{"id":128,"date":"2017-03-30T15:56:24","date_gmt":"2017-03-30T07:56:24","guid":{"rendered":"http:\/\/www.jsjs.org\/?p=128"},"modified":"2017-03-30T15:56:24","modified_gmt":"2017-03-30T07:56:24","slug":"kubernetes%e9%9b%86%e7%be%a4%e7%9a%84%e5%ae%89%e5%85%a8%e9%85%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/blog.jsjs.org\/?p=128","title":{"rendered":"Kubernetes\u96c6\u7fa4\u7684\u5b89\u5168\u914d\u7f6e"},"content":{"rendered":"<p>\u4f7f\u7528kubernetes\/cluster\/kube-up.sh\u811a\u672c\u5728\u88c5\u6709<a href=\"http:\/\/tonybai.com\/tag\/ubuntu\">Ubuntu<\/a>\u64cd\u4f5c\u7cfb\u7edf\u7684bare metal\u4e0a<a href=\"http:\/\/tonybai.com\/2016\/10\/18\/learn-how-to-install-kubernetes-on-ubuntu\/\">\u642d\u5efa\u7684Kubernetes\u96c6\u7fa4<\/a>\u5e76\u4e0d\u5b89\u5168\uff0c\u751a\u81f3\u53ef\u4ee5\u8bf4\u662f\u201c\u5b8c\u5168\u4e0d\u8bbe\u9632\u7684\u201d\uff0c\u8fd9\u662f\u56e0\u4e3aKubernetes\u96c6\u7fa4\u7684\u6838\u5fc3\u7ec4\u4ef6\uff1a<a href=\"http:\/\/kubernetes.io\/docs\/admin\/kube-apiserver\/\">kube-apiserver<\/a>\u542f\u7528\u4e86insecure-port\u3002insecure-port\u80cc\u540e\u7684api server\u9ed8\u8ba4\u5b8c\u5168\u4fe1\u4efb\u8bbf\u95ee\u8be5\u7aef\u53e3\u7684\u6d41\u91cf\uff0c\u5185\u90e8\u65e0\u4efb\u4f55\u5b89\u5168\u673a\u5236\u3002\u5e76\u4e14\u76d1\u542cinsecure-port\u7684api server bind\u7684insecure-address\u4e3a0.0.0.0\u3002\u4e5f\u5c31\u662f\u8bf4\u4efb\u4f55\u5185\u5916\u90e8\u8bf7\u6c42\uff0c\u90fd\u53ef\u4ee5\u901a\u8fc7insecure-port\u7aef\u53e3\u4efb\u610f\u64cd\u4f5cKubernetes\u96c6\u7fa4\u3002\u6211\u4eec\u7684\u5e73\u53f0\u867d\u5c0f\uff0c\u4f46\u201c\u88f8\u5954\u201d\u7684k8s\u96c6\u7fa4\u4e5f\u5e76\u4e0d\u662f\u6211\u4eec\u60f3\u770b\u5230\u7684\uff0c\u9002\u5f53\u7684\u5b89\u5168\u914d\u7f6e\u662f\u9700\u8981\u7684\u3002<\/p>\n<p>\u5728\u672c\u6587\u4e2d\uff0c\u6211\u5c06\u548c\u5927\u5bb6\u4e00\u8d77\u5b66\u4e60\u4e00\u4e0bKubernetes\u63d0\u4f9b\u7684\u5b89\u5168\u673a\u5236\uff0c\u5e76\u901a\u8fc7\u5b89\u5168\u914d\u7f6e\u8c03\u6574\uff0c\u5b9e\u73b0K8s\u96c6\u7fa4\u7684\u201c\u6709\u9650\u201d\u5b89\u5168\u3002<\/p>\n<h4>\u4e00\u3001\u96c6\u7fa4\u73b0\u72b6<\/h4>\n<p>\u6211\u4eec\u5148\u6765\u201c\u56de\u987e\u201d\u4e00\u4e0b\u96c6\u7fa4\u73b0\u72b6\uff0c\u4e3a\u540e\u7eed\u914d\u7f6e\u8c03\u6574\u63d0\u4f9b\u4e00\u4e2a\u53ef\u56de\u6eaf\u548c\u53ef\u6bd4\u5bf9\u7684\u201c\u57fa\u7ebf\u201d\u3002<\/p>\n<h5>1\u3001Nodes<\/h5>\n<p>\u96c6\u7fa4\u57fa\u672c\u4fe1\u606f\uff1a<\/p>\n<pre><code># kubectl cluster-info\nKubernetes master is running at http:\/\/10.47.136.60:8080\nKubeDNS is running at http:\/\/10.47.136.60:8080\/api\/v1\/proxy\/namespaces\/kube-system\/services\/kube-dns\n\nTo further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.\n<\/code><\/pre>\n<p>\u5f53\u524d\u96c6\u7fa4\u903b\u8f91\u4e0a\u7531\u4e00\u4e2amaster node\u548c\u4e24\u4e2aworker nodes\u7ec4\u6210\uff1a<\/p>\n<pre><code>\u5355master\uff1a 10.47.136.60\nworker nodes\uff1a 10.47.136.60\u548c10.46.181.146\n\n# kubectl get node --show-labels=true\nNAME            STATUS    AGE       LABELS\n10.46.181.146   Ready     41d       beta.kubernetes.io\/arch=amd64,beta.kubernetes.io\/os=linux,kubernetes.io\/hostname=10.46.181.146\n10.47.136.60    Ready     41d       beta.kubernetes.io\/arch=amd64,beta.kubernetes.io\/os=linux,kubernetes.io\/hostname=10.47.136.60\n<\/code><\/pre>\n<h5>2\u3001kubernetes\u6838\u5fc3\u7ec4\u4ef6\u7684\u542f\u52a8\u53c2\u6570<\/h5>\n<p>\u6211\u4eec\u518d\u6765\u660e\u786e\u4e00\u4e0b\u5f53\u524d\u96c6\u7fa4\u4e2d\u5404k8s\u6838\u5fc3\u7ec4\u4ef6\u7684\u542f\u52a8\u53c2\u6570\uff0c\u8fd9\u4e9b\u53c2\u6570\u51b3\u5b9a\u7740\u7ec4\u4ef6\u80cc\u540e\u7684\u884c\u4e3a\uff1a<\/p>\n<p>master node &amp; worker node1 \u2013 10.47.136.60\u4e0a\uff1a<\/p>\n<pre><code>root       22000       1  0 Oct17 ?        03:52:55 \/opt\/bin\/kube-controller-manager --master=127.0.0.1:8080 --root-ca-file=\/srv\/kubernetes\/ca.crt --service-account-private-key-file=\/srv\/kubernetes\/server.key --logtostderr=true\n\nroot       22021       1  1 Oct17 ?        17:11:15 \/opt\/bin\/kube-apiserver --insecure-bind-address=0.0.0.0 --insecure-port=8080 --etcd-servers=http:\/\/127.0.0.1:4001 --logtostderr=true --service-cluster-ip-range=192.168.3.0\/24 --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,SecurityContextDeny,ResourceQuota --service-node-port-range=30000-32767 --advertise-address=10.47.136.60 --client-ca-file=\/srv\/kubernetes\/ca.crt --tls-cert-file=\/srv\/kubernetes\/server.cert --tls-private-key-file=\/srv\/kubernetes\/server.key\n\nroot       22121       1  0 Oct17 ?        00:22:30 \/opt\/bin\/kube-scheduler --logtostderr=true --master=127.0.0.1:8080\n\nroot     2140405       1  0 Nov15 ?        00:05:26 \/opt\/bin\/kube-proxy --hostname-override=10.47.136.60 --master=http:\/\/10.47.136.60:8080 --logtostderr=true\n\nroot     1912455       1  1 Nov15 ?        03:43:09 \/opt\/bin\/kubelet --hostname-override=10.47.136.60 --api-servers=http:\/\/10.47.136.60:8080 --logtostderr=true --cluster-dns=192.168.3.10 --cluster-domain=cluster.local --config=\n<\/code><\/pre>\n<p>worker node2 \u2013 10.46.181.146\u4e0a:<\/p>\n<pre><code>root      7934     1  1 Nov15 ?        03:06:00 \/opt\/bin\/kubelet --hostname-override=10.46.181.146 --api-servers=http:\/\/10.47.136.60:8080 --logtostderr=true --cluster-dns=192.168.3.10 --cluster-domain=cluster.local --config=\nroot     23026     1  0 Nov15 ?        00:04:49 \/opt\/bin\/kube-proxy --hostname-override=10.46.181.146 --master=http:\/\/10.47.136.60:8080 --logtostderr=true\n<\/code><\/pre>\n<p>\u4ecemaster node\u7684\u6838\u5fc3\u7ec4\u4ef6kube-apiserver \u7684\u542f\u52a8\u547d\u4ee4\u884c\u53c2\u6570\u4e5f\u53ef\u4ee5\u770b\u51fa\u6211\u4eec\u5728\u5f00\u7bc7\u5904\u6240\u63d0\u5230\u7684\u90a3\u6837\uff1aapiserver insecure-port\u5f00\u542f\uff0c\u4e14bind 0.0.0.0:8080\uff0c\u53ef\u4ee5\u4efb\u610f\u8bbf\u95ee\uff0c\u8fdebasic_auth\u90fd\u6ca1\u6709\u3002\u5f53\u7136api server\u4e0d\u53ea\u662f\u76d1\u542c\u8fd9\u4e00\u4e2a\u7aef\u53e3\uff0c\u5728<a href=\"http:\/\/kubernetes.io\/docs\/admin\/accessing-the-api\/\">api server\u6e90\u7801<\/a>\u4e2d\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u5230\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0capiserver\u8fd8\u76d1\u542c\u4e86\u53e6\u5916\u4e00\u4e2asecure port\uff0c\u8be5\u7aef\u53e3\u7684\u9ed8\u8ba4\u503c\u662f6443\uff0c\u901a\u8fc7lsof\u547d\u4ee4\u67e5\u770b6443\u7aef\u53e3\u7684\u76d1\u542c\u8fdb\u7a0b\u4e5f\u53ef\u4ee5\u5370\u8bc1\u8fd9\u4e00\u70b9\uff1a<\/p>\n<pre><code>\/\/master node\u4e0a\n\n# lsof -i tcp:6443\nCOMMAND     PID USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nkube-apis 22021 root   46u  IPv6 921529      0t0  TCP *:6443 (LISTEN)\n<\/code><\/pre>\n<h5>3\u3001\u79c1\u94a5\u6587\u4ef6\u548c\u516c\u94a5\u8bc1\u4e66<\/h5>\n<p>\u901a\u8fc7<a href=\"http:\/\/tonybai.com\/2016\/10\/18\/learn-how-to-install-kubernetes-on-ubuntu\/\">\u5b89\u88c5\u811a\u672c\u5728bare-metal\u4e0a\u5b89\u88c5\u7684k8s\u96c6\u7fa4<\/a>\uff0c\u5728master node\u4e0a\u4f60\u4f1a\u53d1\u73b0\u5982\u4e0b\u6587\u4ef6\uff1a<\/p>\n<pre><code>root@node1:\/srv\/kubernetes# ls\nca.crt  kubecfg.crt  kubecfg.key  server.cert  server.key\n<\/code><\/pre>\n<p>\u8fd9\u4e9b\u79c1\u94a5\u6587\u4ef6\u548c\u516c\u94a5\u8bc1\u4e66\u662f\u5728k8s(1.3.7)\u96c6\u7fa4\u5b89\u88c5\u8fc7\u7a0b\u7531\u5b89\u88c5\u811a\u672c\u521b\u5efa\u7684\uff0c\u5728kubernetes\/cluster\/common.sh\u4e2d\u4f60\u53ef\u4ee5\u53d1\u73b0function create-certs\u8fd9\u6837\u4e00\u4e2a\u51fd\u6570\uff0c\u8fd9\u4e9b\u6587\u4ef6\u5c31\u662f\u5b83\u521b\u5efa\u7684\u3002<\/p>\n<pre><code># Create certificate pairs for the cluster.\n# $1: The public IP for the master.\n#\n# These are used for static cert distribution (e.g. static clustering) at\n# cluster creation time. This will be obsoleted once we implement dynamic\n# clustering.\n#\n# The following certificate pairs are created:\n#\n#  - ca (the cluster's certificate authority)\n#  - server\n#  - kubelet\n#  - kubecfg (for kubectl)\n#\n# TODO(roberthbailey): Replace easyrsa with a simple Go program to generate\n# the certs that we need.\n#\n# Assumed vars\n#   KUBE_TEMP\n#\n# Vars set:\n#   CERT_DIR\n#   CA_CERT_BASE64\n#   MASTER_CERT_BASE64\n#   MASTER_KEY_BASE64\n#   KUBELET_CERT_BASE64\n#   KUBELET_KEY_BASE64\n#   KUBECFG_CERT_BASE64\n#   KUBECFG_KEY_BASE64\nfunction create-certs {\n  local -r primary_cn=\"${1}\"\n  ... ...\n\n}\n<\/code><\/pre>\n<p>\u7b80\u5355\u63cf\u8ff0\u4e00\u4e0b\u8fd9\u4e9b\u6587\u4ef6\u7684\u7528\u9014\uff1a<\/p>\n<pre><code>- ca.crt\uff1athe cluster's certificate authority\uff0cCA\u8bc1\u4e66\uff0c\u5373\u6839\u8bc1\u4e66\uff0c\u5185\u7f6eCA\u516c\u94a5\uff0c\u7528\u4e8e\u9a8c\u8bc1\u67d0.crt\u6587\u4ef6\uff0c\u662f\u5426\u662fCA\u7b7e\u53d1\u7684\u8bc1\u4e66\uff1b\n- server.cert\uff1akube-apiserver\u670d\u52a1\u7aef\u516c\u94a5\u6570\u5b57\u8bc1\u4e66\uff1b\n- server.key\uff1akube-apiserver\u670d\u52a1\u7aef\u79c1\u94a5\u6587\u4ef6\uff1b\n- kubecfg.crt \u548ckubecfg.key\uff1a\u6309\u7167 create-certs\u51fd\u6570\u6ce8\u91ca\u4e2d\u7684\u8bf4\u6cd5\uff1a\u8fd9\u4e24\u4e2a\u6587\u4ef6\u662f\u4e3akubectl\u8bbf\u95eeapiserver[\u53cc\u5411\u8bc1\u4e66\u9a8c\u8bc1](http:\/\/tonybai.com\/2015\/04\/30\/go-and-https\/)\u65f6\u4f7f\u7528\u7684\u3002\n<\/code><\/pre>\n<p>\u4e0d\u8fc7\uff0c\u8fd9\u91cc\u6211\u4eec\u6ca1\u6709CA\u7684key\uff0c\u65e0\u6cd5\u7b7e\u53d1\u65b0\u8bc1\u4e66\uff0c\u5982\u679c\u8981\u7528\u8fd9\u51e0\u4e2a\u6587\u4ef6\uff0c\u90a3\u4e48\u5c31\u4ec5\u80fd\u9650\u4e8e\u8fd9\u51e0\u4e2a\u6587\u4ef6\u3002\u6211\u4eec\u53ef\u4ee5\u5229\u7528kubecfg.crt \u548ckubecfg.key \u4f5c\u4e3a\u8bbf\u95eeapi server\u7684client\u7aef\u7684key\u548ccrt\u4f7f\u7528\u3002\u6211\u4eec\u6765\u67e5\u770b\u4e00\u4e0b\u8fd9\u51e0\u4e2a\u6587\u4ef6\uff1a<\/p>\n<p>\u67e5\u770bca.crt\uff1a<\/p>\n<pre><code>#openssl x509 -noout -text -in ca.crt\n... ...\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 16946557986148168970 (0xeb2e44b3a1ebb50a)\n    Signature Algorithm: sha256WithRSAEncryption\n        Issuer: CN=10.47.136.60@1476362758\n        Validity\n            Not Before: Oct 13 12:45:58 2016 GMT\n            Not After : Oct 11 12:45:58 2026 GMT\n        Subject: CN=10.47.136.60@1476362758\n... ..\n<\/code><\/pre>\n<p>\u67e5\u770bserver.cert\uff1a<\/p>\n<pre><code>...\n Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha256WithRSAEncryption\n        Issuer: CN=10.47.136.60@1476362758\n        Validity\n            Not Before: Oct 13 12:45:59 2016 GMT\n            Not After : Oct 11 12:45:59 2026 GMT\n        Subject: CN=kubernetes-master\n...\n<\/code><\/pre>\n<p>\u67e5\u770bkubecfg.crt\uff1a<\/p>\n<pre><code>...\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 2 (0x2)\n    Signature Algorithm: sha256WithRSAEncryption\n        Issuer: CN=10.47.136.60@1476362758\n        Validity\n            Not Before: Oct 13 12:45:59 2016 GMT\n            Not After : Oct 11 12:45:59 2026 GMT\n        Subject: CN=kubecfg\n...\n<\/code><\/pre>\n<p>\u518d\u6765\u9a8c\u8bc1\u4e00\u4e0bserver.cert\u548ckubecfg.crt\u662f\u5426\u662fca.crt\u7b7e\u53d1\u7684\uff1a<\/p>\n<pre><code># openssl verify -CAfile ca.crt kubecfg.crt\nkubecfg.crt: OK\n\n# openssl verify -CAfile ca.crt server.cert\nserver.cert: OK\n\n<\/code><\/pre>\n<p>\u5728\u524d\u9762\u7684apiserver\u7684\u542f\u52a8\u53c2\u6570\u5c55\u793a\u4e2d\uff0c\u6211\u4eec\u5df2\u7ecf\u770b\u5230kube-apiserver\u4f7f\u7528\u4e86ca.crt, server.cert\u548cserver.key\uff1a<\/p>\n<pre><code>\/opt\/bin\/kube-apiserver --insecure-bind-address=0.0.0.0 --insecure-port=8080 --etcd-servers=http:\/\/127.0.0.1:4001 --logtostderr=true --service-cluster-ip-range=192.168.3.0\/24 --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,SecurityContextDeny,ResourceQuota --service-node-port-range=30000-32767 --advertise-address=10.47.136.60 --client-ca-file=\/srv\/kubernetes\/ca.crt --tls-cert-file=\/srv\/kubernetes\/server.cert --tls-private-key-file=\/srv\/kubernetes\/server.key\n<\/code><\/pre>\n<p>\u5728\u540e\u7eed\u7ae0\u8282\u4e2d\uff0c\u6211\u4eec\u8fd8\u4f1a\u8be6\u7ec6\u8bf4\u660e\u8fd9\u4e9b\u5bc6\u94a5\u548c\u516c\u94a5\u8bc1\u4e66\u5728K8s\u96c6\u7fa4\u5b89\u5168\u4e2d\u6240\u8d77\u5230\u7684\u4f5c\u7528\u3002<\/p>\n<h4>\u4e8c\u3001\u96c6\u7fa4\u73af\u5883<\/h4>\n<p>\u8fd8\u662f\u90a3\u53e5\u8bdd\uff0cKubernetes\u5728active development\u4e2d\uff0c\u8001\u7248\u672c\u548c\u65b0\u7248\u672c\u7684\u5b89\u5168\u673a\u5236\u53ef\u80fd\u6709\u8f83\u5927\u53d8\u52a8\uff0c\u672c\u7bc7\u4e2d\u7684\u914d\u7f6e\u65b9\u6848\u548c\u6b65\u9aa4\u90fd\u662f\u9488\u5bf9\u4e00\u5b9a\u73af\u5883\u6709\u6548\u7684\uff0c\u6211\u4eec\u7684\u73af\u5883\u5982\u4e0b\uff1a<\/p>\n<pre><code>OS\uff1a\nUbuntu 14.04.4 LTS Kernel\uff1a3.19.0-70-generic #78~14.04.1-Ubuntu SMP Fri Sep 23 17:39:18 UTC 2016 x86_64 x86_64 x86_64 GNU\/Linux\n\nDocker\uff1a\n# docker version\nClient:\n Version:      1.12.2\n API version:  1.24\n Go version:   go1.6.3\n Git commit:   bb80604\n Built:        Tue Oct 11 17:00:50 2016\n OS\/Arch:      linux\/amd64\n\nServer:\n Version:      1.12.2\n API version:  1.24\n Go version:   go1.6.3\n Git commit:   bb80604\n Built:        Tue Oct 11 17:00:50 2016\n OS\/Arch:      linux\/amd64\n\nKubernetes\u96c6\u7fa4\uff1a1.3.7\n\n\u79c1\u6709\u955c\u50cf\u4ed3\u5e93\uff1a\u963f\u91cc\u4e91\u955c\u50cf\u4ed3\u5e93\n<\/code><\/pre>\n<h4>\u4e09\u3001\u76ee\u6807<\/h4>\n<p>\u76ee\u524d\uff0c\u6211\u4eec\u5c1a\u4e0d\u5177\u5907\u4e00\u6b65\u8fc8\u5411\u201c\u7edd\u5bf9\u5b89\u5168\u201d\u7684\u80fd\u529b\uff0c\u5728\u76ee\u6807\u8bbe\u5b9a\u65f6\uff0c\u6211\u4eec\u7684\u4e00\u81f4\u60f3\u6cd5\u662f\u5728\u5f53\u524d\u9636\u6bb5\u201c\u6709\u9650\u5b89\u5168\u201d\u7684K8s\u96c6\u7fa4\u66f4\u9002\u5408\u6211\u4eec\u3002\u5728\u8fd9\u4e00\u539f\u5219\u4e0b\uff0c\u6211\u4eec\u9488\u5bf9\u4e0d\u540c\u60c5\u51b5\u63d0\u51fa\u4e0d\u540c\u7684\u76ee\u6807\u8bbe\u5b9a\u3002<\/p>\n<p>\u524d\u9762\u8bf4\u8fc7\uff0ck8s\u9488\u5bf9insecure port(\u2013insecure-bind-address=0.0.0.0 \u2013insecure-port=8080)\u7684\u6d41\u91cf\u6ca1\u6709\u4efb\u4f55\u5b89\u5168\u673a\u5236\u9650\u5236\uff0c\u76f8\u5f53\u4e8ek8s\u201c\u88f8\u5954\u201d\u3002\u4f46\u662f\u8d70k8s apiserver secure port(\u2013bind-address=0.0.0.0 \u2013secure-port=6443)\u7684\u6d41\u91cf\uff0c\u5c06\u4f1a\u9047\u5230<a href=\"http:\/\/kubernetes.io\/docs\/admin\/accessing-the-api\/\">\u9a8c\u8bc1\u3001\u6388\u6743\u7b49\u5b89\u5168\u673a\u5236<\/a>\u7684\u9650\u5236\u3002\u5177\u4f53\u4f7f\u7528\u54ea\u4e2a\u7aef\u53e3\u4e0eAPI server\u7684\u4ea4\u4e92\u65b9\u5f0f\uff0c\u8981\u89c6\u60c5\u51b5\u800c\u5b9a\u3002<\/p>\n<p>\u5728\u5206\u60c5\u51b5\u8bf4\u660e\u4e4b\u524d\uff0c\u5c06api server\u7684insecure port\u7684bind address\u75310.0.0.0\u6539\u4e3alocal address\u662f\u5fc5\u987b\u8981\u505a\u7684\u3002<\/p>\n<h5>1\u3001Cluster -&gt; Master(apiserver)<\/h5>\n<p>\u4ece\u96c6\u7fa4\u5230Apiserver\u7684\u6d41\u91cf\u4e5f\u53ef\u4ee5\u7ec6\u5206\u4e3a\u51e0\u79cd\u60c5\u51b5\uff1a<\/p>\n<h6>a) kubernetes component on master node -&gt; apiserver<\/h6>\n<p>\u7531\u4e8emaster node\u4e0a\u7684components\u4e0eapiserver\u8fd0\u884c\u5728\u4e00\u53f0\u673a\u5668\u4e0a\uff0c\u56e0\u6b64\u53ef\u4ee5\u901a\u8fc7local address\u7684insecure-port\u8bbf\u95eeapiserver\uff0c\u65e0\u9700\u8d70insecure port\u3002\u4ece\u73b0\u72b6\u4e2d\u5f53\u524dmaster\u4e0a\u7684component\u7ec4\u4ef6\u7684\u542f\u52a8\u53c2\u6570\u6765\u770b\uff0c\u76ee\u524d\u5df2\u7ecf\u7b26\u5408\u8981\u6c42\uff0c\u4e8e\u662f\u9488\u5bf9\u8fd9\u4e9bcomponents\uff0c\u6211\u4eec\u65e0\u9700\u518d\u505a\u914d\u7f6e\u4e0a\u7684\u8c03\u6574\u3002<\/p>\n<h6>b) kubernetes component on worker node -&gt; apiserver<\/h6>\n<p>\u76ee\u6807\u662f\u5b9e\u73b0kubernetes components on worker node\u548c\u8fd0\u884c\u4e8emaster\u4e0a\u7684apiserver\u4e4b\u95f4\u7684\u57fa\u4e8ehttps\u7684\u53cc\u5411\u8ba4\u8bc1\u3002kubernetes\u7684\u5404\u4e2a\u7ec4\u4ef6\u5747\u652f\u6301\u5728\u547d\u4ee4\u884c\u53c2\u6570\u4e2d\u4f20\u5165tls\u76f8\u5173\u53c2\u6570\uff0c\u6bd4\u5982ca\u6587\u4ef6\u8def\u5f84\uff0c\u6bd4\u5982client\u7aef\u7684cert\u6587\u4ef6\u548ckey\u7b49\u3002<\/p>\n<h6>c) componet in pod for kubernetes -&gt; apiserver<\/h6>\n<p>\u50cfkube dns\u548ckube dashboard\u8fd9\u4e9b\u8fd0\u884c\u4e8epod\u4e2d\u7684k8s \u7ec4\u4ef6\u4e5f\u662f\u5728k8s cluster\u8303\u56f4\u5185\u8c03\u5ea6\u7684\uff0c\u5b83\u4eec\u53ef\u80fd\u8fd0\u884c\u5728\u4efb\u4f55\u4e00\u4e2aworker node\u4e0a\u3002\u7406\u60f3\u60c5\u51b5\u4e0b\uff0c\u5b83\u4eec\u4e0emaster\u4e0aapi server\u7684\u901a\u4fe1\u4e5f\u5e94\u8be5\u662f\u57fa\u4e8e\u4e00\u5b9a\u5b89\u5168\u673a\u5236\u7684\u3002\u4e0d\u8fc7\u5728\u672c\u7bc7\u4e2d\uff0c\u6211\u4eec\u6682\u65f6\u4e0d\u52a8\u5b83\u4eec\u7684\u8bbe\u7f6e\uff0c\u4ee5\u514d\u5bf9\u5176\u4ed6\u76ee\u6807\u7684\u5b9e\u73b0\u9020\u6210\u4e00\u5b9a\u969c\u788d\u548c\u66f4\u591a\u7684\u5de5\u4f5c\u91cf\uff0c\u5728\u540e\u7eed\u6587\u7ae0\u4e2d\uff0c\u53ef\u80fd\u4f1a\u4e13\u95e8\u5c06dns\u548cdashboard\u62ff\u51fa\u6765\u505a\u5b89\u5168\u52a0\u56fa\u8bf4\u660e\u3002\u56e0\u6b64\uff0cdns\u548cdashboard\u5728\u8fd9\u91cc\u4ecd\u7136\u4f7f\u7528\u7684\u662finsecure-port\uff1a<\/p>\n<pre><code>root     10531 10515  0 Nov15 ?        00:03:02 \/dashboard --port=9090 --apiserver-host=http:\/\/10.47.136.60:8080\nroot     2018255 2018240  0 Nov15 ?        00:03:50 \/kube-dns --domain=cluster.local. --dns-port=10053 --kube-master-url=http:\/\/10.47.136.60:8080\n<\/code><\/pre>\n<h6>d) user service in pod -&gt; apiserver<\/h6>\n<p>\u6211\u4eec\u7684\u96c6\u7fa4\u7ba1\u7406\u7a0b\u5e8f\u4e5f\u662f\u4ee5service\u7684\u5f62\u5f0f\u8fd0\u884c\u5728k8s cluster\u4e2d\u7684\uff0c\u8fd9\u4e9b\u7a0b\u5e8f\u5982\u4f55\u8bbf\u95eeapiserver\u624d\u662f\u6211\u4eec\u5173\u5fc3\u7684\u91cd\u70b9\uff0c\u6211\u4eec\u5e0c\u671b\u7ba1\u7406\u7a0b\u5e8f\u901a\u8fc7secure-port\uff0c\u5728\u4e00\u5b9a\u7684\u5b89\u5168\u673a\u5236\u4e0b\u4e0eapiserver\u4ea4\u4e92\u3002<\/p>\n<h5>2\u3001Master(apiserver) -&gt; Cluster<\/h5>\n<p>apiserver\u4f5c\u4e3aclient\u7aef\u8bbf\u95eeCluster\uff0c\u5728k8s\u6587\u6863\u4e2d\uff0c\u8fd9\u4e2a\u8bbf\u95ee\u8def\u5f84\u4e3b\u8981\u5305\u542b\u4e24\u79cd\u60c5\u51b5\uff1a<\/p>\n<p>a) apiserver\u4e0e\u5404\u4e2anode\u4e0akubelet\u4ea4\u4e92\uff0c\u91c7\u96c6Pod\u7684log\uff1b<br \/>\nb) apiserver\u901a\u8fc7\u81ea\u8eab\u7684proxy\u529f\u80fd\u8bbf\u95eenode\u3001pod\u4ee5\u53ca\u96c6\u7fa4\u4e2d\u7684\u5404\u79cdservice\u3002<\/p>\n<p>\u5728\u201c\u6709\u9650\u5b89\u5168\u201d\u7684\u539f\u5219\u4e0b\uff0c\u6211\u4eec\u6682\u4e0d\u8003\u8651\u8fd9\u79cd\u60c5\u51b5\u4e0b\u7684\u5b89\u5168\u673a\u5236\u3002<\/p>\n<h4>\u56db\u3001Kubernetes\u7684\u5b89\u5168\u673a\u5236<\/h4>\n<p>kube-apiserver\u662f\u6574\u4e2akubernetes\u96c6\u7fa4\u7684\u6838\u5fc3\uff0c\u65e0\u8bba\u662fkubectl\u8fd8\u662f\u901a\u8fc7api\u7ba1\u7406\u96c6\u7fa4\uff0c\u6700\u7ec8\u90fd\u4f1a\u843d\u5230\u4e0ekube-apiserver\u7684\u4ea4\u4e92\uff0capiserver\u662f\u96c6\u7fa4\u7ba1\u7406\u547d\u4ee4\u7684\u5165\u53e3\u3002kube-apiserver\u540c\u65f6\u76d1\u542c\u4e24\u4e2a\u7aef\u53e3\uff1ainsecure-port\u548csecure-port\u3002\u4e4b\u524d\u63d0\u5230\u8fc7\uff1a\u901a\u8fc7insecure-port\u8fdb\u5165apiserver\u7684\u6d41\u91cf\u53ef\u4ee5\u6709\u63a7\u5236\u6574\u4e2a\u96c6\u7fa4\u7684\u5168\u90e8\u6743\u9650\uff1b\u800c\u901a\u8fc7secure-port\u7684\u6d41\u91cf\u5c06\u7ecf\u8fc7k8s\u7684\u5b89\u5168\u673a\u5236\u7684\u91cd\u91cd\u8003\u9a8c\uff0c\u8fd9\u4e5f\u662f\u8fd9\u4e00\u8282\u6211\u4eec\u91cd\u8981\u8981\u8bf4\u660e\u7684\u3002insecure-port\u7684\u5b58\u5728\u4e00\u822c\u662f\u4e3a\u4e86\u96c6\u7fa4bootstrap\u6216\u96c6\u7fa4\u5f00\u53d1\u8c03\u8bd5\u4f7f\u7528\u7684\u3002\u5b98\u65b9\u6587\u6863\u5efa\u8bae\uff1a\u96c6\u7fa4\u5916\u90e8\u6d41\u91cf\u90fd\u5e94\u8be5\u8d70secure port\u3002insecure-port\u53ef\u901a\u8fc7firewall rule\u4f7f\u5916\u90e8\u6d41\u91cfunreachable\u3002<\/p>\n<p>\u4e0b\u9762\u8fd9\u5e45\u5b98\u65b9\u56fe\u793a\u51c6\u786e\u89e3\u91ca\u4e86\u901a\u8fc7secure port\u7684\u6d41\u91cf\u5c06\u8981\u901a\u8fc7\u7684\u201c\u5b89\u5168\u5173\u5361\u201d\uff1a<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/tonybai.com\/wp-content\/uploads\/k8s-apiserver-access-control-overview.svg\" alt=\"img{512x368}\" \/><\/p>\n<p>\u6211\u4eec\u53ef\u4ee5\u770b\u5230\u5916\u754c\u5230APIServer\u7684\u8bf7\u6c42\u5148\u540e\u7ecf\u8fc7\u4e86\uff1a<\/p>\n<pre><code>\u5b89\u5168\u901a\u9053(tls) -&gt; Authentication(\u8eab\u4efd\u9a8c\u8bc1) -&gt; Authorization\uff08\u6388\u6743\uff09-&gt; Admission Control(\u5165\u53e3\u6761\u4ef6\u63a7\u5236)\n<\/code><\/pre>\n<ul>\n<li>\u5b89\u5168\u901a\u9053\uff1a\u5373\u57fa\u4e8etls\u7684https\u7684\u5b89\u5168\u901a\u9053\u5efa\u7acb\uff0c\u5bf9\u6d41\u91cf\u8fdb\u884c\u52a0\u5bc6\uff0c\u9632\u6b62\u55c5\u63a2\u3001\u8eab\u4efd\u5192\u5145\u548c\u7be1\u6539\uff1b<\/li>\n<li>Authentication\uff1a\u5373\u8eab\u4efd\u9a8c\u8bc1\uff0c\u8fd9\u4e2a\u73af\u8282\u5b83\u9762\u5bf9\u7684\u8f93\u5165\u662f\u6574\u4e2ahttp request\u3002\u5b83\u8d1f\u8d23\u5bf9\u6765\u81eaclient\u7684\u8bf7\u6c42\u8fdb\u884c\u8eab\u4efd\u6821\u9a8c\uff0c\u652f\u6301\u7684\u65b9\u6cd5\u5305\u62ec\uff1aclient\u8bc1\u4e66\u9a8c\u8bc1\uff08https\u53cc\u5411\u9a8c\u8bc1\uff09\u3001basic auth\u3001\u666e\u901atoken\u4ee5\u53cajwt token(\u7528\u4e8eserviceaccount)\u3002APIServer\u542f\u52a8\u65f6\uff0c\u53ef\u4ee5\u6307\u5b9a\u4e00\u79cdAuthentication\u65b9\u6cd5\uff0c\u4e5f\u53ef\u4ee5\u6307\u5b9a\u591a\u79cd\u65b9\u6cd5\u3002\u5982\u679c\u6307\u5b9a\u4e86\u591a\u79cd\u65b9\u6cd5\uff0c\u90a3\u4e48APIServer\u5c06\u4f1a\u9010\u4e2a\u4f7f\u7528\u8fd9\u4e9b\u65b9\u6cd5\u5bf9\u5ba2\u6237\u7aef\u8bf7\u6c42\u8fdb\u884c\u9a8c\u8bc1\uff0c\u53ea\u8981\u8bf7\u6c42\u6570\u636e\u901a\u8fc7\u5176\u4e2d\u4e00\u79cd\u65b9\u6cd5\u7684\u9a8c\u8bc1\uff0cAPIServer\u5c31\u4f1a\u8ba4\u4e3aAuthentication\u6210\u529f\uff1b<\/li>\n<li>Authorization\uff1a\u6388\u6743\u3002\u8fd9\u4e2a\u9636\u6bb5\u9762\u5bf9\u7684\u8f93\u5165\u662fhttp request context\u4e2d\u7684\u5404\u79cd\u5c5e\u6027\uff0c\u5305\u62ec\uff1auser\u3001group\u3001request path\uff08\u6bd4\u5982\uff1a\/api\/v1\u3001\/healthz\u3001\/version\u7b49\uff09\u3001request verb(\u6bd4\u5982\uff1aget\u3001list\u3001create\u7b49)\u3002APIServer\u4f1a\u5c06\u8fd9\u4e9b\u5c5e\u6027\u503c\u4e0e\u4e8b\u5148\u914d\u7f6e\u597d\u7684\u8bbf\u95ee\u7b56\u7565(access policy\uff09\u76f8\u6bd4\u8f83\u3002APIServer\u652f\u6301\u591a\u79cdauthorization mode\uff0c\u5305\u62ecAlwaysAllow\u3001AlwaysDeny\u3001ABAC\u3001RBAC\u548cWebhook\u3002APIServer\u542f\u52a8\u65f6\uff0c\u53ef\u4ee5\u6307\u5b9a\u4e00\u79cdauthorization mode\uff0c\u4e5f\u53ef\u4ee5\u6307\u5b9a\u591a\u79cdauthorization mode\uff0c\u5982\u679c\u662f\u540e\u8005\uff0c\u53ea\u8981Request\u901a\u8fc7\u4e86\u5176\u4e2d\u4e00\u79cdmode\u7684\u6388\u6743\uff0c\u90a3\u4e48\u8be5\u73af\u8282\u7684\u6700\u7ec8\u7ed3\u679c\u5c31\u662f\u6388\u6743\u6210\u529f\u3002<\/li>\n<li>Admission Control\uff1a\u4ece\u6280\u672f\u7684\u89d2\u5ea6\u770b\uff0cAdmission control\u5c31\u50cfa chain of interceptors\uff08\u62e6\u622a\u5668\u94fe\u6a21\u5f0f\uff09\uff0c\u5b83\u62e6\u622a\u90a3\u4e9b\u5df2\u7ecf\u987a\u5229\u901a\u8fc7authentication\u548cauthorization\u7684http\u8bf7\u6c42\u3002http\u8bf7\u6c42\u6cbf\u7740APIServer\u542f\u52a8\u65f6\u914d\u7f6e\u7684admission control chain\u987a\u5e8f\u9010\u4e00\u88ab\u62e6\u622a\u548c\u5904\u7406\uff0c\u5982\u679c\u67d0\u4e2ainterceptor\u62d2\u7edd\u4e86\u8be5http\u8bf7\u6c42\uff0c\u90a3\u4e48request\u5c06\u4f1a\u88ab\u76f4\u63a5reject\u6389\uff0c\u800c\u4e0d\u662f\u50cfauthentication\u6216authorization\u90a3\u6837\u6709\u7ee7\u7eed\u5c1d\u8bd5\u5176\u4ed6interceptor\u7684\u673a\u4f1a\u3002<\/li>\n<\/ul>\n<h4>\u4e94\u3001\u5b9e\u73b0\u5b89\u5168\u4f20\u8f93\u901a\u9053\uff08https)\u4e0e\u8eab\u4efd\u6821\u9a8c(authentication)<\/h4>\n<p>\u5728\u5efa\u7acb\u5b89\u5168\u4f20\u8f93\u901a\u9053\u3001\u8eab\u4efd\u6821\u9a8c\u73af\u8282\uff0c\u6211\u4eec\u6839\u636e\u201d\u76ee\u6807\u201c\u8bbe\u5b9a\u4e00\u8282\u4e2d\u7684\u5206\u7c7b\uff0c\u4e5f\u5206\u4e3a\u4e09\u79cd\u60c5\u51b5\uff1a<\/p>\n<p>a) \u8fd0\u884c\u4e8emaster\u4e0a\u7684\u6838\u5fc3k8s components\u8d70insecure port\uff0c\u8fd9\u4e2a\u6682\u4e0d\u7528\u4fee\u6539\u914d\u7f6e\uff1b<br \/>\nb) worker node\u4e0a\u7684k8s\u7ec4\u4ef6\u914d\u7f6e\u901a\u8fc7insecure-port\u8bbf\u95ee\uff0c\u5e76\u91c7\u7528https\u53cc\u5411\u8ba4\u8bc1\u7684\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\uff1b<br \/>\nc) pod in k8s\u8bbf\u95eeapiserver\uff0c\u901a\u8fc7https+ basic auth\u7684\u65b9\u5f0f\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u3002<\/p>\n<p>APIServer\u76f4\u63a5\u4f7f\u7528\u4e86\u96c6\u7fa4\u521b\u5efa\u65f6\u521b\u5efa\u7684ca.crt\u3001server.cert\u548cserver.key\uff0c\u7531\u4e8e\u6ca1\u6709ca.key\uff0c\u6240\u4ee5\u6211\u4eec\u53ea\u80fd\u76f4\u63a5\u5229\u7528\u5176\u5b83\u4e24\u4e2a\u6587\u4ef6: kubecfg.key\u548ckubecfg.crt\u4f5c\u4e3a\u5ba2\u6237\u7aef\u7684\u79c1\u94a5\u6587\u4ef6\u548c\u516c\u94a5\u8bc1\u4e66\u3002\u5f53\u7136\u4f60\u4e5f\u53ef\u4ee5<a href=\"http:\/\/tonybai.com\/2015\/04\/30\/go-and-https\/\">\u624b\u52a8\u91cd\u65b0\u521b\u5efaca<\/a>\uff0c\u5e76\u5c06apiserver\u4f7f\u7528\u7684.key\u3001.crt\u4ee5\u53ca\u5404\u4e2acomponents\u7684client.key\u548cclient.crt\u90fd\u751f\u6210\u4e00\u4efd\uff0c\u5e76\u7528\u4f60\u751f\u6210\u7684Ca\u7b7e\u53d1\u3002\u8fd9\u91cc\u6211\u4eec\u5c31\u5077\u4e2a\u61d2\u513f\u4e86\u3002<\/p>\n<p>\u5728\u5f00\u59cb\u4e4b\u524d\uff0c\u6211\u4eec\u518d\u6765\u770b\u770bapiserver\u7684\u542f\u52a8\u53c2\u6570\uff1a<\/p>\n<pre><code>root       22021       1  1 Oct17 ?        17:11:15 \/opt\/bin\/kube-apiserver --insecure-bind-address=0.0.0.0 --insecure-port=8080 --etcd-servers=http:\/\/127.0.0.1:4001 --logtostderr=true --service-cluster-ip-range=192.168.3.0\/24 --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,SecurityContextDeny,ResourceQuota --service-node-port-range=30000-32767 --advertise-address=10.47.136.60 --client-ca-file=\/srv\/kubernetes\/ca.crt --tls-cert-file=\/srv\/kubernetes\/server.cert --tls-private-key-file=\/srv\/kubernetes\/server.key\n\n<\/code><\/pre>\n<p>\u7531\u4e8e\u4e4b\u524d\u7b80\u8ff0\u4e86Kubernetes\u7684\u5b89\u5168\u673a\u5236\uff0c\u4e8e\u662f\u6211\u4eec\u5bf9\u8fd9\u4e9b\u53c2\u6570\u53c8\u6709\u4e86\u8fdb\u4e00\u6b65\u8ba4\u8bc6<\/p>\n<pre><code>https\u5b89\u5168\u901a\u9053\u5efa\u7acb\u9636\u6bb5\uff1a\u7aef\u53e36443(\u901a\u8fc7 \/opt\/bin\/kube-apiserver --help\u67e5\u770boptions\u8bf4\u660e\u53ef\u4ee5\u5f97\u5230)\uff0c\u516c\u94a5\u8bc1\u4e66server.cert \uff0c\u79c1\u94a5\u6587\u4ef6\uff1aserver.key\u3002\nAuthentication\u9636\u6bb5\uff1a\u4ece\u5f53\u524d\u542f\u52a8\u53c2\u6570\u4e2d\uff0c\u6211\u4eec\u4ec5\u80fd\u770b\u5230\u4e00\u79cd\u673a\u5236\uff1a--client-ca-file=\/srv\/kubernetes\/ca.crt\uff0c\u4e5f\u5c31\u662fclient\u8bc1\u4e66\u6821\u9a8c\u673a\u5236\u3002apiserver\u4f1a\u7528\/srv\/kubernetes\/ca.crt\u5bf9client\u7aef\u53d1\u8fc7\u6765\u7684client.crt\u8fdb\u884c\u9a8c\u8bc1\u3002\nAuthorization\u9636\u6bb5\uff1a\u901a\u8fc7 \/opt\/bin\/kube-apiserver --help\u67e5\u770boptions\u8bf4\u660e\u53ef\u4ee5\u5f97\u5230\uff1a--authorization-mode=\"AlwaysAllow\"\uff0c\u4e5f\u5c31\u662f\u8bf4\u5728\u8fd9\u4e00\u73af\u8282\uff0c\u6240\u6709Request\u90fd\u53ef\u4ee5\u987a\u5229\u901a\u8fc7\u3002\nAdmission Control\u9636\u6bb5\uff1aapiserver\u6307\u5b9a\u4e86\u201cNamespaceLifecycle,LimitRanger,ServiceAccount,SecurityContextDeny,ResourceQuota\u201d\u8fd9\u6837\u4e00\u4e2ainterceptor\u94fe\u3002\n<\/code><\/pre>\n<p>\u6211\u4eec\u9996\u5148\u6765\u6d4b\u8bd5\u4e00\u4e0b\u901a\u8fc7kubecfg.key\u548ckubecfg.crt\u8bbf\u95eeAPIServer\u7684insecure-port\uff0c\u9a8c\u8bc1\u4e00\u4e0bkubecfg.key\u548ckubecfg.crt\u4f5c\u4e3aclient\u7aef\u79c1\u94a5\u6587\u4ef6\u548c\u516c\u94a5\u8bc1\u4e66\u7684\u53ef\u884c\u6027\uff1a<\/p>\n<pre><code># curl https:\/\/10.47.136.60:6443\/version --cert \/srv\/kubernetes\/kubecfg.crt --key \/srv\/kubernetes\/kubecfg.key --cacert \/srv\/kubernetes\/ca.crt\n{\n  \"major\": \"1\",\n  \"minor\": \"3\",\n  \"gitVersion\": \"v1.3.7\",\n  \"gitCommit\": \"a2cba278cba1f6881bb0a7704d9cac6fca6ed435\",\n  \"gitTreeState\": \"clean\",\n  \"buildDate\": \"2016-09-12T23:08:43Z\",\n  \"goVersion\": \"go1.6.2\",\n  \"compiler\": \"gc\",\n  \"platform\": \"linux\/amd64\"\n}\n<\/code><\/pre>\n<p>\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u5c31\u6765\u5f00\u59cb\u8c03\u6574k8s\u914d\u7f6e\u3002<\/p>\n<h5>\u7b2c\u4e00\u4e2a\u573a\u666f\uff1acomponents on worker node -&gt; master<\/h5>\n<p>worker node\u4e0a\u6709\u4e24\u4e2ak8s components\uff1akubelet\u548ckube-proxy\uff0c\u5f53\u524d\u5b83\u4eec\u7684\u542f\u52a8\u53c2\u6570\u4e3a\uff1a<\/p>\n<pre><code>root      7934     1  1 Nov15 ?        03:33:35 \/opt\/bin\/kubelet --hostname-override=10.46.181.146 --api-servers=http:\/\/10.47.136.60:8080 --logtostderr=true --cluster-dns=192.168.3.10 --cluster-domain=cluster.local --config=\nroot      8140     1  0 14:59 ?        00:00:00 \/opt\/bin\/kube-proxy --hostname-override=10.46.181.146 --master=http:\/\/10.47.136.60:8080 --logtostderr=true\n<\/code><\/pre>\n<p>\u6211\u4eec\u5c06ca.crt\u3001kubecfg.key\u548ckubecfg.crt scp\u5230\u5176\u4ed6\u5404\u4e2aWorker node\u7684\/srv\/kubernetes\u76ee\u5f55\u4e0b\uff1a<\/p>\n<pre><code>root@node1:\/srv\/kubernetes# scp ca.crt root@10.46.181.146:\/srv\/kubernetes\nca.crt                                                                                                                                        100% 1220     1.2KB\/s   00:00\nroot@node1:\/srv\/kubernetes# scp kubecfg.crt root@10.46.181.146:\/srv\/kubernetes\nkubecfg.crt                                                                                                                                   100% 4417     4.3KB\/s   00:00\nroot@node1:\/srv\/kubernetes# scp kubecfg.key root@10.46.181.146:\/srv\/kubernetes\nkubecfg.key\n\n\u5728worker node: 10.46.181.146\u4e0a\uff1a\n\n# ls -l\ntotal 16\n-rw-r----- 1 root root 1220 Nov 25 15:51 ca.crt\n-rw------- 1 root root 4417 Nov 25 15:51 kubecfg.crt\n-rw------- 1 root root 1708 Nov 25 15:51 kubecfg.key\n<\/code><\/pre>\n<p>\u521b\u5efaworker node\u4e0akubelet\u548ckube-proxy\u6240\u8981\u4f7f\u7528\u7684<a href=\"http:\/\/kubernetes.io\/docs\/user-guide\/kubeconfig-file\/\">config\u6587\u4ef6<\/a>\uff1a\/root\/.kube\/config<\/p>\n<pre><code>\/root\/.kube\/config\n\napiVersion: v1\nkind: Config\npreferences: {}\nusers:\n- name: kubecfg\n  user:\n    client-certificate: \/srv\/kubernetes\/kubecfg.crt\n    client-key: \/srv\/kubernetes\/kubecfg.key\nclusters:\n- cluster:\n    certificate-authority: \/srv\/kubernetes\/ca.crt\n  name: ubuntu\ncontexts:\n- context:\n    cluster: ubuntu\n    user: kubecfg\n  name: ubuntu\ncurrent-context: ubuntu\n<\/code><\/pre>\n<p>\u8fd9\u4e2a\u6587\u4ef6\u53c2\u8003\u4e86master node\u4e0a\u7684\/root\/.kube\/config\u6587\u4ef6\u7684\u683c\u5f0f\uff0c\u4f60\u4e5f\u53ef\u4ee5\u5728master node\u4e0a\u4f7f\u7528kubectl config view\u67e5\u770bconfig\u6587\u4ef6\u5185\u5bb9\uff1a<\/p>\n<pre><code># kubectl config view\napiVersion: v1\nclusters:\n- cluster:\n    insecure-skip-tls-verify: true\n    server: http:\/\/10.47.136.60:8080\n  name: ubuntu\ncontexts:\n- context:\n    cluster: ubuntu\n    user: ubuntu\n  name: ubuntu\ncurrent-context: ubuntu\nkind: Config\npreferences: {}\nusers:\n- name: ubuntu\n  user:\n    password: xxxxxA\n    username: admin\n<\/code><\/pre>\n<p>Worker node\u4e0a\/root\/.kube\/config\u4e2d\u7684user.name\u4f7f\u7528\u7684\u662fkubecfg\uff0c\u8fd9\u4e5f\u662f\u5728\u524d\u9762\u67e5\u770bkubecfg.crt\u65f6\uff0ckubecfg.crt\u5728\/CN\u57df\u4e2d\u4f7f\u7528\u7684\u503c\u3002<\/p>\n<p>\u63a5\u4e0b\u6765\u6211\u4eec\u6765\u4fee\u6539worker node\u4e0a\u7684\/etc\/default\/kubelet\u6587\u4ef6\uff1a<\/p>\n<pre><code>KUBELET_OPTS=\" --hostname-override=10.46.181.146  --api-servers=https:\/\/10.47.136.60:6443 --logtostderr=true  --cluster-dns=192.168.3.10  --cluster-domain=cluster.local  --kubeconfig=\/root\/.kube\/config\"\n#KUBELET_OPTS=\" --hostname-override=10.46.181.146  --api-servers=http:\/\/10.47.136.60:8080  --logtostderr=true  --cluster-dns=192.168.3.10  --cluster-domain=cluster.local  --config=  \"\n<\/code><\/pre>\n<p>\u5728worker node\u4e0a\u91cd\u542fkubelet\u5e76\u67e5\u770b\/var\/log\/upstart\/kubelet.log\uff1a<\/p>\n<pre><code># service kubelet restart\nkubelet stop\/waiting\nkubelet start\/running, process 9716\n\n\/\/\/var\/log\/upstart\/kubelet.log\n... ...\nI1125 16:12:26.332652    9716 server.go:784] Watching apiserver\nW1125 16:12:26.338581    9716 kubelet.go:572] Hairpin mode set to \"promiscuous-bridge\" but configureCBR0 is false, falling back to \"hairpin-veth\"\nI1125 16:12:26.338641    9716 kubelet.go:393] Hairpin mode set to \"hairpin-veth\"\nI1125 16:12:26.366600    9716 docker_manager.go:235] Setting dockerRoot to \/var\/lib\/docker\nI1125 16:12:26.367067    9716 server.go:746] Started kubelet v1.3.7\nE1125 16:12:26.369508    9716 kubelet.go:954] Image garbage collection failed: unable to find data for container \/\nI1125 16:12:26.370534    9716 fs_resource_analyzer.go:66] Starting FS ResourceAnalyzer\nI1125 16:12:26.370567    9716 status_manager.go:123] Starting to sync pod status with apiserver\nI1125 16:12:26.370601    9716 kubelet.go:2501] Starting kubelet main sync loop.\nI1125 16:12:26.370632    9716 kubelet.go:2510] skipping pod synchronization - [network state unknown container runtime is down]\nI1125 16:12:26.370981    9716 server.go:117] Starting to listen on 0.0.0.0:10250\nI1125 16:12:26.384336    9716 volume_manager.go:227] Starting Kubelet Volume Manager\nI1125 16:12:26.480387    9716 factory.go:295] Registering Docker factory\nI1125 16:12:26.480483    9716 factory.go:54] Registering systemd factory\nI1125 16:12:26.481446    9716 factory.go:86] Registering Raw factory\nI1125 16:12:26.482888    9716 manager.go:1072] Started watching for new ooms in manager\nI1125 16:12:26.484242    9716 oomparser.go:200] OOM parser using kernel log file: \"\/var\/log\/kern.log\"\nI1125 16:12:26.485330    9716 manager.go:281] Starting recovery of all containers\nI1125 16:12:26.562959    9716 kubelet.go:1213] Node 10.46.181.146 was previously registered\nI1125 16:12:26.712150    9716 manager.go:286] Recovery completed\n<\/code><\/pre>\n<p>\u4e00\u6b21\u70b9\u4eae\uff01<\/p>\n<p>\u518d\u6765\u4fee\u6539worker node\u4e0akube-proxy\u7684\u914d\u7f6e\uff1a\/etc\/default\/kube-proxy:<\/p>\n<pre><code>\/\/ \/etc\/default\/kube-proxy\nKUBE_PROXY_OPTS=\" --hostname-override=10.46.181.146  --master=https:\/\/10.47.136.60:6443  --logtostderr=true --kubeconfig=\/root\/.kube\/config\"\n#KUBE_PROXY_OPTS=\" --hostname-override=10.46.181.146  --master=http:\/\/10.47.136.60:8080  --logtostderr=true  \"\n\n<\/code><\/pre>\n<p>\u5728worker node\u4e0a\u91cd\u542fkube-proxy\u5e76\u67e5\u770b\/var\/log\/upstart\/kube-proxy.log\uff1a<\/p>\n<pre><code># service kube-proxy restart\nkube-proxy stop\/waiting\nkube-proxy start\/running, process 26185\n\n\/\/ \/var\/log\/upstart\/kube-proxy.log\nI1125 16:30:28.224491   26185 server.go:202] Using iptables Proxier.\nI1125 16:30:28.228067   26185 server.go:214] Tearing down userspace rules.\nI1125 16:30:28.245634   26185 conntrack.go:40] Setting nf_conntrack_max to 65536\nI1125 16:30:28.247422   26185 conntrack.go:57] Setting conntrack hashsize to 16384\nI1125 16:30:28.249456   26185 conntrack.go:62] Setting nf_conntrack_tcp_timeout_established to 86400\n\n<\/code><\/pre>\n<p>\u4ece\u65e5\u5fd7\u4e0a\u770b\u4e0d\u51fa\u6709\u5565\u5f02\u5e38\uff0c\u7b97\u662f\u6210\u529f\uff01:)<\/p>\n<h5>\u7b2c\u4e8c\u4e2a\u573a\u666f\uff1apod in cluster -&gt; master<\/h5>\n<p>\u901a\u8fc7\u9605\u8bfbK8s\u7684\u5b98\u65b9\u6587\u6863\u201c<a href=\"http:\/\/kubernetes.io\/docs\/user-guide\/accessing-the-cluster\/#accessing-the-api-from-a-pod\">Accessing the api from a pod<\/a>\u201d\uff0c\u6211\u4eec\u77e5\u9053K8s cluster\u4e3aPod\u8bbf\u95eeAPI Server\u505a\u4e86\u5f88\u591a\u201c\u9884\u5907\u201d\u5de5\u4f5c\uff0c\u6700\u91cd\u8981\u7684\u4e00\u70b9\u5c31\u662f\u5728Pod\u88ab\u521b\u5efa\u7684\u65f6\u5019\uff0c\u4e00\u4e2a<a href=\"https:\/\/github.com\/kubernetes\/kubernetes\/blob\/master\/docs\/design\/service_accounts.md\">serviceaccount<\/a> \u88ab\u81ea\u52a8mount\u5230\/var\/run\/secrets\/kubernetes.io\/serviceaccount\u8def\u5f84\u4e0b\uff1a<\/p>\n<pre><code>#kubectl describe pod\/my-golang-1147314274-0qms5\n\nName:        my-golang-1147314274-0qms5\nNamespace:    default\nNode:        10.47.136.60\/10.47.136.60\nStart Time:    Thu, 24 Nov 2016 14:59:52 +0800\nLabels:        pod-template-hash=1147314274\n        run=my-golang\nStatus:        Running\nIP:        172.16.99.9\n... ...\n\nContainers:\n  my-golang:\n    ... ...\n    Volume Mounts:\n      \/var\/run\/secrets\/kubernetes.io\/serviceaccount from default-token-40z0x (ro)\n    Environment Variables:    &lt;none&gt;\n... ...\nVolumes:\n  default-token-40z0x:\n    Type:    Secret (a volume populated by a Secret)\n    SecretName:    default-token-40z0x\nQoS Class:    BestEffort\nTolerations:    &lt;none&gt;\n<\/code><\/pre>\n<p>serviceaccount\u987e\u540d\u601d\u4e49\uff0c\u662fPod\u4e2d\u7a0b\u5e8f\u8bbf\u95eeAPIServer\u6240\u8981\u4f7f\u7528\u7684\u8d26\u6237\u4fe1\u606f\uff0c\u6211\u4eec\u6765\u770b\u770b\u90fd\u6709\u5565\uff1a<\/p>\n<pre><code># kubectl get serviceaccount\nNAME      SECRETS   AGE\ndefault   1         43d\n\n# kubectl describe serviceaccount\/default\nName:        default\nNamespace:    default\nLabels:        &lt;none&gt;\n\nImage pull secrets:    &lt;none&gt;\n\nMountable secrets:     default-token-40z0x\n\nTokens:                default-token-40z0x\n\n# kubectl describe secret\/default-token-40z0x\nName:        default-token-40z0x\nNamespace:    default\nLabels:        &lt;none&gt;\nAnnotations:    kubernetes.io\/service-account.name=default\n        kubernetes.io\/service-account.uid=90de59ad-9120-11e6-a0a6-00163e1625a9\n\nType:    kubernetes.io\/service-account-token\n\nData\n====\nca.crt:        1220 bytes\nnamespace:    7 bytes\ntoken:        {Token data}\n<\/code><\/pre>\n<p>mount\u5230Pod\u4e2d\/var\/run\/secrets\/kubernetes.io\/serviceaccount\u8def\u5f84\u4e0b\u7684default-token-40z0x volume\u5305\u542b\u4e09\u4e2a\u6587\u4ef6\uff1a<\/p>\n<ul>\n<li>ca.crt\uff1aCA\u7684\u516c\u94a5\u8bc1\u4e66<\/li>\n<li>namspace\u6587\u4ef6\uff1a\u91cc\u9762\u7684\u5185\u5bb9\u4e3a\uff1a\u201ddefault\u201d<\/li>\n<li>token\uff1a\u7528\u5728Pod\u8bbf\u95eeAPIServer\u65f6\u5019\u7684\u8eab\u4efd\u9a8c\u8bc1\u3002<\/li>\n<\/ul>\n<p>\u7406\u8bba\u4e0a\uff0c\u4f7f\u7528\u8fd9\u4e9b\u4fe1\u606fPod\u53ef\u4ee5\u6210\u529f\u8bbf\u95eeAPIServer\uff0c\u6211\u4eec\u6765\u6d4b\u8bd5\u4e00\u4e0b\u3002\u6ce8\u610f\u5728Pod\u7684\u4e16\u754c\u4e2d\uff0cAPIServer\u4e5f\u662f\u4e00\u4e2aService\uff0c\u901a\u8fc7kubectl get service\u53ef\u4ee5\u770b\u5230\uff1a<\/p>\n<pre><code># kubectl get services\nNAME           CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE\nkubernetes     192.168.3.1     &lt;none&gt;        443\/TCP    43d\n<\/code><\/pre>\n<p>kubernetes\u8fd9\u4e2aService\u76d1\u542c\u7684\u7aef\u53e3\u662f443\uff0c\u4e5f\u5c31\u662f\u8bf4\u5728Pod\u7684\u89c6\u89d2\u4e2d\uff0cAPIServer\u66b4\u9732\u7684\u4ec5\u4ec5\u662finsecure-port\u3002\u5e76\u4e14\u4f7f\u7528\u201dkubernetes\u201d\u8fd9\u4e2a\u540d\u5b57\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7<a href=\"http:\/\/tonybai.com\/2016\/10\/23\/install-dns-addon-for-k8s\/\">kube-dns<\/a>\u83b7\u5f97APIServer\u7684ClusterIP\u3002<\/p>\n<p>\u542f\u52a8\u4e00\u4e2a\u57fa\u4e8egolang:latest\u7684pod\uff0cpod.yaml\u5982\u4e0b\uff1a<\/p>\n<pre><code>apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: my-golang\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        run: my-golang\n    spec:\n      containers:\n      - name: my-golang\n        image: golang:latest\n        command: [\"tail\", \"-f\", \"\/var\/log\/bootstrap.log\"]\n<\/code><\/pre>\n<p>Pod\u542f\u52a8\u540e\uff0cdocker exec -it container-id \/bin\/bash\u5207\u5165container\uff0c\u5e76\u6267\u884c\u5982\u4e0b\u547d\u4ee4\uff1a<\/p>\n<pre><code># TOKEN=\"$(cat \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token)\"\n# curl --cacert \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt https:\/\/kubernetes:443\/version -H \"Authorization: Bearer $TOKEN\"\nUnauthorized\n<\/code><\/pre>\n<p>\u67e5\u770bAPI Server\u7684log\uff1a<\/p>\n<pre><code>E1125 17:30:22.504059 2743425 handlers.go:54] Unable to authenticate the request due to an error: crypto\/rsa: verification error\n<\/code><\/pre>\n<p>\u4f3c\u4e4e\u662f\u9a8c\u8bc1token\u5931\u8d25\u3002\u8fd9\u4e2a\u95ee\u9898\u5728kubernetes\u7684<a href=\"https:\/\/github.com\/kubernetes\/kubernetes\/issues\/22351\">github issue\u4e2d\u4e5f\u6709\u88ab\u63d0\u53ca<\/a>\uff0c\u76ee\u524d\u5c1a\u672a\u89e3\u51b3\u3002<\/p>\n<p>\u4e0d\u8fc7\u4ed4\u7ec6\u60f3\u4e86\u60f3\uff0c\u5982\u679c\u6bcf\u4e2aPod\u90fd\u9ed8\u8ba4\u53ef\u4ee5\u8bbf\u95eeAPIServer\uff0c\u663e\u7136\u4e5f\u662f\u4e0d\u5b89\u5168\u7684\uff0c\u867d\u7136\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7authority\u548cadmission control\u5bf9\u9ed8\u8ba4\u7684token\u8bbf\u95ee\u505a\u51fa\u9650\u5236\uff0c\u4f46\u603b\u611f\u89c9\u4e0d\u90a3\u4e48\u201c\u5b89\u5168\u201d\u3002<\/p>\n<p>\u6211\u4eec\u6765\u8bd5\u8bd5basic auth\u65b9\u5f0f\uff08\u8fd9\u79cd\u65b9\u5f0f\u7684\u5f0a\u7aef\u662fAPI Server\u8fd0\u884c\u4e2d\uff0c\u65e0\u6cd5\u5728\u8fd0\u884c\u65f6\u52a8\u6001\u66f4\u65b0auth\u6587\u4ef6\uff0c\u5bf9\u4e8eauth\u6587\u4ef6\u7684\u4fee\u6539\uff0c\u5fc5\u987b\u91cd\u542fAPIServer\u540e\u751f\u6548\uff09\u3002<\/p>\n<p>\u6211\u4eec\u9996\u5148\u5728APIServer\u4fa7\u4e3aAPIServer\u521b\u5efa\u4e00\u4e2abasic auth file\uff1a<\/p>\n<pre><code>\/\/ \/srv\/kubernetes\/basic_auth_file\nadmin123,admin,admin\n\n<\/code><\/pre>\n<p>basic_auth_file\u4e2d\u6bcf\u4e00\u884c\u7684\u683c\u5f0f\uff1apassword,username,useruid<\/p>\n<p>\u4fee\u6539APIServer\u7684\u542f\u52a8\u53c2\u6570\uff0c\u5c06basic_auth_file\u4f20\u5165\u5e76\u91cd\u542fapiserver\uff1a<\/p>\n<pre><code>KUBE_APISERVER_OPTS=\" --insecure-bind-address=10.47.136.60 --insecure-port=8080 --etcd-servers=http:\/\/127.0.0.1:4001 --logtostderr=true --service-cluster-ip-range=192.168.3.0\/24 --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,SecurityContextDeny,ResourceQuota --service-node-port-range=30000-32767 --advertise-address=10.47.136.60 --basic-auth-file=\/srv\/kubernetes\/basic_auth_file --client-ca-file=\/srv\/kubernetes\/ca.crt --tls-cert-file=\/srv\/kubernetes\/server.cert --tls-private-key-file=\/srv\/kubernetes\/server.key\"\n<\/code><\/pre>\n<p>\u6211\u4eec\u5728Pod\u4e2d\u4f7f\u7528basic auth\u8bbf\u95eeAPI Server\uff1a<\/p>\n<pre><code># curl --cacert \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt https:\/\/kubernetes:443\/version -basic -u admin:admin123\n{\n  \"major\": \"1\",\n  \"minor\": \"3\",\n  \"gitVersion\": \"v1.3.7\",\n  \"gitCommit\": \"a2cba278cba1f6881bb0a7704d9cac6fca6ed435\",\n  \"gitTreeState\": \"clean\",\n  \"buildDate\": \"2016-09-12T23:08:43Z\",\n  \"goVersion\": \"go1.6.2\",\n  \"compiler\": \"gc\",\n  \"platform\": \"linux\/amd64\"\n}\n<\/code><\/pre>\n<p>Pod to APIServer authentication\u6210\u529f\u4e86\u3002<\/p>\n<h4>\u516d\u3001\u5c0f\u7ed3<\/h4>\n<p>\u518d\u91cd\u7533\u4e00\u6b21\uff1a\u4e0a\u8ff0\u914d\u7f6e\u4e0d\u662f\u7edd\u5bf9\u5b89\u5168\u7684\u7406\u60f3\u914d\u7f6e\u65b9\u6848\uff0c\u53ea\u662f\u9636\u6bb5\u6027\u6ee1\u8db3\u6211\u76ee\u524d\u9879\u76ee\u9700\u6c42\u7684\u4e00\u4e2a\u201c\u6709\u9650\u5b89\u5168\u201d\u65b9\u6848\uff0c\u5927\u5bb6\u8c28\u614e\u53c2\u8003\u3002<\/p>\n<p>\u5230\u76ee\u524d\u4e3a\u6b62\uff0c\u6211\u4eec\u7684\u201c\u6709\u9650\u5b89\u5168\u201d\u4e5f\u4ec5\u4ec5\u505a\u5230Authentication\u8fd9\u4e00\u6b65\uff0c\u81f3\u4e8eAuthority\u548cAdmission Control\uff0c\u76ee\u524d\u5c1a\u672a\u6709\u76f8\u5173\u5b9e\u8df5\uff0c\u53ef\u80fd\u4f1a\u5728\u540e\u7eed\u7684\u6587\u7ae0\u4e2d\u505a\u5355\u72ec\u8bf4\u660e\u3002<\/p>\n<h4>\u4e03\u3001\u53c2\u8003\u8d44\u6599<\/h4>\n<ul>\n<li>Master &lt;-&gt; Node Communication \u2013 http:\/\/kubernetes.io\/docs\/admin\/master-node-communication\/<\/li>\n<li>Authentication \u2013 http:\/\/kubernetes.io\/docs\/admin\/authentication\/<\/li>\n<li>Using Authorization Plugins \u2013 http:\/\/kubernetes.io\/docs\/admin\/authorization\/<\/li>\n<li>Accessing the API \u2013 http:\/\/kubernetes.io\/docs\/admin\/accessing-the-api\/<\/li>\n<li>Managing Service Accounts \u2013 http:\/\/kubernetes.io\/docs\/admin\/service-accounts-admin\/<\/li>\n<li>Authenticating Across Clusters with kubeconfig \u2014 http:\/\/kubernetes.io\/docs\/user-guide\/kubeconfig-file\/<\/li>\n<li>Service Accounts \u2014 https:\/\/docs.openshift.com\/enterprise\/3.1\/dev_guide\/service_accounts.html<\/li>\n<li>4S: SERVICES ACCOUNT, SECRET, SECURITY CONTEXT AND SECURITY IN KUBERNETES \u2014 http:\/\/www.sel.zju.edu.cn\/?p=588<\/li>\n<li>KUBERNETES APISERVER\u6e90\u7801\u5206\u6790\u2014\u2014API\u8bf7\u6c42\u7684\u8ba4\u8bc1\u8fc7\u7a0b \u2013 http:\/\/www.sel.zju.edu.cn\/?p=609<\/li>\n<li>Kubernetes\u5b89\u5168\u914d\u7f6e\u6848\u4f8b \u2013 http:\/\/www.cnblogs.com\/breg\/p\/5923604.html<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u4f7f\u7528kubernetes\/cluster\/kube-up.sh\u811a\u672c\u5728\u88c5\u6709Ubuntu\u64cd\u4f5c\u7cfb\u7edf\u7684bare metal\u4e0a\u642d\u5efa\u7684Kubernetes\u96c6\u7fa4\u5e76\u4e0d\u5b89\u5168\uff0c\u751a\u81f3\u53ef\u4ee5\u8bf4\u662f\u201c\u5b8c\u5168\u4e0d\u8bbe\u9632\u7684\u201d\uff0c\u8fd9\u662f\u56e0\u4e3aKubernetes\u96c6\u7fa4\u7684\u6838\u5fc3\u7ec4\u4ef6\uff1akube-apiserver\u542f\u7528\u4e86insecure-port\u3002insecure-port\u80cc\u540e\u7684api server\u9ed8\u8ba4\u5b8c\u5168\u4fe1\u4efb\u8bbf\u95ee\u8be5\u7aef\u53e3\u7684\u6d41\u91cf\uff0c\u5185\u90e8\u65e0\u4efb\u4f55\u5b89\u5168\u673a\u5236\u3002\u5e76\u4e14\u76d1\u542cinsecure-port\u7684api server bind\u7684insecure-address\u4e3a0.0.0.0\u3002\u4e5f\u5c31\u662f\u8bf4\u4efb\u4f55\u5185\u5916\u90e8\u8bf7\u6c42\uff0c\u90fd\u53ef\u4ee5\u901a\u8fc7insecure-port\u7aef\u53e3\u4efb\u610f\u64cd\u4f5cKubernetes\u96c6\u7fa4\u3002\u6211\u4eec\u7684\u5e73\u53f0\u867d\u5c0f\uff0c\u4f46\u201c\u88f8\u5954\u201d\u7684k8s\u96c6\u7fa4\u4e5f\u5e76\u4e0d\u662f\u6211\u4eec\u60f3\u770b\u5230\u7684\uff0c\u9002\u5f53\u7684\u5b89\u5168\u914d\u7f6e\u662f\u9700\u8981\u7684\u3002 \u5728\u672c\u6587\u4e2d\uff0c\u6211\u5c06\u548c\u5927\u5bb6\u4e00\u8d77\u5b66\u4e60\u4e00\u4e0bKubernetes\u63d0\u4f9b\u7684\u5b89\u5168\u673a\u5236\uff0c\u5e76\u901a\u8fc7\u5b89\u5168\u914d\u7f6e\u8c03\u6574\uff0c\u5b9e\u73b0K8s\u96c6\u7fa4\u7684\u201c\u6709\u9650\u201d\u5b89\u5168\u3002 \u4e00\u3001\u96c6\u7fa4\u73b0\u72b6 \u6211\u4eec\u5148\u6765\u201c\u56de\u987e\u201d\u4e00\u4e0b\u96c6\u7fa4\u73b0\u72b6\uff0c\u4e3a\u540e\u7eed\u914d\u7f6e\u8c03\u6574\u63d0\u4f9b\u4e00\u4e2a\u53ef\u56de\u6eaf\u548c\u53ef\u6bd4\u5bf9\u7684\u201c\u57fa\u7ebf\u201d\u3002 1\u3001Nodes \u96c6\u7fa4\u57fa\u672c\u4fe1\u606f\uff1a # kubectl cluster-info Kubernetes master is running at http:\/\/10.47.136.60:8080 KubeDNS [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-128","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/posts\/128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=128"}],"version-history":[{"count":0,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/posts\/128\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}