• 对于注定会优秀的人来说,他所需要的,只是时间----博主
  • 手懒得,必受贫穷,手勤的,必得富足----《圣经》
  • 帮助别人,成就自己。愿君在本站能真正有所收获!
  • 如果你在本站中发现任何问题,欢迎留言指正!
  • 宝剑锋从磨砺出,梅花香自苦寒来!
  • 本站开启了防爆破关小黑屋机制,如果您是正常登录但被关进小黑屋,请联系站长解除!

<二十七>Kubernetes学习笔记-手动搭建k8s-1.10.4之部署kube-scheduler

kubernetes eryajf 9个月前 (12-09) 1466°C 已收录 0个评论
本文预计阅读时间 17 分钟

本文档介绍部署高可用 kube-scheduler 集群的步骤。

该集群包含 3 个节点,启动后将通过竞争选举机制产生一个 leader 节点,其它节点为阻塞状态。当 leader 节点不可用后,剩余节点将再次进行选举产生新的 leader 节点,从而保证服务的可用性。

为保证通信安全,本文档先生成 x509 证书和私钥,kube-scheduler 在如下两种情况下使用该证书:

  • 与 kube-apiserver 的安全端口通信;
  • 在安全端口(https,10251) 输出 prometheus 格式的 metrics;

配置之前需要先安装kubelet,flannel等组件,不过前边已经安装,现在直接进入配置。

1,创建 kube-scheduler 证书和私钥

创建证书签名请求:

cat > kube-scheduler-csr.json <<EOF
{
    "CN": "system:kube-scheduler",
    "hosts": [
      "127.0.0.1",
      "192.168.106.3",
      "192.168.106.4",
      "192.168.106.5"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
      {
        "C": "CN",
        "ST": "BeiJing",
        "L": "BeiJing",
        "O": "system:kube-scheduler",
        "OU": "4Paradigm"
      }
    ]
}
EOF
  • hosts 列表包含所有 kube-scheduler 节点 IP;
  • CN 为 system:kube-scheduler、O 为 system:kube-scheduler,kubernetes 内置的 ClusterRoleBindings system:kube-scheduler 将赋予 kube-scheduler 工作所需的权限。

生成证书和私钥:

$cfssl gencert -ca=/etc/kubernetes/cert/ca.pem \
  -ca-key=/etc/kubernetes/cert/ca-key.pem \
  -config=/etc/kubernetes/cert/ca-config.json \
  -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

2,创建和分发 kubeconfig 文件

kubeconfig 文件包含访问 apiserver 的所有信息,如 apiserver 地址、CA 证书和自身使用的证书;

$source /opt/k8s/bin/environment.sh

$kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/cert/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-scheduler.kubeconfig

$kubectl config set-credentials system:kube-scheduler \
  --client-certificate=kube-scheduler.pem \
  --client-key=kube-scheduler-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-scheduler.kubeconfig

$kubectl config set-context system:kube-scheduler \
  --cluster=kubernetes \
  --user=system:kube-scheduler \
  --kubeconfig=kube-scheduler.kubeconfig

$kubectl config use-context system:kube-scheduler --kubeconfig=kube-scheduler.kubeconfig
  • 上一步创建的证书、私钥以及 kube-apiserver 地址被写入到 kubeconfig 文件中;

分发 kubeconfig 到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash

source /opt/k8s/bin/environment.sh

for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}" 
    scp kube-scheduler.kubeconfig k8s@${node_ip}:/etc/kubernetes/
done
EOF

3,创建和分发 kube-scheduler systemd unit 文件

cat > kube-scheduler.service <<EOF
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
ExecStart=/opt/k8s/bin/kube-scheduler \\
  --address=127.0.0.1 \\
  --kubeconfig=/etc/kubernetes/kube-scheduler.kubeconfig \\
  --leader-elect=true \\
  --alsologtostderr=true \\
  --logtostderr=false \\
  --log-dir=/var/log/kubernetes \\
  --v=2
Restart=on-failure
RestartSec=5
User=k8s

[Install]
WantedBy=multi-user.target
EOF
  • --address:在 127.0.0.1:10251 端口接收 http /metrics 请求;kube-scheduler 目前还不支持接收 https 请求;
  • --kubeconfig:指定 kubeconfig 文件路径,kube-scheduler 使用它连接和验证 kube-apiserver;
  • --leader-elect=true:集群运行模式,启用选举功能;被选为 leader 的节点负责处理工作,其它节点为阻塞状态;
  • User=k8s:使用 k8s 账户运行;

分发 systemd unit 文件到所有 master 节点:

cat > magic.sh << "EOF"
#!/bin/bash

source /opt/k8s/bin/environment.sh

for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}" 
    scp kube-scheduler.service root@${node_ip}:/etc/systemd/system/
done
EOF

4,启动 kube-scheduler 服务

cat > magic.sh << "EOF"
#!/bin/bash

source /opt/k8s/bin/environment.sh

for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}" 
    ssh root@${node_ip} "mkdir -p /var/log/kubernetes && chown -R k8s /var/log/kubernetes"
    ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kube-scheduler && systemctl start kube-scheduler"
done
EOF

5,检查服务运行状态

cat > magic.sh << "EOF"
#!/bin/bash

source /opt/k8s/bin/environment.sh

for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}" 
    ssh k8s@${node_ip} "systemctl status kube-scheduler|grep Active"
done
EOF

如果看到如下输出:

$bash magic.sh
>>> 192.168.106.3
   Active: active (running) since Fri 2018-11-23 18:31:30 CST; 6h ago
>>> 192.168.106.4
   Active: active (running) since Fri 2018-11-23 18:29:32 CST; 6h ago
>>> 192.168.106.5
   Active: active (running) since Fri 2018-11-23 18:29:32 CST; 6h ago

则正常,如果失败,看日志:

journalctl -xu kube-scheduler

5,查看输出的 metric

注意:以下命令在 kube-scheduler 节点上执行。

kube-scheduler 监听 10251 端口,接收 http 请求:

$sudo netstat -lnpt|grep kube-sche
tcp        0      0 127.0.0.1:10251         0.0.0.0:*               LISTEN      15377/kube-schedule
$curl -s http://127.0.0.1:10251/metrics |head
# HELP apiserver_audit_event_total Counter of audit events generated and sent to the audit backend.
# TYPE apiserver_audit_event_total counter
apiserver_audit_event_total 0
# HELP go_gc_duration_seconds A summary of the GC invocation durations.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 6.3423e-05
go_gc_duration_seconds{quantile="0.25"} 0.000120079
go_gc_duration_seconds{quantile="0.5"} 0.000146495
go_gc_duration_seconds{quantile="0.75"} 0.000174475
go_gc_duration_seconds{quantile="1"} 0.001807813

6,查看当前的 leader

$kubectl get endpoints kube-scheduler --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"kube-node2_aa57b017-ef0a-11e8-aaf2-5254001a681e","leaseDurationSeconds":15,"acquireTime":"2018-11-23T10:31:09Z","renewTime":"2018-11-23T17:05:31Z","leaderTransitions":1}'
  creationTimestamp: 2018-11-23T10:29:32Z
  name: kube-scheduler
  namespace: kube-system
  resourceVersion: "30835"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-scheduler
  uid: aabb2233-ef0a-11e8-9670-525400c7ba97

可见,当前的 leader 为 kube-node2 节点。

7,测试 kube-scheduler 集群的高可用

随便找一个或两个 master 节点,停掉 kube-scheduler 服务,看其它节点是否获取了 leader 权限(systemd 日志)。

现在就去停掉kube-node2上的kube-scheduler 服务。

$systemctl stop kube-scheduler

$systemctl status kube-scheduler | grep Active
   Active: inactive (dead) since Sat 2018-11-24 01:06:40 CST; 14s ago

然后再来查看一下现在的leader是谁:

$kubectl get endpoints kube-scheduler --namespace=kube-system  -o yaml
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"kube-node3_aa9017f9-ef0a-11e8-b73d-525400b42484","leaseDurationSeconds":15,"acquireTime":"2018-11-23T17:06:57Z","renewTime":"2018-11-23T17:07:31Z","leaderTransitions":2}'
  creationTimestamp: 2018-11-23T10:29:32Z
  name: kube-scheduler
  namespace: kube-system
  resourceVersion: "30984"
  selfLink: /api/v1/namespaces/kube-system/endpoints/kube-scheduler
  uid: aabb2233-ef0a-11e8-9670-525400c7ba97

可以看到,已经漂移到了kube-node3上去了。


weinxin
扫码订阅本站,第一时间获得更新
微信扫描二维码,订阅我们网站的动态,另外不定时发送WordPress小技巧,你可以随时退订,欢迎订阅哦~

二丫讲梵 , 版权所有丨如未注明 , 均为原创丨本网站采用BY-NC-SA协议进行授权 , 转载请注明<二十七>Kubernetes学习笔记-手动搭建k8s-1.10.4之部署kube-scheduler
喜欢 (1)
[如果想支持本站,可支付宝赞助]
分享 (0)
eryajf
关于作者:
学无止境,我愿意无止境学。书山有路,我愿意举身投火,淬炼成金!

您必须 登录 才能发表评论!