{"id":1600,"date":"2020-06-10T09:41:26","date_gmt":"2020-06-10T01:41:26","guid":{"rendered":"http:\/\/39.97.231.10\/?p=1600"},"modified":"2020-06-10T09:41:26","modified_gmt":"2020-06-10T01:41:26","slug":"%e6%89%8b%e5%8a%a8%e5%ae%89%e8%a3%85kubernetes-1-8","status":"publish","type":"post","link":"http:\/\/www.weijing.co\/?p=1600","title":{"rendered":"\u624b\u52a8\u5b89\u88c5Kubernetes 1.8"},"content":{"rendered":"<header class=\\\"article-header\\\"><\/header>\n<article class=\\\"article-content\\\">\n<h2><strong>\u5b89\u88c5\u7248\u672c\uff1a<\/strong><\/h2>\n<ul>\n<li>Kubernetes v1.8.2<\/li>\n<li>Etcd v3.2.9<\/li>\n<li>Calico v2.6.2<\/li>\n<li>Docker v17.10.0-ce<\/li>\n<\/ul>\n<h2>\u5b89\u88c5\u73af\u5883\u4fe1\u606f<\/h2>\n<table width=\\\"650\\\">\n<thead>\n<tr>\n<td>IP Address<\/td>\n<td>Role<\/td>\n<td>CPU<\/td>\n<td>Memory<\/td>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>172.16.35.12<\/td>\n<td>master1<\/td>\n<td>1<\/td>\n<td>2G<\/td>\n<\/tr>\n<tr>\n<td>172.16.35.10<\/td>\n<td>node1<\/td>\n<td>1<\/td>\n<td>2G<\/td>\n<\/tr>\n<tr>\n<td>172.16.35.11<\/td>\n<td>node2<\/td>\n<td>1<\/td>\n<td>2G<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<ul>\n<li>master \u4e3a\u4e3b\u8981\u63a7\u5236\u8282\u70b9\u4e5f\u662f\u90e8\u7f72\u8282\u70b9\uff0cnode \u4e3a\u5e94\u7528\u7a0b\u5e8f\u5de5\u4f5c\u8282\u70b9\u3002<\/li>\n<li>\u6240\u6709\u64cd\u4f5c\u5168\u90e8\u7528root\u4f7f\u7528\u8005\u8fdb\u884c\u3002<\/li>\n<\/ul>\n<p>\u9996\u5148\u5b89\u88c5\u524d\u8981\u786e\u8ba4\u4ee5\u4e0b\u51e0\u9879\u90fd\u5df2\u5c06\u51c6\u5907\u5b8c\u6210\uff1a<\/p>\n<ul>\n<li>\u6240\u6709\u8282\u70b9\u5f7c\u6b64\u7f51\u7edc\u4e92\u901a\uff0c\u5e76\u4e14master1\u00a0SSH \u767b\u5165\u5176\u4ed6\u8282\u70b9\u4e3a passwdless\u3002<\/li>\n<li>\u6240\u6709\u9632\u706b\u5899\u4e0e SELinux \u5df2\u5173\u95ed\u3002\u5982 CentOS\uff1a<\/li>\n<\/ul>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ systemctl stop firewalld <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl disable firewalld\n$ setenforce <\/span><span class=\\\"lit\\\">0<\/span><span class=\\\"pln\\\">\n$ vim <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">selinux<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">config\nSELINUX<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">disabled<\/span><\/pre>\n<ul>\n<li>\u6240\u6709\u8282\u70b9\u9700\u8981\u8bbe\u5b9a\/etc\/host\u89e3\u6790\u5230\u6240\u6709\u4e3b\u673a\u3002<\/li>\n<\/ul>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pun\\\">...<\/span>\n<span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.10<\/span><span class=\\\"pln\\\"> node1\n<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.11<\/span><span class=\\\"pln\\\"> node2\n<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span><span class=\\\"pln\\\"> master1<\/span><\/pre>\n<ul>\n<li>\u6240\u6709\u8282\u70b9\u9700\u8981\u5b89\u88c5Docker\u6216rtk\u5f15\u64ce\u3002\u8fd9\u8fb9\u91c7\u7528Docker\u6765\u5f53\u4f5c\u5bb9\u5668\u5f15\u64ce\uff0c\u5b89\u88c5\u65b9\u5f0f\u5982\u4e0b\uff1a<\/li>\n<\/ul>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ curl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">fsSL <\/span><span class=\\\"str\\\">\\\"https:\/\/get.docker.com\/\\\"<\/span> <span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> sh<\/span><\/pre>\n<blockquote><p>\u4e0d\u7ba1\u662f\u5728\u00a0Ubuntu\u00a0\u6216\u00a0CentOS\u00a0\u90fd\u53ea\u9700\u8981\u6267\u884c\u8be5\u6307\u4ee4\u5c31\u4f1a\u81ea\u52a8\u5b89\u88c5\u6700\u65b0\u7248 Docker\u3002<br \/>\nCentOS \u5b89\u88c5\u5b8c\u6210\u540e\uff0c\u9700\u8981\u518d\u6267\u884c\u4ee5\u4e0b\u6307\u4ee4\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ systemctl enable docker <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl start docker<\/span><\/pre>\n<\/blockquote>\n<p>\u7f16\u8f91\/lib\/systemd\/system\/docker.service\uff0c\u5728ExecStart=..\u4e0a\u9762\u52a0\u5165\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"typ\\\">ExecStartPost<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\/sbin\/<\/span><span class=\\\"pln\\\">iptables <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">I FORWARD <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">s <\/span><span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">0<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">j ACCEPT<\/span><\/pre>\n<blockquote><p>\u5b8c\u6210\u540e\uff0c\u91cd\u65b0\u542f\u52a8 docker \u670d\u52a1\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ systemctl daemon<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">reload <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl restart docker<\/span><\/pre>\n<\/blockquote>\n<ul>\n<li>\u6240\u6709\u8282\u70b9\u9700\u8981\u8bbe\u5b9a\/etc\/sysctl.d\/k8s.conf\u7684\u7cfb\u7edf\u53c2\u6570\u3002<\/li>\n<\/ul>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ cat <\/span><span class=\\\"pun\\\">&lt;&lt;<\/span><span class=\\\"pln\\\">EOF <\/span><span class=\\\"pun\\\">&gt;<\/span> <span class=\\\"str\\\">\/etc\/<\/span><span class=\\\"pln\\\">sysctl<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">k8s<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\nnet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">ipv4<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">ip_forward <\/span><span class=\\\"pun\\\">=<\/span> <span class=\\\"lit\\\">1<\/span><span class=\\\"pln\\\">\nnet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">bridge<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">bridge<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">nf<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">call<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ip6tables <\/span><span class=\\\"pun\\\">=<\/span> <span class=\\\"lit\\\">1<\/span><span class=\\\"pln\\\">\nnet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">bridge<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">bridge<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">nf<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">call<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">iptables <\/span><span class=\\\"pun\\\">=<\/span> <span class=\\\"lit\\\">1<\/span><span class=\\\"pln\\\">\nEOF\n$ sysctl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">sysctl<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">k8s<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<ul>\n<li>\u5728master1\u9700\u8981\u5b89\u88c5CFSSL\u5de5\u5177\uff0c\u8fd9\u5c06\u4f1a\u7528\u6765\u5efa\u7acb TLS certificates\u3002<\/li>\n<\/ul>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CFSSL_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/pkg.cfssl.org\/R1.2\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${CFSSL_URL}\/cfssl_linux-amd64\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cfssl\n$ wget <\/span><span class=\\\"str\\\">\\\"${CFSSL_URL}\/cfssljson_linux-amd64\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cfssljson\n$ chmod <\/span><span class=\\\"pun\\\">+<\/span><span class=\\\"pln\\\">x <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cfssl <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cfssljson<\/span><\/pre>\n<h2>Etcd<\/h2>\n<p>\u5728\u5f00\u59cb\u5b89\u88c5 Kubernetes \u4e4b\u524d\uff0c\u9700\u8981\u5148\u5c06\u4e00\u4e9b\u5fc5\u8981\u7cfb\u7edf\u521b\u5efa\u5b8c\u6210\uff0c\u5176\u4e2d Etcd \u5c31\u662f Kubernetes \u6700\u91cd\u8981\u7684\u4e00\u73af\uff0cKubernetes \u4f1a\u5c06\u5927\u90e8\u5206\u4fe1\u606f\u50a8\u5b58\u4e8e Etcd \u4e0a\uff0c\u6765\u63d0\u4f9b\u7ed9\u5176\u4ed6\u8282\u70b9\u7d22\u53d6\uff0c\u4ee5\u786e\u4fdd\u6574\u4e2a\u96c6\u7fa4\u8fd0\u4f5c\u4e0e\u6c9f\u901a\u6b63\u5e38\u3002<\/p>\n<h3>\u521b\u5efa\u96c6\u7fa4 CA \u4e0e Certificates<\/h3>\n<p>\u5728\u8fd9\u90e8\u5206\uff0c\u5c06\u4f1a\u9700\u8981\u4ea7\u751f client \u4e0e server \u7684\u5404\u7ec4\u4ef6 certificates\uff0c\u5e76\u4e14\u66ff Kubernetes admin user \u4ea7\u751f client \u8bc1\u4e66\u3002<br \/>\n\u5efa\u7acb\/etc\/etcd\/ssl\u6587\u4ef6\u5939\uff0c\u7136\u540e\u8fdb\u5165\u76ee\u5f55\u5b8c\u6210\u4ee5\u4e0b\u64cd\u4f5c\u3002<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> PKI_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/pki\\\"<\/span><\/pre>\n<p>\u4e0b\u8f7dca-config.json\u4e0eetcd-ca-csr.json\u6587\u4ef6\uff0c\u5e76\u4ea7\u751f CA \u5bc6\u94a5\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/ca-config.json\\\"<\/span> <span class=\\\"str\\\">\\\"${PKI_URL}\/etcd-ca-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">initca etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca\n$ ls etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\netcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<p>\u4e0b\u8f7detcd-csr.json\u6587\u4ef6\uff0c\u5e76\u4ea7\u751f kube-apiserver certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/etcd-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare etcd\n$ ls etcd<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\netcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pe<\/span><\/pre>\n<blockquote><p>\u82e5\u8282\u70b9 IP \u4e0d\u540c\uff0c\u9700\u8981\u4fee\u6539etcd-csr.json\u7684hosts\u3002<\/p><\/blockquote>\n<p>\u5b8c\u6210\u540e\u5220\u9664\u4e0d\u5fc5\u8981\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ rm <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">rf <\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">json<\/span><\/pre>\n<p>\u786e\u8ba4\/etc\/etcd\/ssl\u6709\u4ee5\u4e0b\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ ls <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl\netcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csr  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csr  etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<h3>Etcd \u5b89\u88c5\u4e0e\u8bbe\u5b9a<\/h3>\n<p>\u9996\u5148\u5728master1\u8282\u70b9\u4e0b\u8f7d Etcd\uff0c\u5e76\u89e3\u538b\u7f29\u653e\u5230 \/opt \u5e95\u4e0b\u4e0e\u5b89\u88c5\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> ETCD_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/github.com\/coreos\/etcd\/releases\/download\\\"<\/span><span class=\\\"pln\\\">\n$ cd <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> wget <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">qO<\/span><span class=\\\"pun\\\">-<\/span> <span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">show<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">progress <\/span><span class=\\\"str\\\">\\\"${ETCD_URL}\/v3.2.9\/etcd-v3.2.9-linux-amd64.tar.gz\\\"<\/span> <span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> tar <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">zx\n$ mv etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">v3<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">2.9<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">linux<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">amd64<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">*<\/span> <span class=\\\"str\\\">\/usr\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span> <span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> rm <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">rf etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">v3<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">2.9<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">linux<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">amd64<\/span><\/pre>\n<p>\u5b8c\u6210\u540e\u65b0\u5efa Etcd Group \u4e0e User\uff0c\u5e76\u5efa\u7acb Etcd \u914d\u7f6e\u6587\u4ef6\u76ee\u5f55\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ groupadd etcd <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> useradd <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">c <\/span><span class=\\\"str\\\">\\\"Etcd user\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">g etcd <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">s <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">sbin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">nologin <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">r etcd<\/span><\/pre>\n<p>\u4e0b\u8f7detcd\u76f8\u5173\u6587\u4ef6\uff0c\u6211\u4eec\u5c06\u6765\u7ba1\u7406 Etcd\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> ETCD_CONF_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/master\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${ETCD_CONF_URL}\/etcd.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n$ wget <\/span><span class=\\\"str\\\">\\\"${ETCD_CONF_URL}\/etcd.service\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><\/pre>\n<blockquote><p>\u82e5\u4e0e\u8be5\u6559\u7a0b IP \u4e0d\u540c\u7684\u8bdd\uff0c\u8bf7\u7528\u81ea\u5df1 IP \u53d6\u4ee3172.16.35.12\u3002<\/p><\/blockquote>\n<p>\u5efa\u7acb var \u5b58\u653e\u4fe1\u606f\uff0c\u7136\u540e\u542f\u52a8 Etcd \u670d\u52a1:<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">var<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> chown etcd<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">etcd <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">R <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">var<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd\n$ systemctl enable etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl start etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><\/pre>\n<p>\u901a\u8fc7\u7b80\u5355\u6307\u4ee4\u9a8c\u8bc1\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CA<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"\/etc\/etcd\/ssl\\\"<\/span><span class=\\\"pln\\\">\n$ ETCDCTL_API<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"lit\\\">3<\/span><span class=\\\"pln\\\"> etcdctl \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cacert<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">CA<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cert<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">CA<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">CA<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">endpoints<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/172.16.35.12:2379\\\"<\/span><span class=\\\"pln\\\"> \\\\\n    endpoint health\n<\/span><span class=\\\"com\\\"># output<\/span><span class=\\\"pln\\\">\nhttps<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"com\\\">\/\/172.16.35.12:2379 is healthy: successfully committed proposal: took = 641.36\u00b5s<\/span><\/pre>\n<h2>Kubernetes Master<\/h2>\n<p><a href=\\\"http:\/\/docs.kubernetes.org.cn\/306.html\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Master<\/a>\u00a0\u662f Kubernetes \u7684\u5927\u603b\u7ba1\uff0c\u4e3b\u8981\u521b\u5efaapiserver\u3001Controller manager\u4e0eScheduler\u6765\u7ec4\u4ef6\u7ba1\u7406\u6240\u6709 Node\u3002\u672c\u6b65\u9aa4\u5c06\u4e0b\u8f7d Kubernetes \u5e76\u5b89\u88c5\u81f3\u00a0master1\u4e0a\uff0c\u7136\u540e\u4ea7\u751f\u76f8\u5173 TLS Cert \u4e0e CA \u5bc6\u94a5\uff0c\u63d0\u4f9b\u7ed9\u96c6\u7fa4\u7ec4\u4ef6\u8ba4\u8bc1\u4f7f\u7528\u3002<\/p>\n<h3>\u4e0b\u8f7d Kubernetes \u7ec4\u4ef6<\/h3>\n<p>\u9996\u5148\u901a\u8fc7\u7f51\u7edc\u53d6\u5f97\u6240\u6709\u9700\u8981\u7684\u6267\u884c\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># Download Kubernetes<\/span><span class=\\\"pln\\\">\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> KUBE_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/storage.googleapis.com\/kubernetes-release\/release\/v1.8.2\/bin\/linux\/amd64\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBE_URL}\/kubelet\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBE_URL}\/kubectl\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubectl\n$ chmod <\/span><span class=\\\"pun\\\">+<\/span><span class=\\\"pln\\\">x <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubectl\n<\/span><span class=\\\"com\\\"># Download CNI<\/span><span class=\\\"pln\\\">\n$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CNI_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/github.com\/containernetworking\/plugins\/releases\/download\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">qO<\/span><span class=\\\"pun\\\">-<\/span> <span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">show<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">progress <\/span><span class=\\\"str\\\">\\\"${CNI_URL}\/v0.6.0\/cni-plugins-amd64-v0.6.0.tgz\\\"<\/span> <span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> tar <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">zx<\/span><\/pre>\n<h3>\u521b\u5efa\u96c6\u7fa4 CA \u4e0e Certificates<\/h3>\n<p>\u5728\u8fd9\u90e8\u5206\uff0c\u5c06\u4f1a\u9700\u8981\u751f\u6210 client \u4e0e server \u7684\u5404\u7ec4\u4ef6 certificates\uff0c\u5e76\u4e14\u66ff Kubernetes admin user \u751f\u6210 client \u8bc1\u4e66\u3002<br \/>\n\u521b\u5efapki\u6587\u4ef6\u5939\uff0c\u7136\u540e\u8fdb\u5165\u76ee\u5f55\u5b8c\u6210\u4ee5\u4e0b\u64cd\u4f5c\u3002<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">pki <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">pki\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> PKI_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/pki\\\"<\/span><span class=\\\"pln\\\">\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> KUBE_APISERVER<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/172.16.35.12:6443\\\"<\/span><\/pre>\n<p>\u4e0b\u8f7dca-config.json\u4e0eca-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 CA \u5bc6\u94a5\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/ca-config.json\\\"<\/span> <span class=\\\"str\\\">\\\"${PKI_URL}\/ca-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">initca ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare ca\n$ ls ca<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<h4>API server certificate<\/h4>\n<p>\u4e0b\u8f7dapiserver-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 kube-apiserver certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/apiserver-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">hostname<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"lit\\\">10.96<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.1<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">127.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.1<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"kwd\\\">default<\/span><span class=\\\"pln\\\"> \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare apiserver\n$ ls apiserver<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\napiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  apiserver<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<blockquote><p>\u82e5\u8282\u70b9 IP \u4e0d\u540c\uff0c\u9700\u8981\u4fee\u6539apiserver-csr.json\u7684hosts\u3002<\/p><\/blockquote>\n<h4>Front proxy certificate<\/h4>\n<p>\u4e0b\u8f7dfront-proxy-ca-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 Front proxy CA \u5bc6\u94a5\uff0cFront proxy \u4e3b\u8981\u662f\u7528\u5728 API aggregator \u4e0a:<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/front-proxy-ca-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">initca front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca\n$ ls front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nfront<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<p>\u4e0b\u8f7dfront-proxy-client-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 front-proxy-client \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/front-proxy-client-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client\n$ ls front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nfront<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<h4><a href=\\\"http:\/\/docs.kubernetes.org.cn\/713.html\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Bootstrap Token<\/a><\/h4>\n<p>\u7531\u4e8e\u901a\u8fc7\u624b\u52a8\u521b\u5efa CA \u65b9\u5f0f\u592a\u8fc7\u7e41\u6742\uff0c\u53ea\u9002\u5408\u5c11\u91cf\u673a\u5668\uff0c\u56e0\u4e3a\u6bcf\u6b21\u7b7e\u8bc1\u65f6\u90fd\u9700\u8981\u7ed1\u5b9a Node IP\uff0c\u968f\u673a\u5668\u589e\u52a0\u4f1a\u5e26\u6765\u5f88\u591a\u56f0\u6270\uff0c\u56e0\u6b64\u8fd9\u8fb9\u4f7f\u7528 TLS Bootstrapping \u65b9\u5f0f\u8fdb\u884c\u6388\u6743\uff0c\u7531 apiserver \u81ea\u52a8\u7ed9\u7b26\u5408\u6761\u4ef6\u7684 Node \u53d1\u9001\u8bc1\u4e66\u6765\u6388\u6743\u52a0\u5165\u96c6\u7fa4\u3002<br \/>\n\u4e3b\u8981\u505a\u6cd5\u662f kubelet \u542f\u52a8\u65f6\uff0c\u5411 kube-apiserver \u4f20\u9001 TLS Bootstrapping \u8bf7\u6c42\uff0c\u800c kube-apiserver \u9a8c\u8bc1 kubelet \u8bf7\u6c42\u7684 token \u662f\u5426\u4e0e\u8bbe\u5b9a\u7684\u4e00\u6837\uff0c\u82e5\u4e00\u6837\u5c31\u81ea\u52a8\u4ea7\u751f kubelet \u8bc1\u4e66\u4e0e\u5bc6\u94a5\u3002\u5177\u4f53\u4f5c\u6cd5\u53ef\u4ee5\u53c2\u8003\u00a0<a href=\\\"http:\/\/docs.kubernetes.org.cn\/698.html\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">TLS bootstrapping<\/a>\u3002<br \/>\n\u9996\u5148\u5efa\u7acb\u4e00\u4e2a\u53d8\u91cf\u6765\u4ea7\u751fBOOTSTRAP_TOKEN\uff0c\u5e76\u5efa\u7acb\u00a0bootstrap.conf\u00a0\u7684 kubeconfig \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> BOOTSTRAP_TOKEN<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">(<\/span><span class=\\\"pln\\\">head <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">c <\/span><span class=\\\"lit\\\">16<\/span> <span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dev<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">urandom <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> od <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"typ\\\">An<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">t x <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> tr <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">d <\/span><span class=\\\"str\\\">\\' \\'<\/span><span class=\\\"pun\\\">)<\/span><span class=\\\"pln\\\">\n$ cat <\/span><span class=\\\"pun\\\">&lt;&lt;<\/span><span class=\\\"pln\\\">EOF <\/span><span class=\\\"pun\\\">&gt;<\/span> <span class=\\\"str\\\">\/etc\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">token<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csv\n$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">BOOTSTRAP_TOKEN<\/span><span class=\\\"pun\\\">},<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">10001<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"str\\\">\\\"system:kubelet-bootstrap\\\"<\/span><span class=\\\"pln\\\">\nEOF\n<\/span><span class=\\\"com\\\"># bootstrap set-cluster<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cluster kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">authority<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">server<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">KUBE_APISERVER<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># bootstrap set-credentials<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">credentials kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">token<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">BOOTSTRAP_TOKEN<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># bootstrap set-context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context <\/span><span class=\\\"kwd\\\">default<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cluster<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap \\\\\n   <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># bootstrap set default context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">use<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context <\/span><span class=\\\"kwd\\\">default<\/span> <span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<blockquote><p>\u82e5\u60f3\u8981\u7528 CA \u65b9\u5f0f\u6765\u8ba4\u8bc1\uff0c\u53ef\u4ee5\u53c2\u8003\u00a0<a href=\\\"https:\/\/gist.github.com\/kairen\/60ad8545b79e8e7aa9bdc8a2893df7a0\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Kubelet certificate<\/a>\u3002<\/p><\/blockquote>\n<h4>Admin certificate<\/h4>\n<p>\u4e0b\u8f7dadmin-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 admin certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/admin-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  admin<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare admin\n$ ls admin<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nadmin<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<p>\u63a5\u7740\u901a\u8fc7\u4ee5\u4e0b\u6307\u4ee4\u751f\u6210\u540d\u79f0\u4e3a\u00a0admin.conf\u00a0\u7684 kubeconfig \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># admin set-cluster<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cluster kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">authority<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">server<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">KUBE_APISERVER<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># admin set-credentials<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">credentials kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">admin \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># admin set-context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">admin@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cluster<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">admin \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># admin set default context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">use<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">admin@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<h4>Controller manager certificate<\/h4>\n<p>\u4e0b\u8f7dmanager-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 kube-controller-manager certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/manager-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  manager<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager\n$ ls controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<blockquote><p>\u82e5\u8282\u70b9 IP \u4e0d\u540c\uff0c\u9700\u8981\u4fee\u6539manager-csr.json\u7684hosts\u3002<\/p><\/blockquote>\n<p>\u63a5\u7740\u901a\u8fc7\u4ee5\u4e0b\u6307\u4ee4\u751f\u6210\u540d\u79f0\u4e3acontroller-manager.conf\u7684 kubeconfig \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># controller-manager set-cluster<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cluster kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">authority<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">server<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">KUBE_APISERVER<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># controller-manager set-credentials<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">credentials system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># controller-manager set-context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cluster<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># controller-manager set default context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">use<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<h4>Scheduler certificate<\/h4>\n<p>\u4e0b\u8f7dscheduler-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 kube-scheduler certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/scheduler-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare scheduler\n$ ls scheduler<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nscheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<blockquote><p>\u82e5\u8282\u70b9 IP \u4e0d\u540c\uff0c\u9700\u8981\u4fee\u6539scheduler-csr.json\u7684hosts\u3002<\/p><\/blockquote>\n<p>\u63a5\u7740\u901a\u8fc7\u4ee5\u4e0b\u6307\u4ee4\u751f\u6210\u540d\u79f0\u4e3a\u00a0scheduler.conf\u00a0\u7684 kubeconfig \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># scheduler set-cluster<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cluster kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">authority<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">server<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">KUBE_APISERVER<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># scheduler set-credentials<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">credentials system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># scheduler set-context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cluster<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># scheduler set default context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">use<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<h4>Kubelet master certificate<\/h4>\n<p>\u4e0b\u8f7dkubelet-csr.json\u6587\u4ef6\uff0c\u5e76\u751f\u6210 master node certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/kubelet-csr.json\\\"<\/span><span class=\\\"pln\\\">\n$ sed <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">i <\/span><span class=\\\"str\\\">\\'s\/$NODE\/master1\/g\\'<\/span><span class=\\\"pln\\\"> kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">hostname<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">master1<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span><span class=\\\"pln\\\"> \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare kubelet\n$ ls kubelet<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nkubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<blockquote><p>\u8fd9\u8fb9$NODE\u9700\u8981\u968f\u8282\u70b9\u540d\u79f0\u4e0d\u540c\u800c\u6539\u53d8\u3002<\/p><\/blockquote>\n<p>\u63a5\u7740\u901a\u8fc7\u4ee5\u4e0b\u6307\u4ee4\u751f\u6210\u540d\u79f0\u4e3a\u00a0kubelet.conf\u00a0\u7684 kubeconfig \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># kubelet set-cluster<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cluster kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">authority<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">server<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">KUBE_APISERVER<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># kubelet set-credentials<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">credentials system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">master1 \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># kubelet set-context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">master1@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cluster<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">master1 \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># kubelet set default context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">use<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">master1@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<h4>Service account key<\/h4>\n<p>Service account \u4e0d\u662f\u901a\u8fc7 CA \u8fdb\u884c\u8ba4\u8bc1\uff0c\u56e0\u6b64\u4e0d\u8981\u901a\u8fc7 CA \u6765\u505a Service account key \u7684\u68c0\u67e5\uff0c\u8fd9\u8fb9\u5efa\u7acb\u4e00\u7ec4 Private \u4e0e Public \u5bc6\u94a5\u63d0\u4f9b\u7ed9 Service account key \u4f7f\u7528\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ openssl genrsa <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">out<\/span><span class=\\\"pln\\\"> sa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key <\/span><span class=\\\"lit\\\">2048<\/span><span class=\\\"pln\\\">\n$ openssl rsa <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> sa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">pubout <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">out<\/span><span class=\\\"pln\\\"> sa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pub\n$ ls sa<\/span><span class=\\\"pun\\\">.*<\/span><span class=\\\"pln\\\">\nsa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key  sa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pub<\/span><\/pre>\n<p>\u5b8c\u6210\u540e\u5220\u9664\u4e0d\u5fc5\u8981\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ rm <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">rf <\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">csr<\/span><\/pre>\n<p>\u786e\u8ba4\/etc\/kubernetes\u4e0e\/etc\/kubernetes\/pki\u6709\u4ee5\u4e0b\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ ls <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">\nadmin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  pki  scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  token<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csv\n$ ls <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">pki\nadmin<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  sa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key  scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem\nadmin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      apiserver<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      front<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem      sa<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pub  scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<h3>\u5b89\u88c5 Kubernetes \u6838\u5fc3\u7ec4\u4ef6<\/h3>\n<p>\u9996\u5148\u4e0b\u8f7d Kubernetes \u6838\u5fc3\u7ec4\u4ef6 YAML \u6587\u4ef6\uff0c\u8fd9\u8fb9\u6211\u4eec\u4e0d\u900f\u8fc7 Binary \u65b9\u6848\u6765\u521b\u5efa Master \u6838\u5fc3\u7ec4\u4ef6\uff0c\u800c\u662f\u5229\u7528 Kubernetes Static Pod \u6765\u521b\u5efa\uff0c\u56e0\u6b64\u9700\u4e0b\u8f7d\u6240\u6709\u6838\u5fc3\u7ec4\u4ef6\u7684Static Pod\u6587\u4ef6\u5230\/etc\/kubernetes\/manifests\u76ee\u5f55\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CORE_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/master\\\"<\/span><span class=\\\"pln\\\">\n$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">manifests <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">manifests\n$ <\/span><span class=\\\"kwd\\\">for<\/span><span class=\\\"pln\\\"> FILE <\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> apiserver manager scheduler<\/span><span class=\\\"pun\\\">;<\/span> <span class=\\\"kwd\\\">do<\/span><span class=\\\"pln\\\">\n    wget <\/span><span class=\\\"str\\\">\\\"${CORE_URL}\/${FILE}.yml.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}.<\/span><span class=\\\"pln\\\">yml\n  <\/span><span class=\\\"kwd\\\">done<\/span><\/pre>\n<blockquote><p>\u82e5IP\u4e0e\u6559\u7a0b\u8bbe\u5b9a\u4e0d\u540c\u7684\u8bdd\uff0c\u8bf7\u8bb0\u5f97\u4fee\u6539apiserver.yml\u3001manager.yml\u3001scheduler.yml\u3002<br \/>\napiserver \u4e2d\u7684\u00a0NodeRestriction\u00a0\u8bf7\u53c2\u8003\u00a0<a href=\\\"http:\/\/docs.kubernetes.org.cn\/156.html\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Using Node Authorization<\/a>\u3002<\/p><\/blockquote>\n<p>\u751f\u6210\u4e00\u4e2a\u7528\u6765\u52a0\u5bc6 Etcd \u7684 Key\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ head <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">c <\/span><span class=\\\"lit\\\">32<\/span> <span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dev<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">urandom <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> base64\n<\/span><span class=\\\"typ\\\">SUpbL4juUYyvxj3<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">gonV5xVEx8j769<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">99TSAf8YT<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">sQ<\/span><span class=\\\"pun\\\">=<\/span><\/pre>\n<p>\u5728\/etc\/kubernetes\/\u76ee\u5f55\u4e0b\uff0c\u521b\u5efaencryption.yml\u7684\u52a0\u5bc6 YAML \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ cat <\/span><span class=\\\"pun\\\">&lt;&lt;<\/span><span class=\\\"pln\\\">EOF <\/span><span class=\\\"pun\\\">&gt;<\/span> <span class=\\\"str\\\">\/etc\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">encryption<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\nkind<\/span><span class=\\\"pun\\\">:<\/span> <span class=\\\"typ\\\">EncryptionConfig<\/span><span class=\\\"pln\\\">\napiVersion<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\"> v1\nresources<\/span><span class=\\\"pun\\\">:<\/span>\n  <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\"> resources<\/span><span class=\\\"pun\\\">:<\/span>\n      <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\"> secrets\n    providers<\/span><span class=\\\"pun\\\">:<\/span>\n      <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\"> aescbc<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">\n          keys<\/span><span class=\\\"pun\\\">:<\/span>\n            <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\"> name<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\"> key1\n              secret<\/span><span class=\\\"pun\\\">:<\/span> <span class=\\\"typ\\\">SUpbL4juUYyvxj3<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">gonV5xVEx8j769<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">99TSAf8YT<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">sQ<\/span><span class=\\\"pun\\\">=<\/span>\n      <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\"> identity<\/span><span class=\\\"pun\\\">:<\/span> <span class=\\\"pun\\\">{}<\/span><span class=\\\"pln\\\">\nEOF<\/span><\/pre>\n<blockquote><p>Etcd \u6570\u636e\u52a0\u5bc6\u53ef\u53c2\u8003\u8fd9\u7bc7\u00a0<a href=\\\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/encrypt-data\/\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Encrypting data at rest<\/a>\u3002<\/p><\/blockquote>\n<p>\u5728\/etc\/kubernetes\/\u76ee\u5f55\u4e0b\uff0c\u521b\u5efaaudit-policy.yml\u7684\u8fdb\u9636\u5ba1\u6838\u7b56\u7565 YAML \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ cat <\/span><span class=\\\"pun\\\">&lt;&lt;<\/span><span class=\\\"pln\\\">EOF <\/span><span class=\\\"pun\\\">&gt;<\/span> <span class=\\\"str\\\">\/etc\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">audit<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">policy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\napiVersion<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\"> audit<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">k8s<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">io<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">v1beta1\nkind<\/span><span class=\\\"pun\\\">:<\/span> <span class=\\\"typ\\\">Policy<\/span><span class=\\\"pln\\\">\nrules<\/span><span class=\\\"pun\\\">:<\/span>\n<span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\"> level<\/span><span class=\\\"pun\\\">:<\/span> <span class=\\\"typ\\\">Metadata<\/span><span class=\\\"pln\\\">\nEOF<\/span><\/pre>\n<blockquote><p>Audit Policy \u8bf7\u53c2\u8003\u8fd9\u7bc7\u00a0<a href=\\\"https:\/\/kubernetes.io\/docs\/tasks\/debug-application-cluster\/audit\/\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Auditing<\/a>\u3002<\/p><\/blockquote>\n<p>\u4e0b\u8f7dkubelet.service\u76f8\u5173\u6587\u4ef6\u6765\u7ba1\u7406 kubelet\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> KUBELET_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/master\\\"<\/span><span class=\\\"pln\\\">\n$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBELET_URL}\/kubelet.service\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBELET_URL}\/10-kubelet.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">10<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<p>\u6700\u540e\u521b\u5efa var \u5b58\u653e\u4fe1\u606f\uff0c\u7136\u540e\u542f\u52a8 kubelet \u670d\u52a1:<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">var<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">var<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">log<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes\n$ systemctl enable kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl start kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><\/pre>\n<p>\u5b8c\u6210\u540e\u4f1a\u9700\u8981\u4e00\u6bb5\u65f6\u95f4\u6765\u4e0b\u8f7d\u955c\u50cf\u6587\u4ef6\u4e0e\u542f\u52a8\u7ec4\u4ef6\uff0c\u53ef\u4ee5\u5229\u7528\u8be5\u6307\u4ee4\u6765\u67e5\u770b\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ watch netstat <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ntlp\ntcp        <\/span><span class=\\\"lit\\\">0<\/span>      <span class=\\\"lit\\\">0<\/span> <span class=\\\"lit\\\">127.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.1<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">10248<\/span>         <span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">:*<\/span><span class=\\\"pln\\\">               LISTEN      <\/span><span class=\\\"lit\\\">23012<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet\ntcp        <\/span><span class=\\\"lit\\\">0<\/span>      <span class=\\\"lit\\\">0<\/span> <span class=\\\"lit\\\">127.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.1<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">10251<\/span>         <span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">:*<\/span><span class=\\\"pln\\\">               LISTEN      <\/span><span class=\\\"lit\\\">22305<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">schedule\ntcp        <\/span><span class=\\\"lit\\\">0<\/span>      <span class=\\\"lit\\\">0<\/span> <span class=\\\"lit\\\">127.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.1<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">10252<\/span>         <span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.0<\/span><span class=\\\"pun\\\">:*<\/span><span class=\\\"pln\\\">               LISTEN      <\/span><span class=\\\"lit\\\">22529<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controll\ntcp6       <\/span><span class=\\\"lit\\\">0<\/span>      <span class=\\\"lit\\\">0<\/span> <span class=\\\"pun\\\">:::<\/span><span class=\\\"lit\\\">6443<\/span>                 <span class=\\\"pun\\\">:::*<\/span><span class=\\\"pln\\\">                    LISTEN      <\/span><span class=\\\"lit\\\">22956<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">apiserve<\/span><\/pre>\n<blockquote><p>\u82e5\u770b\u5230\u4ee5\u4e0a\u4fe1\u606f\u8868\u793a\u670d\u52a1\u6b63\u5e38\u542f\u52a8\uff0c\u82e5\u53d1\u751f\u95ee\u9898\u53ef\u4ee5\u7528docker cli\u6765\u67e5\u770b\u3002<\/p><\/blockquote>\n<p>\u5b8c\u6210\u540e\uff0c\u590d\u5236 admin kubeconfig \u6587\u4ef6\uff0c\u5e76\u901a\u8fc7\u7b80\u5355\u6307\u4ee4\u9a8c\u8bc1\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ cp <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">admin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf <\/span><span class=\\\"pun\\\">~<\/span><span class=\\\"str\\\">\/.kube\/<\/span><span class=\\\"pln\\\">config\n$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> cs\nNAME                 STATUS    MESSAGE              ERROR\netcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">0<\/span>               <span class=\\\"typ\\\">Healthy<\/span>   <span class=\\\"pun\\\">{<\/span><span class=\\\"str\\\">\\\"health\\\"<\/span><span class=\\\"pun\\\">:<\/span> <span class=\\\"str\\\">\\\"true\\\"<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\">\nscheduler            <\/span><span class=\\\"typ\\\">Healthy<\/span><span class=\\\"pln\\\">   ok\ncontroller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager   <\/span><span class=\\\"typ\\\">Healthy<\/span><span class=\\\"pln\\\">   ok\n$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> node\nNAME      STATUS     ROLES     AGE       VERSION\nmaster1   <\/span><span class=\\\"typ\\\">NotReady<\/span><span class=\\\"pln\\\">   master    <\/span><span class=\\\"lit\\\">4m<\/span><span class=\\\"pln\\\">        v1<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">8.2<\/span><span class=\\\"pln\\\">\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po\nNAME                              READY     STATUS    RESTARTS   AGE\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1            <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">4m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">4m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1            <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">4m<\/span><\/pre>\n<p>\u786e\u8ba4\u670d\u52a1\u80fd\u591f\u6267\u884c logs \u7b49\u6307\u4ee4\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system logs <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1\n<\/span><span class=\\\"typ\\\">Error<\/span> <span class=\\\"kwd\\\">from<\/span><span class=\\\"pln\\\"> server <\/span><span class=\\\"pun\\\">(<\/span><span class=\\\"typ\\\">Forbidden<\/span><span class=\\\"pun\\\">):<\/span> <span class=\\\"typ\\\">Forbidden<\/span> <span class=\\\"pun\\\">(<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">apiserver<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\"> verb<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\"> resource<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">nodes<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\"> subresource<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">)<\/span> <span class=\\\"pun\\\">(<\/span><span class=\\\"pln\\\"> pods<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">log kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1<\/span><span class=\\\"pun\\\">)<\/span><\/pre>\n<blockquote><p>\u8fd9\u8fb9\u4f1a\u53d1\u73b0\u51fa\u73b0 403 Forbidden \u95ee\u9898\uff0c\u8fd9\u662f\u56e0\u4e3a\u00a0kube-apiserver\u00a0user \u5e76\u6ca1\u6709 nodes \u7684\u8d44\u6e90\u6743\u9650\uff0c\u5c5e\u4e8e\u6b63\u5e38\u3002<\/p><\/blockquote>\n<p>\u7531\u4e8e\u4e0a\u8ff0\u6743\u9650\u95ee\u9898\uff0c\u6211\u4eec\u5fc5\u9700\u521b\u5efa\u4e00\u4e2a\u00a0apiserver-to-kubelet-rbac.yml\u00a0\u6765\u5b9a\u4e49\u6743\u9650\uff0c\u4ee5\u4f9b\u6211\u4eec\u6267\u884c logs\u3001exec \u7b49\u6307\u4ee4\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/master\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${URL}\/apiserver-to-kubelet-rbac.yml.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">to<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">rbac<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl apply <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">to<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">rbac<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n<\/span><span class=\\\"com\\\"># \u6e2c\u8a66 logs<\/span><span class=\\\"pln\\\">\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system logs <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1\n<\/span><span class=\\\"pun\\\">...<\/span><span class=\\\"pln\\\">\nI1031 <\/span><span class=\\\"lit\\\">03<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">22<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">42.527697<\/span>       <span class=\\\"lit\\\">1<\/span><span class=\\\"pln\\\"> leaderelection<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">go<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">184<\/span><span class=\\\"pun\\\">]<\/span><span class=\\\"pln\\\"> successfully acquired lease kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler<\/span><\/pre>\n<h2>Kubernetes Node<\/h2>\n<p>Node \u662f\u4e3b\u8981\u6267\u884c\u5bb9\u5668\u5b9e\u4f8b\u7684\u8282\u70b9\uff0c\u53ef\u89c6\u4e3a\u5de5\u4f5c\u8282\u70b9\u3002\u5728\u8fd9\u6b65\u9aa4\u6211\u4eec\u4f1a\u4e0b\u8f7d Kubernetes binary \u6587\u4ef6\uff0c\u5e76\u521b\u5efa node \u7684 certificate \u6765\u63d0\u4f9b\u7ed9\u8282\u70b9\u6ce8\u518c\u8ba4\u8bc1\u7528\u3002Kubernetes \u4f7f\u7528Node Authorizer\u6765\u63d0\u4f9b<a href=\\\"http:\/\/docs.kubernetes.org.cn\/156.html\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Authorization mode<\/a>\uff0c\u8fd9\u79cd\u6388\u6743\u6a21\u5f0f\u4f1a\u66ff Kubelet \u751f\u6210 API request\u3002<br \/>\n\u5728\u5f00\u59cb\u524d\uff0c\u6211\u4eec\u5148\u5728master1\u5c06\u9700\u8981\u7684 ca \u4e0e cert \u590d\u5236\u5230 Node \u8282\u70b9\u4e0a\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">for<\/span><span class=\\\"pln\\\"> NODE <\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> node1 node2<\/span><span class=\\\"pun\\\">;<\/span> <span class=\\\"kwd\\\">do<\/span><span class=\\\"pln\\\">\n    ssh $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">NODE<\/span><span class=\\\"pun\\\">}<\/span> <span class=\\\"str\\\">\\\"mkdir -p \/etc\/kubernetes\/pki\/\\\"<\/span><span class=\\\"pln\\\">\n    ssh $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">NODE<\/span><span class=\\\"pun\\\">}<\/span> <span class=\\\"str\\\">\\\"mkdir -p \/etc\/etcd\/ssl\\\"<\/span>\n    <span class=\\\"com\\\"># Etcd ca and cert<\/span>\n    <span class=\\\"kwd\\\">for<\/span><span class=\\\"pln\\\"> FILE <\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><span class=\\\"pun\\\">;<\/span> <span class=\\\"kwd\\\">do<\/span><span class=\\\"pln\\\">\n      scp <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">NODE<\/span><span class=\\\"pun\\\">}:\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}<\/span>\n    <span class=\\\"kwd\\\">done<\/span>\n    <span class=\\\"com\\\"># Kubernetes ca and cert<\/span>\n    <span class=\\\"kwd\\\">for<\/span><span class=\\\"pln\\\"> FILE <\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> pki<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem pki<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><span class=\\\"pun\\\">;<\/span> <span class=\\\"kwd\\\">do<\/span><span class=\\\"pln\\\">\n      scp <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">NODE<\/span><span class=\\\"pun\\\">}:\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}<\/span>\n    <span class=\\\"kwd\\\">done<\/span>\n  <span class=\\\"kwd\\\">done<\/span><\/pre>\n<h3>\u4e0b\u8f7d Kubernetes \u7ec4\u4ef6<\/h3>\n<p>\u9996\u5148\u901a\u8fc7\u7f51\u7edc\u53d6\u5f97\u6240\u6709\u9700\u8981\u7684\u6267\u884c\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># Download Kubernetes<\/span><span class=\\\"pln\\\">\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> KUBE_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/storage.googleapis.com\/kubernetes-release\/release\/v1.8.2\/bin\/linux\/amd64\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBE_URL}\/kubelet\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet\n$ chmod <\/span><span class=\\\"pun\\\">+<\/span><span class=\\\"pln\\\">x <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet\n<\/span><span class=\\\"com\\\"># Download CNI<\/span><span class=\\\"pln\\\">\n$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CNI_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/github.com\/containernetworking\/plugins\/releases\/download\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">qO<\/span><span class=\\\"pun\\\">-<\/span> <span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">show<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">progress <\/span><span class=\\\"str\\\">\\\"${CNI_URL}\/v0.6.0\/cni-plugins-amd64-v0.6.0.tgz\\\"<\/span> <span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> tar <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">zx<\/span><\/pre>\n<h3>\u8bbe\u5b9a Kubernetes node<\/h3>\n<p>\u63a5\u7740\u4e0b\u8f7d Kubernetes \u76f8\u5173\u6587\u4ef6\uff0c\u5305\u542b drop-in file\u3001systemd service \u6863\u6848\u7b49\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> KUBELET_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/node\\\"<\/span><span class=\\\"pln\\\">\n$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBELET_URL}\/kubelet.service\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service\n$ wget <\/span><span class=\\\"str\\\">\\\"${KUBELET_URL}\/10-kubelet.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">10<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<p>\u63a5\u7740\u5728\u6240\u6709node\u521b\u5efa var \u5b58\u653e\u4fe1\u606f\uff0c\u7136\u540e\u542f\u52a8 kubelet \u670d\u52a1:<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">var<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubelet <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">var<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">log<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">manifests\n$ systemctl enable kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl start kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><\/pre>\n<p>P.S. \u91cd\u590d\u4e00\u6837\u52a8\u4f5c\u6765\u5b8c\u6210\u5176\u4ed6\u8282\u70b9\u3002<\/p>\n<h3>\u6388\u6743 Kubernetes Node<\/h3>\n<p>\u5f53\u6240\u6709\u8282\u70b9\u90fd\u5b8c\u6210\u540e\uff0c\u5728master\u8282\u70b9\uff0c\u56e0\u4e3a\u6211\u4eec\u91c7\u7528 TLS Bootstrapping\uff0c\u6240\u9700\u8981\u521b\u5efa\u4e00\u4e2a ClusterRoleBinding\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl create clusterrolebinding kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">clusterrole<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrapper \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap<\/span><\/pre>\n<p>\u5728master\u901a\u8fc7\u7b80\u5355\u6307\u4ee4\u9a8c\u8bc1\uff0c\u4f1a\u770b\u5230\u8282\u70b9\u5904\u4e8epending\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> csr\nNAME                                                   AGE       REQUESTOR           CONDITION\nnode<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"typ\\\">YWf97ZrLCTlr2hmXsNLfjVLwaLfZRsu52FRKOYjpcBE<\/span>   <span class=\\\"lit\\\">2s<\/span><span class=\\\"pln\\\">        kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap   <\/span><span class=\\\"typ\\\">Pending<\/span><span class=\\\"pln\\\">\nnode<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">eq4q6ffOwT4yqYQNU6sT7mphPOQdFN6yulMVZeu6pkE   <\/span><span class=\\\"lit\\\">2s<\/span><span class=\\\"pln\\\">        kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap   <\/span><span class=\\\"typ\\\">Pending<\/span><\/pre>\n<p>\u901a\u8fc7 kubectl \u6765\u5141\u8bb8\u8282\u70b9\u52a0\u5165\u96c6\u7fa4\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> csr <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> awk <\/span><span class=\\\"str\\\">\\'\/Pending\/ {print $1}\\'<\/span> <span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> xargs kubectl certificate approve\ncertificatesigningrequest <\/span><span class=\\\"str\\\">\\\"node-csr-YWf97ZrLCTlr2hmXsNLfjVLwaLfZRsu52FRKOYjpcBE\\\"<\/span><span class=\\\"pln\\\"> approved\ncertificatesigningrequest <\/span><span class=\\\"str\\\">\\\"node-csr-eq4q6ffOwT4yqYQNU6sT7mphPOQdFN6yulMVZeu6pkE\\\"<\/span><span class=\\\"pln\\\"> approved\n$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> csr\nNAME                                                   AGE       REQUESTOR           CONDITION\nnode<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"typ\\\">YWf97ZrLCTlr2hmXsNLfjVLwaLfZRsu52FRKOYjpcBE<\/span>   <span class=\\\"lit\\\">30s<\/span><span class=\\\"pln\\\">       kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap   <\/span><span class=\\\"typ\\\">Approved<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"typ\\\">Issued<\/span><span class=\\\"pln\\\">\nnode<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">eq4q6ffOwT4yqYQNU6sT7mphPOQdFN6yulMVZeu6pkE   <\/span><span class=\\\"lit\\\">30s<\/span><span class=\\\"pln\\\">       kubelet<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bootstrap   <\/span><span class=\\\"typ\\\">Approved<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"typ\\\">Issued<\/span><span class=\\\"pln\\\">\n$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span> <span class=\\\"kwd\\\">no<\/span><span class=\\\"pln\\\">\nNAME      STATUS     ROLES     AGE       VERSION\nmaster1   <\/span><span class=\\\"typ\\\">NotReady<\/span><span class=\\\"pln\\\">   master    <\/span><span class=\\\"lit\\\">15m<\/span><span class=\\\"pln\\\">       v1<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">8.2<\/span><span class=\\\"pln\\\">\nnode1     <\/span><span class=\\\"typ\\\">NotReady<\/span>   <span class=\\\"str\\\">&lt;none&gt;<\/span>    <span class=\\\"lit\\\">8m<\/span><span class=\\\"pln\\\">        v1<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">8.2<\/span><span class=\\\"pln\\\">\nnode2     <\/span><span class=\\\"typ\\\">NotReady<\/span>   <span class=\\\"str\\\">&lt;none&gt;<\/span>    <span class=\\\"lit\\\">6s<\/span><span class=\\\"pln\\\">        v1<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">8.2<\/span><\/pre>\n<h2>Kubernetes Core Addons \u90e8\u7f72<\/h2>\n<p>\u5f53\u5b8c\u6210\u4e0a\u9762\u6240\u6709\u6b65\u9aa4\u540e\uff0c\u63a5\u7740\u6211\u4eec\u9700\u8981\u5b89\u88c5\u4e00\u4e9b\u63d2\u4ef6\uff0c\u800c\u8fd9\u4e9b\u6709\u90e8\u5206\u662f\u975e\u5e38\u91cd\u8981\u8ddf\u597d\u7528\u7684\uff0c\u5982Kube-dns\u4e0eKube-proxy\u7b49\u3002<\/p>\n<h3>Kube-proxy addon<\/h3>\n<p><a href=\\\"https:\/\/github.com\/kubernetes\/kubernetes\/tree\/master\/cluster\/addons\/kube-proxy\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Kube-proxy<\/a>\u00a0\u662f\u5b9e\u73b0 Service \u7684\u5173\u952e\u7ec4\u4ef6\uff0ckube-proxy \u4f1a\u5728\u6bcf\u53f0\u8282\u70b9\u4e0a\u6267\u884c\uff0c\u7136\u540e\u76d1\u542c API Server \u7684 Service \u4e0e Endpoint \u8d44\u6e90\u5bf9\u8c61\u7684\u6539\u53d8\uff0c\u7136\u540e\u6765\u4f9d\u636e\u53d8\u5316\u6267\u884c iptables \u6765\u5b9e\u73b0\u7f51\u7edc\u7684\u8f6c\u53d1\u3002\u8fd9\u8fb9\u6211\u4eec\u4f1a\u9700\u8981\u5efa\u8bae\u4e00\u4e2a DaemonSet \u6765\u6267\u884c\uff0c\u5e76\u4e14\u521b\u5efa\u4e00\u4e9b\u9700\u8981\u7684 certificate\u3002<a href=\\\"https:\/\/www.kubernetes.org.cn\/3025.html\\\">Kubernetes 1.8 kube-proxy \u5f00\u542f ipvs<\/a><br \/>\n\u9996\u5148\u5728master1\u4e0b\u8f7dkube-proxy-csr.json\u6587\u4ef6\uff0c\u5e76\u4ea7\u751f kube-proxy certificate \u8bc1\u4e66\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> PKI_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/pki\\\"<\/span><span class=\\\"pln\\\">\n$ cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">pki\n$ wget <\/span><span class=\\\"str\\\">\\\"${PKI_URL}\/kube-proxy-csr.json\\\"<\/span> <span class=\\\"str\\\">\\\"${PKI_URL}\/ca-config.json\\\"<\/span><span class=\\\"pln\\\">\n$ cfssl gencert \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">config<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json \\\\\n  <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">profile<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n  kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">csr<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">json <\/span><span class=\\\"pun\\\">|<\/span><span class=\\\"pln\\\"> cfssljson <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bare kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy\n$ ls kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">pem\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem  kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><\/pre>\n<p>\u63a5\u7740\u900f\u8fc7\u4ee5\u4e0b\u6307\u4ee4\u751f\u6210\u540d\u79f0\u4e3a\u00a0kube-proxy.conf\u00a0\u7684 kubeconfig \u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"com\\\"># kube-proxy set-cluster<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cluster kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">authority<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">server<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/172.16.35.12:6443\\\"<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># kube-proxy set-credentials<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">credentials system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">client<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certificate<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">embed<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"kwd\\\">true<\/span><span class=\\\"pln\\\"> \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># kube-proxy set-context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">set<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">cluster<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">user<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n<\/span><span class=\\\"com\\\"># kube-proxy set default context<\/span><span class=\\\"pln\\\">\n$ kubectl config <\/span><span class=\\\"kwd\\\">use<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">context system<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy@kubernetes \\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">kubeconfig<\/span><span class=\\\"pun\\\">=..\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<p>\u5b8c\u6210\u540e\u5220\u9664\u4e0d\u5fc5\u8981\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ rm <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">rf <\/span><span class=\\\"pun\\\">*.<\/span><span class=\\\"pln\\\">json<\/span><\/pre>\n<p>\u786e\u8ba4\/etc\/kubernetes\u6709\u4ee5\u4e0b\u6587\u4ef6\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ ls <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">\nadmin<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf        bootstrap<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf           encryption<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml  kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  pki             token<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csv\naudit<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">policy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml  controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf  kubelet<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf    manifests        scheduler<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><\/pre>\n<p>\u5728master1\u5c06kube-proxy\u76f8\u5173\u6587\u4ef6\u590d\u5236\u5230 Node \u8282\u70b9\u4e0a\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">for<\/span><span class=\\\"pln\\\"> NODE <\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> node1 node2<\/span><span class=\\\"pun\\\">;<\/span> <span class=\\\"kwd\\\">do<\/span>\n    <span class=\\\"kwd\\\">for<\/span><span class=\\\"pln\\\"> FILE <\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> pki<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem pki<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf<\/span><span class=\\\"pun\\\">;<\/span> <span class=\\\"kwd\\\">do<\/span><span class=\\\"pln\\\">\n      scp <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}<\/span><span class=\\\"pln\\\"> $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">NODE<\/span><span class=\\\"pun\\\">}:\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">$<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">FILE<\/span><span class=\\\"pun\\\">}<\/span>\n    <span class=\\\"kwd\\\">done<\/span>\n  <span class=\\\"kwd\\\">done<\/span><\/pre>\n<p>\u5b8c\u6210\u540e\uff0c\u5728master1\u901a\u8fc7 kubectl \u6765\u521b\u5efa kube-proxy daemon\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> ADDON_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/addon\\\"<\/span><span class=\\\"pln\\\">\n$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">addons <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">addons\n$ wget <\/span><span class=\\\"str\\\">\\\"${ADDON_URL}\/kube-proxy.yml.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl apply <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">l k8s<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">app<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy\nNAME               READY     STATUS    RESTARTS   AGE\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">bpp7q   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">47s<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">cztvh   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">47s<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">q7mm4   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">47s<\/span><\/pre>\n<h3>Kube-dns addon<\/h3>\n<p><a href=\\\"http:\/\/docs.kubernetes.org.cn\/733.html\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Kube DNS<\/a>\u00a0\u662f Kubernetes \u96c6\u7fa4\u5185\u90e8 Pod \u4e4b\u95f4\u4e92\u76f8\u6c9f\u901a\u7684\u91cd\u8981 Addon\uff0c\u5b83\u5141\u8bb8 Pod \u53ef\u4ee5\u901a\u8fc7 Domain Name \u65b9\u5f0f\u6765\u8fde\u63a5 Service\uff0c\u5176\u4e3b\u8981\u7531 Kube DNS \u4e0e Sky DNS \u7ec4\u5408\u800c\u6210\uff0c\u901a\u8fc7 Kube DNS \u76d1\u542c Service \u4e0e Endpoint \u53d8\u5316\uff0c\u6765\u63d0\u4f9b\u7ed9 Sky DNS \u4fe1\u606f\uff0c\u5df2\u66f4\u65b0\u89e3\u6790\u5730\u5740\u3002<br \/>\n\u5b89\u88c5\u53ea\u9700\u8981\u5728master1\u901a\u8fc7 kubectl \u6765\u521b\u5efa kube-dns deployment \u5373\u53ef\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> ADDON_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/addon\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${ADDON_URL}\/kube-dns.yml.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dns<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl apply <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dns<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">l k8s<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">app<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dns\nNAME                        READY     STATUS    RESTARTS   AGE\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dns<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">6cb549f55f<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">h4zr5   <\/span><span class=\\\"lit\\\">0<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">3<\/span>       <span class=\\\"typ\\\">Pending<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">40s<\/span><\/pre>\n<h2>Calico Network \u5b89\u88c5\u4e0e\u8bbe\u5b9a<\/h2>\n<p>Calico \u662f\u4e00\u6b3e\u7eaf Layer 3 \u7684\u6570\u636e\u4e2d\u5fc3\u7f51\u7edc\u65b9\u6848(\u4e0d\u9700\u8981 Overlay \u7f51\u7edc)\uff0cCalico \u597d\u5904\u662f\u4ed6\u5df2\u4e0e\u5404\u79cd\u4e91\u539f\u751f\u5e73\u53f0\u6709\u826f\u597d\u7684\u6574\u5408\uff0c\u800c Calico \u5728\u6bcf\u4e00\u4e2a\u8282\u70b9\u5229\u7528 Linux Kernel \u5b9e\u73b0\u9ad8\u6548\u7684 vRouter \u6765\u8d1f\u8d23\u6570\u636e\u7684\u8f6c\u53d1\uff0c\u800c\u5f53\u6570\u636e\u4e2d\u5fc3\u590d\u6742\u5ea6\u589e\u52a0\u65f6\uff0c\u53ef\u4ee5\u7528 BGP route reflector \u6765\u8fbe\u6210\u3002<br \/>\n\u9996\u5148\u5728master1\u901a\u8fc7 kubectl \u5efa\u7acb Calico policy controller\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CALICO_CONF_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/network\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${CALICO_CONF_URL}\/calico-controller.yml.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl apply <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">l k8s<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">app<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">policy\nNAME                                        READY     STATUS    RESTARTS   AGE\ncalico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">policy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">5ff8b4549d<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">tctmm   <\/span><span class=\\\"lit\\\">0<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Pending<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">5s<\/span><\/pre>\n<p>\u5728master1\u4e0b\u8f7d Calico CLI \u5de5\u5177\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ wget https<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"com\\\">\/\/github.com\/projectcalico\/calicoctl\/releases\/download\/v1.6.1\/calicoctl<\/span><span class=\\\"pln\\\">\n$ chmod <\/span><span class=\\\"pun\\\">+<\/span><span class=\\\"pln\\\">x calicoctl <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> mv calicoctl <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">usr<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"kwd\\\">local<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><\/pre>\n<p>\u7136\u540e\u5728\u6240\u6709\u8282\u70b9\u4e0b\u8f7d Calico\uff0c\u5e76\u6267\u884c\u4ee5\u4e0b\u6b65\u9aa4\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CALICO_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/github.com\/projectcalico\/cni-plugin\/releases\/download\/v1.11.0\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">N <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">P <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">CALICO_URL<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">calico\n$ wget <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">N <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">P <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">CALICO_URL<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ipam\n$ chmod <\/span><span class=\\\"pun\\\">+<\/span><span class=\\\"pln\\\">x <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">calico <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">opt<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">bin<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ipam<\/span><\/pre>\n<p>\u63a5\u7740\u5728\u6240\u6709\u8282\u70b9\u4e0b\u8f7d CNI plugins\u914d\u7f6e\u6587\u4ef6\uff0c\u4ee5\u53ca calico-node.service\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">net<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d\n$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> CALICO_CONF_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/network\\\"<\/span><span class=\\\"pln\\\">\n$ wget <\/span><span class=\\\"str\\\">\\\"${CALICO_CONF_URL}\/10-calico.conf\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">cni<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">net<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">d<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">10<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">calico<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf\n$ wget <\/span><span class=\\\"str\\\">\\\"${CALICO_CONF_URL}\/calico-node.service\\\"<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">lib<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">systemd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">system<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><\/pre>\n<blockquote><p>\u82e5\u90e8\u7f72\u7684\u673a\u5668\u662f\u4f7f\u7528\u865a\u62df\u673a\uff0c\u5982 Virtualbox \u7b49\u7684\u8bdd\uff0c\u8bf7\u4fee\u6539calico-node.service\u6587\u4ef6\uff0c\u5e76\u5728IP_AUTODETECTION_METHOD(\u5305\u542b IP6)\u90e8\u5206\u6307\u5b9a\u7ed1\u5b9a\u7684\u7f51\u5361\uff0c\u4ee5\u907f\u514d\u9ed8\u8ba4\u7ed1\u5b9a\u5230 NAT \u7f51\u7edc\u4e0a\u3002<\/p><\/blockquote>\n<p>\u4e4b\u540e\u5728\u6240\u6709\u8282\u70b9\u542f\u52a8 Calico-node:<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ systemctl enable calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> systemctl start calico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">node<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">service<\/span><\/pre>\n<p>\u5728master1\u67e5\u770b Calico nodes:<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ cat <\/span><span class=\\\"pun\\\">&lt;&lt;<\/span><span class=\\\"pln\\\">EOF <\/span><span class=\\\"pun\\\">&gt;<\/span> <span class=\\\"pun\\\">~<\/span><span class=\\\"str\\\">\/calico-rc\nexport ETCD_ENDPOINTS=\\\"https:\/<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">2379<\/span><span class=\\\"str\\\">\\\"\nexport ETCD_CA_CERT_FILE=\\\"<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ca<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><span class=\\\"str\\\">\\\"\nexport ETCD_CERT_FILE=\\\"<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><span class=\\\"str\\\">\\\"\nexport ETCD_KEY_FILE=\\\"<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">ssl<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etcd<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">pem<\/span><span class=\\\"str\\\">\\\"\nEOF\n$ . ~\/calico-rc\n$ calicoctl get node -o wide\nNAME      ASN       IPV4              IPV6\nmaster1   (64512)   172.16.35.12\/24\nnode1     (64512)   172.16.35.10\/24\nnode2     (64512)   172.16.35.11\/24<\/span><\/pre>\n<p>\u67e5\u770b pending \u7684 pod \u662f\u5426\u5df2\u6267\u884c\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po\nNAME                                        READY     STATUS    RESTARTS   AGE\ncalico<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">policy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">5ff8b4549d<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">tctmm   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">4m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">apiserver<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1                      <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">20m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">controller<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">manager<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1             <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">20m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dns<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">6cb549f55f<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">h4zr5                   <\/span><span class=\\\"lit\\\">3<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">3<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">5m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">fnrkb                            <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">6m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">l72bq                            <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">6m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">proxy<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">m6rfw                            <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">6m<\/span><span class=\\\"pln\\\">\nkube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">scheduler<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">master1                      <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">20m<\/span><\/pre>\n<p>\u6700\u540e\u82e5\u60f3\u7701\u4e8b\uff0c\u53ef\u4ee5\u76f4\u63a5\u7528\u00a0<a href=\\\"https:\/\/docs.projectcalico.org\/v2.6\/getting-started\/kubernetes\/installation\/hosted\/hosted\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">Standard Hosted<\/a>\u00a0\u65b9\u5f0f\u5b89\u88c5\u3002<\/p>\n<h2>Kubernetes Extra Addons \u90e8\u7f72<\/h2>\n<p>\u672c\u8282\u8bf4\u660e\u5982\u4f55\u90e8\u7f72\u4e00\u4e9b\u5b98\u65b9\u5e38\u7528\u7684 Addons\uff0c\u5982 Dashboard\u3001Heapster \u7b49\u3002<\/p>\n<h3>Dashboard addon<\/h3>\n<p>Dashboard\u00a0\u662f Kubernetes \u793e\u533a\u5b98\u65b9\u5f00\u53d1\u7684\u4eea\u8868\u677f\uff0c\u6709\u4e86\u4eea\u8868\u677f\u540e\u7ba1\u7406\u8005\u5c31\u80fd\u591f\u900f\u8fc7 Web-based \u65b9\u5f0f\u6765\u7ba1\u7406 Kubernetes \u96c6\u7fa4\uff0c\u9664\u4e86\u63d0\u5347\u7ba1\u7406\u65b9\u4fbf\uff0c\u4e5f\u8ba9\u8d44\u6e90\u53ef\u89c6\u5316\uff0c\u8ba9\u4eba\u66f4\u76f4\u89c9\u770b\u89c1\u7cfb\u7edf\u4fe1\u606f\u7684\u5448\u73b0\u7ed3\u679c\u3002<br \/>\n\u9996\u5148\u6211\u4eec\u8981\u5efa\u7acbkubernetes-dashboard-certs\uff0c\u6765\u63d0\u4f9b\u7ed9 Dashboard TLS \u4f7f\u7528\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ mkdir <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">p <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">addons<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">certs <\/span><span class=\\\"pun\\\">&amp;&amp;<\/span><span class=\\\"pln\\\"> cd <\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">etc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">addons\n$ openssl genrsa <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">des3 <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">passout <\/span><span class=\\\"kwd\\\">pass<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">x <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">out<\/span><span class=\\\"pln\\\"> certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"kwd\\\">pass<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key <\/span><span class=\\\"lit\\\">2048<\/span><span class=\\\"pln\\\">\n$ openssl rsa <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">passin <\/span><span class=\\\"kwd\\\">pass<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"pln\\\">x <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"kwd\\\">pass<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">out<\/span><span class=\\\"pln\\\"> certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key\n$ openssl req <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">new<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">key certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">out<\/span><span class=\\\"pln\\\"> certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csr <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">subj <\/span><span class=\\\"str\\\">\\'\/CN=kube-dashboard\\'<\/span><span class=\\\"pln\\\">\n$ openssl x509 <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">req <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">sha256 <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">days <\/span><span class=\\\"lit\\\">365<\/span> <span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">in<\/span><span class=\\\"pln\\\"> certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">csr <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">signkey certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"kwd\\\">out<\/span><span class=\\\"pln\\\"> certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">crt\n$ rm certs<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"kwd\\\">pass<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">key\n$ kubectl create secret generic kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">certs\\\\\n    <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"kwd\\\">from<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">file<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">certs <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system<\/span><\/pre>\n<p>\u63a5\u7740\u5728master1\u901a\u8fc7 kubectl \u6765\u5efa\u7acb kubernetes dashboard \u5373\u53ef\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> ADDON_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/addon\\\"<\/span><span class=\\\"pln\\\">\n$ wget $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">ADDON_URL<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl apply <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\">svc <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">l k8s<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">app<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard\nNAME                                      READY     STATUS    RESTARTS   AGE\npo<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">747c4f7cf<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">md5m8   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">56s<\/span><span class=\\\"pln\\\">\nNAME                       TYPE        CLUSTER<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">IP      EXTERNAL<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">IP   PORT<\/span><span class=\\\"pun\\\">(<\/span><span class=\\\"pln\\\">S<\/span><span class=\\\"pun\\\">)<\/span><span class=\\\"pln\\\">   AGE\nsvc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">dashboard   <\/span><span class=\\\"typ\\\">ClusterIP<\/span>   <span class=\\\"lit\\\">10.98<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">120.209<\/span>   <span class=\\\"str\\\">&lt;none&gt;<\/span>        <span class=\\\"lit\\\">443<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP   <\/span><span class=\\\"lit\\\">56s<\/span><\/pre>\n<blockquote><p>P.S. \u8fd9\u8fb9\u4f1a\u989d\u5916\u521b\u5efa\u4e00\u4e2a\u540d\u79f0\u4e3aanonymous-open-door\u00a0Cluster Role Binding\uff0c\u8fd9\u4ec5\u4f5c\u4e3a\u65b9\u4fbf\u6d4b\u8bd5\u65f6\u4f7f\u7528\uff0c\u5728\u4e00\u822c\u60c5\u51b5\u4e0b\u4e0d\u8981\u5f00\u542f\uff0c\u4e0d\u7136\u5c31\u4f1a\u76f4\u63a5\u88ab\u5b58\u53d6\u6240\u6709 API\u3002<\/p><\/blockquote>\n<p>\u5b8c\u6210\u540e\uff0c\u5c31\u53ef\u4ee5\u900f\u8fc7\u6d4f\u89c8\u5668\u8bbf\u95ee\u00a0Dashboard\uff0chttps:\/\/172.16.35.12:6443\/api\/v1\/namespaces\/kube-system\/services\/https:kubernetes-dashboard:\/proxy\/<\/p>\n<h3>Heapster addon<\/h3>\n<p><a href=\\\"https:\/\/www.kubernetes.org.cn\/932.html\\\">Heapster<\/a>\u00a0\u662f Kubernetes \u793e\u533a\u7ef4\u62a4\u7684\u5bb9\u5668\u96c6\u7fa4\u76d1\u63a7\u5206\u6790\u5de5\u5177\u3002Heapster \u4f1a\u4ece Kubernetes apiserver \u83b7\u5f97\u6240\u6709 Node \u4fe1\u606f\uff0c\u7136\u540e\u518d\u901a\u8fc7\u8fd9\u4e9b Node \u6765\u83b7\u5f97 kubelet \u4e0a\u7684\u6570\u636e\uff0c\u6700\u540e\u518d\u5c06\u6240\u6709\u6536\u96c6\u5230\u6570\u636e\u9001\u5230 Heapster \u7684\u540e\u53f0\u50a8\u5b58 InfluxDB\uff0c\u6700\u540e\u5229\u7528 Grafana \u6765\u6293\u53d6 InfluxDB \u7684\u6570\u636e\u6e90\u6765\u8fdb\u884c\u53ef\u89c6\u5316\u3002<br \/>\n\u5728master1\u901a\u8fc7 kubectl \u6765\u521b\u5efa kubernetes monitor \u5373\u53ef\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ <\/span><span class=\\\"kwd\\\">export<\/span><span class=\\\"pln\\\"> ADDON_URL<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"str\\\">\\\"https:\/\/kairen.github.io\/files\/manual-v1.8\/addon\\\"<\/span><span class=\\\"pln\\\">\n$ wget $<\/span><span class=\\\"pun\\\">{<\/span><span class=\\\"pln\\\">ADDON_URL<\/span><span class=\\\"pun\\\">}\/<\/span><span class=\\\"pln\\\">kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">monitor<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">conf <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">O kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">monitor<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl apply <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">f kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">monitor<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"pln\\\">yml\n$ kubectl <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">n kube<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">system <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> po<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\">svc\nNAME                                           READY     STATUS    RESTARTS   AGE\n<\/span><span class=\\\"pun\\\">...<\/span><span class=\\\"pln\\\">\npo<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">heapster<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">74fb5c8cdc<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">62xzc<\/span>                   <span class=\\\"lit\\\">4<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">4<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">7m<\/span><span class=\\\"pln\\\">\npo<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">influxdb<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">grafana<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">55bd7df44<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">nw4nc            <\/span><span class=\\\"lit\\\">2<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">2<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">7m<\/span><span class=\\\"pln\\\">\nNAME                       TYPE        CLUSTER<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">IP       EXTERNAL<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">IP   PORT<\/span><span class=\\\"pun\\\">(<\/span><span class=\\\"pln\\\">S<\/span><span class=\\\"pun\\\">)<\/span><span class=\\\"pln\\\">             AGE\n<\/span><span class=\\\"pun\\\">...<\/span><span class=\\\"pln\\\">\nsvc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">heapster               <\/span><span class=\\\"typ\\\">ClusterIP<\/span>   <span class=\\\"lit\\\">10.100<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">242.225<\/span>   <span class=\\\"str\\\">&lt;none&gt;<\/span>        <span class=\\\"lit\\\">80<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP              <\/span><span class=\\\"lit\\\">7m<\/span><span class=\\\"pln\\\">\nsvc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">monitoring<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">grafana     <\/span><span class=\\\"typ\\\">ClusterIP<\/span>   <span class=\\\"lit\\\">10.101<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">106.180<\/span>   <span class=\\\"str\\\">&lt;none&gt;<\/span>        <span class=\\\"lit\\\">80<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP              <\/span><span class=\\\"lit\\\">7m<\/span><span class=\\\"pln\\\">\nsvc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">monitoring<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">influxdb    <\/span><span class=\\\"typ\\\">ClusterIP<\/span>   <span class=\\\"lit\\\">10.109<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">245.142<\/span>   <span class=\\\"str\\\">&lt;none&gt;<\/span>        <span class=\\\"lit\\\">8083<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">8086<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP   <\/span><span class=\\\"lit\\\">7m<\/span>\n<span class=\\\"pun\\\">\u00b7\u00b7\u00b7<\/span><\/pre>\n<p>\u5b8c\u6210\u540e\uff0c\u5c31\u53ef\u4ee5\u900f\u8fc7\u6d4f\u89c8\u5668\u5b58\u53d6\u00a0Grafana Dashboard\uff0chttps:\/\/172.16.35.12:6443\/api\/v1\/proxy\/namespaces\/kube-system\/services\/monitoring-grafana<\/p>\n<h2>\u7b80\u5355\u90e8\u7f72 Nginx \u670d\u52a1<\/h2>\n<p>Kubernetes \u53ef\u4ee5\u9009\u62e9\u4f7f\u7528\u6307\u4ee4\u76f4\u63a5\u521b\u5efa\u5e94\u7528\u7a0b\u5e8f\u4e0e\u670d\u52a1\uff0c\u6216\u8005\u64b0\u5199 YAML \u4e0e JSON \u6863\u6848\u6765\u63cf\u8ff0\u90e8\u7f72\u5e94\u7528\u7a0b\u5e8f\u7684\u914d\u7f6e\uff0c\u4ee5\u4e0b\u5c06\u521b\u5efa\u4e00\u4e2a\u7b80\u5355\u7684 Nginx \u670d\u52a1\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl run nginx <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">image<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"pln\\\">nginx <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">port<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"lit\\\">80<\/span><span class=\\\"pln\\\">\n$ kubectl expose deploy nginx <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">port<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"lit\\\">80<\/span> <span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">type<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"typ\\\">LoadBalancer<\/span> <span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">external<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">ip<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span><span class=\\\"pln\\\">\n$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> svc<\/span><span class=\\\"pun\\\">,<\/span><span class=\\\"pln\\\">po\nNAME             TYPE           CLUSTER<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">IP      EXTERNAL<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">IP    PORT<\/span><span class=\\\"pun\\\">(<\/span><span class=\\\"pln\\\">S<\/span><span class=\\\"pun\\\">)<\/span><span class=\\\"pln\\\">        AGE\nsvc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">kubernetes   <\/span><span class=\\\"typ\\\">ClusterIP<\/span>      <span class=\\\"lit\\\">10.96<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">0.1<\/span>       <span class=\\\"str\\\">&lt;none&gt;<\/span>         <span class=\\\"lit\\\">443<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP        <\/span><span class=\\\"lit\\\">1h<\/span><span class=\\\"pln\\\">\nsvc<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">nginx        <\/span><span class=\\\"typ\\\">LoadBalancer<\/span>   <span class=\\\"lit\\\">10.97<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">121.243<\/span>   <span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span>   <span class=\\\"lit\\\">80<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">30344<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP   <\/span><span class=\\\"lit\\\">22s<\/span><span class=\\\"pln\\\">\nNAME                        READY     STATUS    RESTARTS   AGE\npo<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">nginx<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">7cbc4b4d9c<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">7796l<\/span>   <span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">28s<\/span>       <span class=\\\"lit\\\">192.160<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">57.181<\/span>   <span class=\\\"pun\\\">,<\/span><span class=\\\"lit\\\">172.16<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">35.12<\/span>   <span class=\\\"lit\\\">80<\/span><span class=\\\"pun\\\">:<\/span><span class=\\\"lit\\\">32054<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"pln\\\">TCP   <\/span><span class=\\\"lit\\\">21s<\/span><\/pre>\n<blockquote><p>\u8fd9\u8fb9type\u53ef\u4ee5\u9009\u62e9 NodePort \u4e0e LoadBalancer\uff0c\u5728\u672c\u5730\u88f8\u673a\u90e8\u7f72\uff0c\u4e24\u8005\u5dee\u5f02\u5728\u4e8eNodePort\u53ea\u6620\u5c04 Host port \u5230 Container port\uff0c\u800cLoadBalancer\u5219\u7ee7\u627fNodePort\u989d\u5916\u591a\u51fa\u6620\u5c04 Host target port \u5230 Container port\u3002<\/p><\/blockquote>\n<p>\u786e\u8ba4\u6ca1\u95ee\u9898\u540e\u5373\u53ef\u5728\u6d4f\u89c8\u5668\u5b58\u53d6\u00a0http:\/\/172.16.35.12<\/p>\n<h3>\u6269\u5c55\u670d\u52a1\u6570\u91cf<\/h3>\n<p>\u82e5\u96c6\u7fa4node\u8282\u70b9\u589e\u52a0\u4e86\uff0c\u800c\u60f3\u8ba9 Nginx \u670d\u52a1\u63d0\u4f9b\u53ef\u9760\u6027\u7684\u8bdd\uff0c\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u65b9\u5f0f\u6765\u6269\u5c55\u670d\u52a1\u7684\u526f\u672c\uff1a<\/p>\n<pre class=\\\"prettyprint\\\"><span class=\\\"pln\\\">$ kubectl scale deploy nginx <\/span><span class=\\\"pun\\\">--<\/span><span class=\\\"pln\\\">replicas<\/span><span class=\\\"pun\\\">=<\/span><span class=\\\"lit\\\">2<\/span><span class=\\\"pln\\\">\n$ kubectl <\/span><span class=\\\"kwd\\\">get<\/span><span class=\\\"pln\\\"> pods <\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">o wide\nNAME                    READY     STATUS    RESTARTS   AGE       IP             NODE\nnginx<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">158599303<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">0h9lr<\/span>   <span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">25s<\/span>       <span class=\\\"lit\\\">10.244<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">100.5<\/span><span class=\\\"pln\\\">   node2\nnginx<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"lit\\\">158599303<\/span><span class=\\\"pun\\\">-<\/span><span class=\\\"pln\\\">k7cbt   <\/span><span class=\\\"lit\\\">1<\/span><span class=\\\"pun\\\">\/<\/span><span class=\\\"lit\\\">1<\/span>       <span class=\\\"typ\\\">Running<\/span>   <span class=\\\"lit\\\">0<\/span>          <span class=\\\"lit\\\">1m<\/span>        <span class=\\\"lit\\\">10.244<\/span><span class=\\\"pun\\\">.<\/span><span class=\\\"lit\\\">24.3<\/span><span class=\\\"pln\\\">    node1<\/span><\/pre>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>\u5b89\u88c5\u7248\u672c\uff1a Kubernetes v1.8.2 Etcd v3.2.9 Calico v2.6.2 Docke &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"http:\/\/www.weijing.co\/?p=1600\"> <span class=\"screen-reader-text\">\u624b\u52a8\u5b89\u88c5Kubernetes 1.8<\/span> \u67e5\u770b\u5168\u6587 &raquo;<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":""},"categories":[104,123],"tags":[],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false,"mailpoet_newsletter_max":false,"woocommerce_thumbnail":false,"woocommerce_single":false,"woocommerce_gallery_thumbnail":false,"shop_catalog":false,"shop_single":false,"shop_thumbnail":false},"uagb_author_info":{"display_name":"weijing","author_link":"http:\/\/www.weijing.co\/?author=4"},"uagb_comment_info":0,"uagb_excerpt":"\u5b89\u88c5\u7248\u672c\uff1a Kubernetes v1.8.2 Etcd v3.2.9 Calico v2.6.2 Docke&hellip;","_links":{"self":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts\/1600"}],"collection":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1600"}],"version-history":[{"count":0,"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts\/1600\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1600"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}