06-3.部署高可用 kube-controller-manager 集群

    该集群包含 3 个节点，启动后将通过竞争选举机制产生一个 leader 节点，其它节点为阻塞状态。当 leader 节点不可用时，阻塞的节点将再次进行选举产生新的 leader 节点，从而保证服务的可用性。

    为保证通信安全，本文档先生成 x509 证书和私钥，kube-controller-manager 在如下两种情况下使用该证书：

    1. 与 kube-apiserver 的安全端口通信;
    2. 在安全端口(https，10252) 输出 prometheus 格式的 metrics；

    注意：如果没有特殊指明，本文档的所有操作均在 zhangjun-k8s01 节点上执行，然后远程分发文件和执行命令。

    下载最新版本的二进制文件、安装和配置 flanneld 参考：06-1.部署master节点.md。

    创建 kube-controller-manager 证书和私钥

    创建证书签名请求：

    • hosts 列表包含所有 kube-controller-manager 节点 IP；
    • CN 和 O 均为 ，kubernetes 内置的 ClusterRoleBindings system:kube-controller-manager 赋予 kube-controller-manager 工作所需的权限。
    1. cd /opt/k8s/work
    2. cfssl gencert -ca=/opt/k8s/work/ca.pem \
    3.   -ca-key=/opt/k8s/work/ca-key.pem \
    4.   -config=/opt/k8s/work/ca-config.json \
    5.   -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager
    6. ls kube-controller-manager*pem

    将生成的证书和私钥分发到所有 master 节点：

    1. cd /opt/k8s/work
    2. source /opt/k8s/bin/environment.sh
    3. for node_ip in ${NODE_IPS[@]}
    4.   do
    5.     echo ">>> ${node_ip}"
    6.     scp kube-controller-manager*.pem root@${node_ip}:/etc/kubernetes/cert/
    7.   done

    创建和分发 kubeconfig 文件

    kube-controller-manager 使用 kubeconfig 文件访问 apiserver，该文件提供了 apiserver 地址、嵌入的 CA 证书和 kube-controller-manager 证书：

    1. cd /opt/k8s/work
    2. source /opt/k8s/bin/environment.sh
    3. kubectl config set-cluster kubernetes \
    4.   --certificate-authority=/opt/k8s/work/ca.pem \
    5.   --embed-certs=true \
    6.   --server=${KUBE_APISERVER} \
    7.   --kubeconfig=kube-controller-manager.kubeconfig
    9. kubectl config set-credentials system:kube-controller-manager \
    10.   --client-certificate=kube-controller-manager.pem \
    11.   --client-key=kube-controller-manager-key.pem \
    12.   --embed-certs=true \
    13.   --kubeconfig=kube-controller-manager.kubeconfig
    15. kubectl config set-context system:kube-controller-manager \
    16.   --cluster=kubernetes \
    17.   --user=system:kube-controller-manager \
    18.   --kubeconfig=kube-controller-manager.kubeconfig
    20. kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig

    分发 kubeconfig 到所有 master 节点：

    1. cd /opt/k8s/work
    2. source /opt/k8s/bin/environment.sh
    3. for node_ip in ${NODE_IPS[@]}
    4.   do
    5.     echo ">>> ${node_ip}"
    6.     scp kube-controller-manager.kubeconfig root@${node_ip}:/etc/kubernetes/
    7.   done

    创建 kube-controller-manager systemd unit 模板文件

    • --secure-port=10252、--bind-address=0.0.0.0: 在所有网络接口监听 10252 端口的 https /metrics 请求；
    • --kubeconfig：指定 kubeconfig 文件路径，kube-controller-manager 使用它连接和验证 kube-apiserver；
    • --authentication-kubeconfig 和 --authorization-kubeconfig：kube-controller-manager 使用它连接 apiserver，对 client 的请求进行认证和授权。kube-controller-manager 不再使用 --tls-ca-file 对请求 https metrics 的 Client 证书进行校验。如果没有配置这两个 kubeconfig 参数，则 client 连接 kube-controller-manager https 端口的请求会被拒绝(提示权限不足)。
    • --cluster-signing-*-file：签名 TLS Bootstrap 创建的证书；
    • --experimental-cluster-signing-duration：指定 TLS Bootstrap 证书的有效期；
    • ：放置到容器 ServiceAccount 中的 CA 证书，用来对 kube-apiserver 的证书进行校验；
    • --service-account-private-key-file：签名 ServiceAccount 中 Token 的私钥文件，必须和 kube-apiserver 的 --service-account-key-file 指定的公钥文件配对使用；
    • --service-cluster-ip-range ：指定 Service Cluster IP 网段，必须和 kube-apiserver 中的同名参数一致；
    • --leader-elect=true：集群运行模式，启用选举功能；被选为 leader 的节点负责处理工作，其它节点为阻塞状态；
    • --controllers=*,bootstrapsigner,tokencleaner：启用的控制器列表，tokencleaner 用于自动清理过期的 Bootstrap token；
    • --horizontal-pod-autoscaler-*：custom metrics 相关参数，支持 autoscaling/v2alpha1；
    • --tls-cert-file、--tls-private-key-file：使用 https 输出 metrics 时使用的 Server 证书和秘钥；
    • --use-service-account-credentials=true: kube-controller-manager 中各 controller 使用 serviceaccount 访问 kube-apiserver；

    替换模板文件中的变量，为各节点创建 systemd unit 文件：

    1. cd /opt/k8s/work
    2. source /opt/k8s/bin/environment.sh
    3. for (( i=0; i < 3; i++ ))
    4.   do
    5.     sed -e "s/##NODE_NAME##/${NODE_NAMES[i]}/" -e "s/##NODE_IP##/${NODE_IPS[i]}/" kube-controller-manager.service.template > kube-controller-manager-${NODE_IPS[i]}.service 
    6.   done
    7. ls kube-controller-manager*.service
    • NODE_NAMES 和 NODE_IPS 为相同长度的 bash 数组，分别为节点名称和对应的 IP；

    分发到所有 master 节点：

    1. cd /opt/k8s/work
    2. source /opt/k8s/bin/environment.sh
    3. for node_ip in ${NODE_IPS[@]}
    4.   do
    5.     echo ">>> ${node_ip}"
    6.     scp kube-controller-manager-${node_ip}.service root@${node_ip}:/etc/systemd/system/kube-controller-manager.service
    7.   done
    • 文件重命名为 kube-controller-manager.service;

    启动 kube-controller-manager 服务

    1. source /opt/k8s/bin/environment.sh
    2. for node_ip in ${NODE_IPS[@]}
    3.   do
    4.     echo ">>> ${node_ip}"
    5.     ssh root@${node_ip} "mkdir -p ${K8S_DIR}/kube-controller-manager"
    6.     ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl restart kube-controller-manager"
    7.   done
    • 启动服务前必须先创建工作目录；

    检查服务运行状态

    1. source /opt/k8s/bin/environment.sh
    2. for node_ip in ${NODE_IPS[@]}
    3.   do
    4.     echo ">>> ${node_ip}"
    5.     ssh root@${node_ip} "systemctl status kube-controller-manager|grep Active"
    6.   done

    kube-controller-manager 监听 10252 端口，接收 https 请求：

    1. $ sudo netstat -lnpt | grep kube-cont
    2. tcp        0      0 172.27.137.240:10252    0.0.0.0:*               LISTEN      108977/kube-control

    查看输出的 metrics

    注意：以下命令在 kube-controller-manager 节点上执行。

    1. $ curl -s --cacert /opt/k8s/work/ca.pem --cert /opt/k8s/work/admin.pem --key /opt/k8s/work/admin-key.pem https://172.27.137.240:10252/metrics |head
    2. # HELP ClusterRoleAggregator_adds (Deprecated) Total number of adds handled by workqueue: ClusterRoleAggregator
    3. # TYPE ClusterRoleAggregator_adds counter
    4. ClusterRoleAggregator_adds 3
    5. # HELP ClusterRoleAggregator_depth (Deprecated) Current depth of workqueue: ClusterRoleAggregator
    6. # TYPE ClusterRoleAggregator_depth gauge
    7. ClusterRoleAggregator_depth 0
    8. # HELP ClusterRoleAggregator_longest_running_processor_microseconds (Deprecated) How many microseconds has the longest running processor for ClusterRoleAggregator been running.
    9. # TYPE ClusterRoleAggregator_longest_running_processor_microseconds gauge
    10. ClusterRoleAggregator_longest_running_processor_microseconds 0
    11. # HELP ClusterRoleAggregator_queue_latency (Deprecated) How long an item stays in workqueueClusterRoleAggregator before being requested.

    ClusteRole system:kube-controller-manager 的权限很小，只能创建 secret、serviceaccount 等资源对象，各 controller 的权限分散到 ClusterRole system:controller:XXX 中：

    2. Labels:       kubernetes.io/bootstrapping=rbac-defaults
    3. Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
    4. PolicyRule:
    5.   Resources                                  Non-Resource URLs  Resource Names  Verbs
    6.   ---------                                  -----------------  --------------  -----
    7.   secrets                                    []                 []              [create delete get update]
    8.   endpoints                                  []                 []              [create get update]
    9.   serviceaccounts                            []                 []              [create get update]
    10.   events                                     []                 []              [create patch update]
    11.   tokenreviews.authentication.k8s.io         []                 []              [create]
    12.   subjectaccessreviews.authorization.k8s.io  []                 []              [create]
    13.   configmaps                                 []                 []              [get]
    14.   namespaces                                 []                 []              [get]
    15.   *.*                                        []                 []              [list watch]

    需要在 kube-controller-manager 的启动参数中添加 --use-service-account-credentials=true 参数，这样 main controller 会为各 controller 创建对应的 ServiceAccount XXX-controller。内置的 ClusterRoleBinding system:controller:XXX 将赋予各 XXX-controller ServiceAccount 对应的 ClusterRole system:controller:XXX 权限。

    1. $ kubectl get clusterrole|grep controller
    2. system:controller:attachdetach-controller                              51m
    3. system:controller:certificate-controller                               51m
    4. system:controller:clusterrole-aggregation-controller                   51m
    5. system:controller:cronjob-controller                                   51m
    6. system:controller:daemon-set-controller                                51m
    7. system:controller:deployment-controller                                51m
    8. system:controller:disruption-controller                                51m
    9. system:controller:endpoint-controller                                  51m
    10. system:controller:expand-controller                                    51m
    11. system:controller:generic-garbage-collector                            51m
    12. system:controller:horizontal-pod-autoscaler                            51m
    13. system:controller:job-controller                                       51m
    14. system:controller:namespace-controller                                 51m
    15. system:controller:node-controller                                      51m
    16. system:controller:persistent-volume-binder                             51m
    17. system:controller:pod-garbage-collector                                51m
    18. system:controller:pv-protection-controller                             51m
    19. system:controller:pvc-protection-controller                            51m
    20. system:controller:replicaset-controller                                51m
    21. system:controller:replication-controller                               51m
    22. system:controller:resourcequota-controller                             51m
    23. system:controller:route-controller                                     51m
    24. system:controller:service-account-controller                           51m
    25. system:controller:service-controller                                   51m
    26. system:controller:statefulset-controller                               51m
    27. system:controller:ttl-controller                                       51m
    28. system:kube-controller-manager                                         51m

    以 deployment controller 为例：

    查看当前的 leader

    1. $ kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
    2. apiVersion: v1
    3. kind: Endpoints
    4. metadata:
    5.   annotations:
    6.     control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"zhangjun-k8s01_6537b938-7f5a-11e9-8487-00220d338975","leaseDurationSeconds":15,"acquireTime":"2019-05-26T02:03:18Z","renewTime":"2019-05-26T02:06:08Z","leaderTransitions":1}'
    7.   creationTimestamp: "2019-05-26T01:52:39Z"
    8.   name: kube-controller-manager
    9.   namespace: kube-system
    10.   resourceVersion: "1965"
    12.   uid: f1755fc5-7f58-11e9-b4c4-00220d338975

    测试 kube-controller-manager 集群的高可用

    停掉一个或两个节点的 kube-controller-manager 服务，观察其它节点的日志，看是否获取了 leader 权限。

    参考

    1. 关于 controller 权限和 use-service-account-credentials 参数：https://github.com/kubernetes/kubernetes/issues/48208