6\u7fa4\u7684\u516c\u5171\u6839\u8bc1\u4e66\uff0c\u4ee5\u4fbf\u5b89\u5168\u5730\u8fde\u63a5\u5230apiserver\u3002<br \/>\n\u5e0c\u671b\u8fde\u63a5\u5230apiserver\u7684Pod\u53ef\u4ee5\u901a\u8fc7service account\u6765\u5b9e\u73b0\uff0c\u4ee5\u4fbfKubernetes\u5728\u5b9e\u4f8b\u5316\u65f6\u81ea\u52a8\u5c06\u516c\u5171\u6839\u8bc1\u4e66\u548c\u6709\u6548\u7684bearer token\u63d2\u5165\u5230pod\u4e2d\uff0ckubernetes\u00a0service (\u5728\u6240\u6709namespaces\u4e2d)\u90fd\u914d\u7f6e\u4e86\u4e00\u4e2a\u865a\u62dfIP\u5730\u5740\uff0c\u8be5IP\u5730\u5740\u7531apiserver\u91cd\u5b9a\u5411(\u901a\u8fc7kube &#8211; proxy)\u5230HTTPS\u3002<br \/>\nMaster\u7ec4\u4ef6\u901a\u8fc7\u975e\u52a0\u5bc6(\u672a\u52a0\u5bc6\u6216\u8ba4\u8bc1)\u7aef\u53e3\u4e0e\u96c6\u7fa4apiserver\u901a\u4fe1\u3002\u8fd9\u4e2a\u7aef\u53e3\u901a\u5e38\u53ea\u5728Master\u4e3b\u673a\u7684localhost\u63a5\u53e3\u4e0a\u66b4\u9732\u3002<\/p>\n<h2 id=\\\"master---cluster\\\"><span id=\\\"Master_-gt_Cluster\\\">Master -&gt; Cluster<\/span><\/h2>\n<p>\u4eceMaster\u00a0(apiserver)\u5230\u96c6\u7fa4\u6709\u4e24\u4e2a\u4e3b\u8981\u7684\u901a\u4fe1\u8def\u5f84\u3002\u7b2c\u4e00\u4e2a\u662f\u4eceapiserver\u5230\u5728\u96c6\u7fa4\u4e2d\u7684\u6bcf\u4e2a\u8282\u70b9\u4e0a\u8fd0\u884c\u7684kubelet\u8fdb\u7a0b\u3002\u7b2c\u4e8c\u4e2a\u662f\u901a\u8fc7apiserver\u7684\u4ee3\u7406\u529f\u80fd\u4eceapiserver\u5230\u4efb\u4f55node\u3001pod\u6216service\u00a0\u3002<\/p>\n<h3 id=\\\"apiserver---kubelet\\\"><span id=\\\"apiserver_-_gt_kubelet\\\">apiserver &#8211; &gt; kubelet<\/span><\/h3>\n<p>\u4eceapiserver\u5230kubelet\u7684\u8fde\u63a5\u7528\u4e8e\u83b7\u53d6pod\u7684\u65e5\u5fd7\uff0c\u901a\u8fc7kubectl\u6765\u8fd0\u884cpod\uff0c\u5e76\u4f7f\u7528kubelet\u7684\u7aef\u53e3\u8f6c\u53d1\u529f\u80fd\u3002\u8fd9\u4e9b\u8fde\u63a5\u5728kubelet\u7684HTTPS\u7ec8\u7aef\u5904\u7ec8\u6b62\u3002<br \/>\n\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0capiserver\u4e0d\u4f1a\u9a8c\u8bc1kubelet\u7684\u670d\u52a1\u8bc1\u4e66\uff0c\u8fd9\u4f1a\u4f7f\u8fde\u63a5\u4e0d\u53d7\u5230\u4fdd\u62a4\u3002<\/p>\n<p class=\\\"tgt\\\">\u8981\u9a8c\u8bc1\u6b64\u8fde\u63a5\uff0c\u4f7f\u7528&#8211;kubelet-certificate-authority flag\u4e3aapiserver\u63d0\u4f9b\u6839\u8bc1\u4e66\u5305\uff0c\u4ee5\u9a8c\u8bc1kubelet\u7684\u670d\u52a1\u8bc1\u4e66\u3002<\/p>\n<p>\u5982\u679c\u4e0d\u80fd\u5b9e\u73b0\uff0c\u90a3\u4e48\u8bf7\u5728apiserver\u548ckubelet\u4e4b\u95f4\u4f7f\u7528\u00a0SSH tunneling\u3002<br \/>\n\u6700\u540e\uff0c\u5e94\u8be5\u542f\u7528Kubelet\u8ba4\u8bc1\u6216\u6388\u6743\u6765\u4fdd\u62a4Kubelet API\u3002<\/p>\n<h3 id=\\\"apiserver---nodes-pods-and-services\\\"><span id=\\\"apiserver_-gt_nodespodsservices\\\">apiserver -&gt; nodes\u3001pods\u3001services<\/span><\/h3>\n<p>\u4eceapiserver\u5230Node\u3001Pod\u6216Service\u7684\u8fde\u63a5\u9ed8\u8ba4\u4e3aHTTP\u8fde\u63a5\uff0c\u56e0\u6b64\u4e0d\u9700\u8fdb\u884c\u8ba4\u8bc1\u52a0\u5bc6\u3002\u4e5f\u53ef\u4ee5\u901a\u8fc7HTTPS\u7684\u5b89\u5168\u8fde\u63a5\uff0c\u4f46\u662f\u5b83\u4eec\u4e0d\u4f1a\u9a8c\u8bc1HTTPS \u7aef\u53e3\u63d0\u4f9b\u7684\u8bc1\u4e66\uff0c\u4e5f\u4e0d\u63d0\u4f9b\u5ba2\u6237\u7aef\u51ed\u636e\uff0c\u56e0\u6b64\u8fde\u63a5\u5c06\u88ab\u52a0\u5bc6\u4f46\u4e0d\u4f1a\u63d0\u4f9b\u4efb\u4f55\u8bda\u4fe1\u7684\u4fdd\u8bc1\u3002\u8fd9\u4e9b\u8fde\u63a5\u4e0d\u53ef\u4ee5\u5728\u4e0d\u53d7\u4fe1\u4efb\/\u6216\u516c\u5171\u7f51\u7edc\u4e0a\u8fd0\u884c\u3002<\/p>\n<h3 id=\\\"ssh-tunnels\\\"><span id=\\\"SSH_Tunnels\\\">SSH Tunnels<\/span><\/h3>\n<p><a href=\\\"https:\/\/cloud.google.com\/container-engine\/docs\/\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Google Container Engine<\/a>\u00a0\u4f7f\u7528SSH tunnels\u6765\u4fdd\u62a4 Master -&gt; \u96c6\u7fa4 \u901a\u4fe1\u8def\u5f84\uff0cSSH tunnel\u80fd\u591f\u4f7fNode\u3001Pod\u6216Service\u53d1\u9001\u7684\u6d41\u91cf\u4e0d\u4f1a\u66b4\u9732\u5728\u96c6\u7fa4\u5916\u90e8\u3002\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Kubernetes Master-Node\u901a\u4fe1 1\u00a0\u6982\u8ff0 2\u00a0Cluster -&gt; Master 3\u00a0 &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"http:\/\/www.weijing.co\/?p=1572\"> <span class=\"screen-reader-text\">Kubernetes Master-Node\u901a\u4fe1<\/span> \u67e5\u770b\u5168\u6587 &raquo;<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":""},"categories":[104,123],"tags":[],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false,"mailpoet_newsletter_max":false,"woocommerce_thumbnail":false,"woocommerce_single":false,"woocommerce_gallery_thumbnail":false,"shop_catalog":false,"shop_single":false,"shop_thumbnail":false},"uagb_author_info":{"display_name":"weijing","author_link":"http:\/\/www.weijing.co\/?author=4"},"uagb_comment_info":0,"uagb_excerpt":"Kubernetes Master-Node\u901a\u4fe1 1\u00a0\u6982\u8ff0 2\u00a0Cluster -&gt; Master 3\u00a0&hellip;","_links":{"self":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts\/1572"}],"collection":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1572"}],"version-history":[{"count":0,"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts\/1572\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1572"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}