《蹲坑学kubernetes》之9-6：安装部署kube-controller-manager

[root@k8s-master ~]# cd /usr/local/kubernetes/ssl/
[root@k8s-master ssl]# vimkube-controller-manager-csr.json
添加：
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST":"BeiJing",
            "O": "system:kube-controller-manager",
            "OU":"kubernetes"
        }
    ]
}

[root@k8s-master ssl]# cfssl gencert-ca=/usr/local/kubernetes/ssl/ca.pem-ca-key=/usr/local/kubernetes/ssl/ca-key.pem-config=/usr/local/kubernetes/ssl/ca-config.json -profile=kubernetes/usr/local/kubernetes/ssl/kube-controller-manager-csr.json  | cfssljson -bare kube-controller-manager

[root@k8s-master ~]# vim/usr/local/kubernetes/conf/evn-controller-manager.kubeconfig.sh
添加：
# 设置集群参数
kubectl config set-cluster kubernetes \
    --certificate-authority=/usr/local/kubernetes/ssl/ca.pem \
    --embed-certs=true \
    --server=https://192.168.1.3:6443 \
     --kubeconfig=/usr/local/kubernetes/conf/controller-manager.kubeconfig
# 设置客户端认证参数
kubectl config set-credentialssystem:kube-controller-manager \
    --client-certificate=/usr/local/kubernetes/ssl/kube-controller-manager.pem\
    --client-key=/usr/local/kubernetes/ssl/kube-controller-manager-key.pem \
    --embed-certs=true \
    --kubeconfig=/usr/local/kubernetes/conf/controller-manager.kubeconfig
# 设置上下文参数
kubectl config set-context default \
    --cluster=kubernetes \
     --user=system:kube-controller-manager\
    --kubeconfig=/usr/local/kubernetes/conf/controller-manager.kubeconfig
#设置默认上下文
kubectl config use-context default \
    --kubeconfig=/usr/local/kubernetes/conf/controller-manager.kubeconfig
 
[root@k8s-master ~]# chmod +x/usr/local/kubernetes/conf/evn-controller-manager.kubeconfig.sh
[root@k8s-master ~]#/usr/local/kubernetes/conf/evn-controller-manager.kubeconfig.sh

[root@k8s-master ~]# vim/usr/local/kubernetes/conf/kube-controller-manager
添加：
KUBE_CONTROLLER_MANAGER_OPTS="--v=2\
      --logtostderr=true \
      --address=127.0.0.1 \
      --master=https://192.168.1.3:6443
      --service-cluster-ip-range=10.0.0.0/12
      --cluster-name=kubernetes
     --root-ca-file=/usr/local/kubernetes/ssl/ca.pem \
     --cluster-signing-cert-file=/usr/local/kubernetes/ssl/ca.pem \
     --cluster-signing-key-file=/usr/local/kubernetes/ssl/ca-key.pem \
     --service-account-private-key-file=/usr/local/kubernetes/ssl/sa.key \
     --kubeconfig=/usr/local/kubernetes/conf/controller-manager.kubeconfig \
      --leader-elect=true \
      --use-service-account-credentials=true \
      --node-monitor-grace-period=40s \
      --node-monitor-period=5s \
      --pod-eviction-timeout=2m0s \
     --controllers=*,bootstrapsigner,tokencleaner \
      --allocate-node-cidrs=true \
      --cluster-cidr=10.244.0.0/16 \
     --requestheader-client-ca-file=/usr/local/kubernetes/ssl/ca.pem \
      --node-cidr-mask-size=24"

[root@k8s-master ~]# vim/usr/lib/systemd/system/kube-controller-manager.service
添加：
[Unit]
Description=KubernetesController Manager
Documentation=https://github.com/kubernetes/kubernetes
 
[Service]
EnvironmentFile=-/usr/local/kubernetes/conf/kube-controller-manager
ExecStart=/usr/local/kubernetes/bin/kube-controller-manager$KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure
 
[Install]
WantedBy=multi-user.target

[root@k8s-master ~]# systemctl enablekube-controller-manager
[root@k8s-master ~]# systemctl startkube-controller-manager

[root@k8s-master ~]# systemctl status kube-controller-manager

[root@k8s-master ~]# ps -elf | grep kube-controll

[root@k8s-master ~]# netstat -anpt | grep kube-control