再战 k8s（十八）：RKE
RKE 簡(jiǎn)介
Rancher Kubernetes Engine，簡(jiǎn)稱(chēng) RKE，是一個(gè)經(jīng)過(guò) CNCF 認(rèn)證的 Kubernetes 安裝程序。RKE 支持多種操作系統(tǒng)，包括 MacOS、Linux 和 Windows，可以在裸金屬服務(wù)器（BMS）和虛擬服務(wù)器（Virtualized Server）上運(yùn)行。
市面上的其他 Kubernetes 部署工具存在一個(gè)共性問(wèn)題：在使用工具之前需要滿(mǎn)足的先決條件比較多，例如，在使用工具前需要完成安裝 kubelet、配置網(wǎng)絡(luò)等一系列的繁瑣操作。而 RKE 簡(jiǎn)化了部署 Kubernetes 集群的過(guò)程，只有一個(gè)先決條件：只要您使用的 Docker 是 RKE 支持的版本，就可以通過(guò) RKE 安裝 Kubernetes，部署和運(yùn)行 Kubernetes 集群。RKE 既可以單獨(dú)使用，作為創(chuàng)建 Kubernetes 集群的工具，也可以配合 Rancher2.x 使用，作為 Rancher2.x 的組件，在 Rancher 中部署和運(yùn)行 Kubernetes 集群。
創(chuàng)建集群配置文件
RKE 使用集群配置文件cluster.yml規(guī)劃集群中的節(jié)點(diǎn)，例如集群中應(yīng)該包含哪些節(jié)點(diǎn)，如何部署 Kubernetes。您可以通過(guò)該文件修改很多集群配置選項(xiàng)。在 RKE 的文檔中，我們提供的代碼示例假設(shè)集群中只有一個(gè)節(jié)點(diǎn)。
創(chuàng)建集群配置文件cluster.yml的方式有兩種：
- 使用 minimal cluster.yml創(chuàng)建集群配置文件，然后將您使用的節(jié)點(diǎn)的相關(guān)信息添加到文件中。
- 使用rke config命令創(chuàng)建集群配置文件，然后將集群參數(shù)逐個(gè)輸入到該文件中。
使用rke config
運(yùn)行rke config命令，在當(dāng)前路徑下創(chuàng)建 cluster.yml文件。這條命令會(huì)引導(dǎo)您輸入創(chuàng)建集群所需的所有參數(shù)，詳情請(qǐng)參考集群配置選項(xiàng)。
rke config --name cluster.yml
其他配置選項(xiàng)
在原有創(chuàng)建集群配置文件命令的基礎(chǔ)上，加上 --empty ，可以創(chuàng)建一個(gè)空白的集群配置文件。
rke config --empty --name cluster.yml
您也可以使用--print，將cluster.yml文件的內(nèi)容顯示出來(lái)。
rke config --print
高可用集群
RKE 適配了高可用集群，您可以在cluster.yml文件中配置多個(gè)controlplane節(jié)點(diǎn)。RKE 會(huì)把 master 節(jié)點(diǎn)的組件部署在所有被列為controlplane的節(jié)點(diǎn)上，同時(shí)把 kubelets 的默認(rèn)連接地址配置為127.0.0.1:6443。這個(gè)地址是nginx-proxy請(qǐng)求所有 master 節(jié)點(diǎn)的地址
創(chuàng)建高可用集群需要指定兩個(gè)或更多的節(jié)點(diǎn)作為controlplane。
證書(shū)
v0.2.0 開(kāi)始可用
默認(rèn)情況下，Kubernetes 集群需要用到證書(shū)，而 RKE 會(huì)自動(dòng)為所有集群組件生成證書(shū)。您也可以使用自定義證書(shū)。部署集群后，您可以管理這些自動(dòng)生成的證書(shū)，詳情請(qǐng)參考管理自動(dòng)生成的證書(shū)。
使用 RKE 部署 Kubernetes 集群
創(chuàng)建了cluster.yml文件后，您可以運(yùn)行以下命令部署集群。這條命令默認(rèn)cluster.yml已經(jīng)保存在了您運(yùn)行命令所處的路徑下。
rke up
INFO[0000] Building Kubernetes cluster
INFO[0000] [dialer] Setup tunnel *for* host [10.0.0.1]
INFO[0000] [network] Deploying port listener containers
INFO[0000] [network] Pulling image [alpine:latest] on host [10.0.0.1]
...
INFO[0101] Finished building Kubernetes cluster successfully
運(yùn)行該命令后，返回的最后一行信息應(yīng)該是Finished building Kubernetes cluster successfully，表示成功部署集群，可以開(kāi)始使用集群。在創(chuàng)建 Kubernetes 集群的過(guò)程中，會(huì)創(chuàng)建一個(gè)kubeconfig 文件，它的文件名稱(chēng)是 kube_config_cluster.yml，您可以使用它控制 Kubernetes 集群。
說(shuō)明
如果您之前使用的集群配置文件名稱(chēng)不是cluster.yml，那么這里生成的 kube_config 文件的名稱(chēng)也會(huì)隨之變化為kube_config*<FILE_NAME>.yml。
保存文件#
重要
請(qǐng)保存下文中列出來(lái)的所有文件，這些文件可以用于維護(hù)集群，排查問(wèn)題和升級(jí)集群。
請(qǐng)將這些文件復(fù)制并保存到安全的位置：
- cluster.yml：RKE 集群的配置文件。
- kube_config_cluster.yml：該集群的Kubeconfig 文件包含了獲取該集群所有權(quán)限的認(rèn)證憑據(jù)。
- cluster.rkestate：Kubernetes 集群狀態(tài)文件，包含了獲取該集群所有權(quán)限的認(rèn)證憑據(jù)，使用 RKE v0.2.0 時(shí)才會(huì)創(chuàng)建這個(gè)文件。
說(shuō)明
kube_config_cluster.yml和cluster.rkestate兩個(gè)文件的名稱(chēng)取決于您如何命名 RKE 集群配置文件，如果您修改的集群配置文件的名稱(chēng)，那么后兩個(gè)文件的名稱(chēng)可能會(huì)跟上面列出來(lái)的文件名稱(chēng)不一樣。
Kubernetes 集群狀態(tài)文件#
Kubernetes 集群狀態(tài)文件用集群配置文件cluster.yml以及集群中的組件證書(shū)組成。不同版本的 RKE 會(huì)將文件保存在不同的地方。
v0.2.0 以及更新版本的 RKE 會(huì)在保存集群配置文件 cluster.yml的路徑下創(chuàng)建一個(gè).rkestate文件。該文件包含當(dāng)前集群的狀態(tài)、RKE 配置信息和證書(shū)信息。請(qǐng)妥善保存該文件的副本。
v0.2.0 之前的版本的 RKE 會(huì)將集群狀態(tài)存儲(chǔ)以密文的形式存儲(chǔ)。更新集群狀態(tài)時(shí)，RKE 拉取這些密文，修改集群狀態(tài)，然后將新的集群狀態(tài)再次存儲(chǔ)為密文。
相關(guān)操作#
完成 RKE 安裝后，可能還需要完成以下兩個(gè)相關(guān)操作：
- 管理證書(shū)
- 添加或移除節(jié)點(diǎn)
cluster.yml 文件示例
您可通過(guò)編輯 RKE 的集群配置文件cluster.yml，完成多種配置選項(xiàng)。以下是最小文件示例和完整文件示例。
**說(shuō)明：**如果您使用的是 Rancher v2.0.5 或 v2.0.6，使用集群配置文件，配置集群選項(xiàng)時(shí)，服務(wù)名稱(chēng)不能含有除了英文字母和下劃線(xiàn)外的其他字符。
最小文件示例#
nodes:
- address: 1.2.3.4
? user: ubuntu
? role:
? - controlplane
? - etcd
? - worker
完整文件示例#
nodes:
- address: 1.1.1.1
? user: ubuntu
? role:
? - controlplane
? - etcd
? port: 2222
? docker_socket: /var/run/docker.sock
? - address: 2.2.2.2
? user: ubuntu
? role:
? - worker
? ssh_key_path: /home/user/.ssh/id_rsa
? ssh_key: |-
? -----BEGIN RSA PRIVATE KEY-----
? -----END RSA PRIVATE KEY-----
? ssh_cert_path: /home/user/.ssh/test-key-cert.pub
? ssh_cert: |-
? ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3Bl…
? - address: example.com
? user: ubuntu
? role:
? - worker
? hostname_override: node3
? internal_address: 192.168.1.6
? labels:
? app: ingress
? taints:
? - key: test-key
? value: test-value
? effect: NoSchedule
# If set to true, RKE will not fail when unsupported Docker version
# are found
ignore_docker_version: false
# Enable running cri-dockerd
# Up to Kubernetes 1.23, kubelet contained code called dockershim
# to support Docker runtime. The replacement is called cri-dockerd
# and should be enabled if you want to keep using Docker as your
# container runtime
# Only available to enable in Kubernetes 1.21 and higher
enable_cri_dockerd: true
# Cluster level SSH private key
# Used if no ssh information is set for the node
ssh_key_path: ~/.ssh/test
# Enable use of SSH agent to use SSH private keys with passphrase
# This requires the environment SSH_AUTH_SOCK configured pointing
#to your SSH agent which has the private key added
ssh_agent_auth: true
# List of registry credentials
# If you are using a Docker Hub registry, you can omit the url
# or set it to docker.io
# is_default set to true will override the system default
# registry set in the global settings
private_registries:
? - url: registry.com
? user: Username
? password: password
? is_default: true
# Bastion/Jump host configuration
bastion_host:
? address: x.x.x.x
? user: ubuntu
? port: 22
? ssh_key_path: /home/user/.ssh/bastion_rsa
# or
# ssh_key: |-
# -----BEGIN RSA PRIVATE KEY-----
#
# -----END RSA PRIVATE KEY-----
# Set the name of the Kubernetes cluster
cluster_name: mycluster
# The Kubernetes version used. The default versions of Kubernetes
# are tied to specific versions of the system images.
#
# For RKE v0.2.x and below, the map of Kubernetes versions and their system images is
# located here:
# https://github.com/rancher/types/blob/release/v2.2/apis/management.cattle.io/v3/k8s_defaults.go
#
# For RKE v0.3.0 and above, the map of Kubernetes versions and their system images is
# located here:
# https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_rke_system_images.go
#
# In case the kubernetes_version and kubernetes image in
# system_images are defined, the system_images configuration
# will take precedence over kubernetes_version.
kubernetes_version: v1.10.3-rancher2
# System Images are defaulted to a tag that is mapped to a specific
# Kubernetes Version and not required in a cluster.yml.
# Each individual system image can be specified if you want to use a different tag.
#
# For RKE v0.2.x and below, the map of Kubernetes versions and their system images is
# located here:
# https://github.com/rancher/types/blob/release/v2.2/apis/management.cattle.io/v3/k8s_defaults.go
#
# For RKE v0.3.0 and above, the map of Kubernetes versions and their system images is
# located here:
# https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_rke_system_images.go
#
system_images:
? kubernetes: rancher/hyperkube:v1.10.3-rancher2
? etcd: rancher/coreos-etcd:v3.1.12
? alpine: rancher/rke-tools:v0.1.9
? nginx_proxy: rancher/rke-tools:v0.1.9
? cert_downloader: rancher/rke-tools:v0.1.9
? kubernetes_services_sidecar: rancher/rke-tools:v0.1.9
? kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.8
? dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.8
? kubedns_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.8
? kubedns_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0
? pod_infra_container: rancher/pause-amd64:3.1
services:
? etcd:
? # Custom uid/guid for etcd directory and files
? uid: 52034
? gid: 52034
? # if external etcd is used
? # path: /etcdcluster
? # external_urls:
? # - https://etcd-example.com:2379
? # ca_cert: |-
? # -----BEGIN CERTIFICATE-----
? # xxxxxxxxxx
? # -----END CERTIFICATE-----
? # cert: |-
? # -----BEGIN CERTIFICATE-----
? # xxxxxxxxxx
? # -----END CERTIFICATE-----
? # key: |-
? # -----BEGIN PRIVATE KEY-----
? # xxxxxxxxxx
? # -----END PRIVATE KEY-----
? # Note for Rancher v2.0.5 and v2.0.6 users: If you are configuring
? # Cluster Options using a Config File when creating Rancher Launched
? # Kubernetes, the names of services should contain underscores
? # only: kube_api.
? kube-api:
? # IP range for any services created on Kubernetes
? # This must match the service_cluster_ip_range in kube-controller
? service_cluster_ip_range: 10.43.0.0/16
? # Expose a different port range for NodePort services
? service_node_port_range: 30000-32767
? pod_security_policy: false
? # Encrypt secret data at Rest
? # Available as of v0.3.1
? secrets_encryption_config:
? enabled: true
? custom_config:
? apiVersion: apiserver.config.k8s.io/v1
? kind: EncryptionConfiguration
? resources:
? - resources:
? - secrets
? providers:
? - aescbc:
? keys:
? - name: k-fw5hn
? secret: RTczRjFDODMwQzAyMDVBREU4NDJBMUZFNDhCNzM5N0I=
? - identity: {}
? # Enable audit logging
? # Available as of v1.0.0
? audit_log:
? enabled: true
? configuration:
? max_age: 6
? max_backup: 6
? max_size: 110
? path: /var/log/kube-audit/audit-log.json
? format: json
? policy:
? apiVersion: audit.k8s.io/v1 # This is required.
? kind: Policy
? omitStages:
? - “RequestReceived”
? rules:
? # Log pod changes at RequestResponse level
? - level: RequestResponse
? resources:
? - group: “”
? # Resource “pods” doesn’t match requests to any subresource of pods,
? # which is consistent with the RBAC policy.
? resources: [“pods”]
? # Using the EventRateLimit admission control enforces a limit on the number of events
? # that the API Server will accept in a given time period
? # Available as of v1.0.0
? event_rate_limit:
? enabled: true
? configuration:
? apiVersion: eventratelimit.admission.k8s.io/v1alpha1
? kind: Configuration
? limits:
? - type: Server
? qps: 6000
? burst: 30000
? # Enable AlwaysPullImages Admission controller plugin
? # Available as of v0.2.0
? always_pull_images: false
? # Add additional arguments to the kubernetes API server
? # This WILL OVERRIDE any existing defaults
? extra_args:
? # Enable audit log to stdout
? audit-log-path: “-”
? # Increase number of delete workers
? delete-collection-workers: 3
? # Set the level of log output to debug-level
? v: 4
? # Note for Rancher 2 users: If you are configuring Cluster Options
? # using a Config File when creating Rancher Launched Kubernetes,
? # the names of services should contain underscores only:
? # kube_controller. This only applies to Rancher v2.0.5 and v2.0.6.
? kube-controller:
? # CIDR pool used to assign IP addresses to pods in the cluster
? cluster_cidr: 10.42.0.0/16
? # IP range for any services created on Kubernetes
? # This must match the service_cluster_ip_range in kube-api
? service_cluster_ip_range: 10.43.0.0/16
? # Add additional arguments to the kubernetes API server
? # This WILL OVERRIDE any existing defaults
? extra_args:
? # Set the level of log output to debug-level
? v: 4
? # Enable RotateKubeletServerCertificate feature gate
? feature-gates: RotateKubeletServerCertificate=true
? # Enable TLS Certificates management
? # https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/
? cluster-signing-cert-file: “/etc/kubernetes/ssl/kube-ca.pem”
? cluster-signing-key-file: “/etc/kubernetes/ssl/kube-ca-key.pem”
? kubelet:
? # Base domain for the cluster
? cluster_domain: cluster.local
? # IP address for the DNS service endpoint
? cluster_dns_server: 10.43.0.10
? # Fail if swap is on
? fail_swap_on: false
? # Configure pod-infra-container-image argument
? pod-infra-container-image: “k8s.gcr.io/pause:3.2”
? # Generate a certificate signed by the kube-ca Certificate Authority
? # for the kubelet to use as a server certificate
? # Available as of v1.0.0
? generate_serving_certificate: true
? extra_args:
? # Set max pods to 250 instead of default 110
? max-pods: 250
? # Enable RotateKubeletServerCertificate feature gate
? feature-gates: RotateKubeletServerCertificate=true
? # Optionally define additional volume binds to a service
? extra_binds:
? - “/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins”
? scheduler:
? extra_args:
? # Set the level of log output to debug-level
? v: 4
? kubeproxy:
? extra_args:
? # Set the level of log output to debug-level
? v: 4
# Currently, only authentication strategy supported is x509.
# You can optionally create additional SANs (hostnames or IPs) to
# add to the API server PKI certificate.
# This is useful if you want to use a load balancer for the
# control plane servers.
authentication:
strategy: x509
sans:
? - “10.18.160.10”
? - “my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com”
# Kubernetes Authorization mode
# Use mode: rbac to enable RBAC
# Use mode: none to disable authorization
authorization:
mode: rbac
# If you want to set a Kubernetes cloud provider, you specify
# the name and configuration
cloud_provider:
name: aws
# Add-ons are deployed using kubernetes jobs. RKE will give
# up on trying to get the job status after this timeout in seconds…
addon_job_timeout: 30
# Specify network plugin-in (canal, calico, flannel, weave, or none)
network:
plugin: canal
# Specify MTU
mtu: 1400
options:
? # Configure interface to use for Canal
? canal_iface: eth1
? canal_flannel_backend_type: vxlan
? # Available as of v1.2.6
? canal_autoscaler_priority_class_name: system-cluster-critical
? canal_priority_class_name: system-cluster-critical
# Available as of v1.2.4
tolerations:
- key: “node.kubernetes.io/unreachable”
? operator: “Exists”
? effect: “NoExecute”
? tolerationseconds: 300
- key: “node.kubernetes.io/not-ready”
? operator: “Exists”
? effect: “NoExecute”
? tolerationseconds: 300
# Available as of v1.1.0
update_strategy:
? strategy: RollingUpdate
? rollingUpdate:
? maxUnavailable: 6
# Specify DNS provider (coredns or kube-dns)
dns:
provider: coredns
# Available as of v1.1.0
update_strategy:
? strategy: RollingUpdate
? rollingUpdate:
? maxUnavailable: 20%
? maxSurge: 15%
linear_autoscaler_params:
? cores_per_replica: 0.34
? nodes_per_replica: 4
? prevent_single_point_failure: true
? min: 2
? max: 3
# Specify monitoring provider (metrics-server)
monitoring:
provider: metrics-server
# Available as of v1.1.0
update_strategy:
? strategy: RollingUpdate
? rollingUpdate:
? maxUnavailable: 8
# Currently only nginx ingress provider is supported.
# To disable ingress controller, set provider: none
# node_selector controls ingress placement and is optional
ingress:
provider: nginx
node_selector:
? app: ingress
# Available as of v1.1.0
update_strategy:
? strategy: RollingUpdate
? rollingUpdate:
? maxUnavailable: 5
# All add-on manifests MUST specify a namespace
addons: |-
—
apiVersion: v1
kind: Pod
metadata:
? name: my-nginx
? namespace: default
spec:
? containers:
? - name: my-nginx
? image: nginx
? ports:
? - containerPort: 80
addons_include:
- https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-operator.yaml
- https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-cluster.yaml
- /path/to/manifest
總結(jié)
以上是生活随笔為你收集整理的再战 k8s（十八）：RKE的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。
- 上一篇： 5G芯片大战下的“新变量”
- 下一篇： 511遇见易语言重定义数组和复制数组