kubelet是kubernetes中一個(gè)重要的組件。對(duì)pod容器的管理 ，執(zhí)行交互式命令(如 exec、run、logs 等)都離不開它，kubelet 運(yùn)行在每個(gè) worker 節(jié)點(diǎn)上，負(fù)責(zé)接收 kube-apiserver 發(fā)送的請求，kubelet 在啟動(dòng)時(shí)會(huì)自動(dòng)向 kube-apiserver 發(fā)送注冊信息，內(nèi)置的 cadvisor 統(tǒng)計(jì)和監(jiān)控節(jié)點(diǎn)的資源使用情況。

創(chuàng)新互聯(lián)建站是專業(yè)的桑日網(wǎng)站建設(shè)公司，桑日接單;提供成都網(wǎng)站制作、做網(wǎng)站、外貿(mào)營銷網(wǎng)站建設(shè),網(wǎng)頁設(shè)計(jì),網(wǎng)站設(shè)計(jì),建網(wǎng)站,PHP網(wǎng)站建設(shè)等專業(yè)做網(wǎng)站服務(wù);采用PHP框架,可快速的進(jìn)行桑日網(wǎng)站開發(fā)網(wǎng)頁制作和功能擴(kuò)展;專業(yè)做搜索引擎喜愛的網(wǎng)站,專業(yè)的做網(wǎng)站團(tuán)隊(duì),希望更多企業(yè)前來合作!

1. 準(zhǔn)備工作

特別說明：這里所有的操作都是在devops這臺(tái)機(jī)器上通過ansible工具執(zhí)行；kubelet在需要使用kubeconfig文件來認(rèn)證訪問kube-apiserver，因此需要為其開啟證書輪轉(zhuǎn)

為確保安全，部署時(shí)關(guān)閉了 kubelet 的非安全 http 端口，對(duì)請求進(jìn)行認(rèn)證和授權(quán)，拒絕未授權(quán)的訪問(如 apiserver、heapster 的請求)。

環(huán)境變量定義

#################### Variable parameter setting ######################
KUBE_NAME=kubelet
K8S_INSTALL_PATH=/data/apps/k8s/kubernetes
K8S_BIN_PATH=${K8S_INSTALL_PATH}/sbin
K8S_LOG_DIR=${K8S_INSTALL_PATH}/logs
K8S_CONF_PATH=/etc/k8s/kubernetes
KUBE_CONFIG_PATH=/etc/k8s/kubeconfig
CA_DIR=/etc/k8s/ssl
SOFTWARE=/root/software
HOSTNAME=`hostname`
VERSION=v1.14.2
DOWNLOAD_URL=https://github.com/devops-apps/download/raw/master/kubernetes/kubernetes-server-${VERSION}-linux-amd64.tar.gz
ETH_INTERFACE=eth2
LISTEN_IP=$(ifconfig | grep -A 1 ${ETH_INTERFACE} |grep inet |awk '{print $2}')
USER=k8s
CLUSTER_DNS_DOMAIN=k8s.mo9.com
CLUSTER_DNS_IP=10.254.0.2
CLUSTER_PODS_CIDR=172.16.0.0/20

2 部署kubelet組件

2.1 安裝kubelet二進(jìn)制文件

### 1.Check if the install directory exists.
if [ ! -d "$K8S_BIN_PATH" ]; then
     mkdir -p $K8S_BIN_PATH
fi

if [ ! -d "$K8S_LOG_DIR/$KUBE_NAME" ]; then
     mkdir -p $K8S_LOG_DIR/$KUBE_NAME
fi

if [ ! -d "$K8S_CONF_PATH" ]; then
     mkdir -p $K8S_CONF_PATH
fi

if [ ! -d "$KUBE_CONFIG_PATH" ]; then
     mkdir -p $KUBE_CONFIG_PATH
fi

### 2.Install kubelet binary of kubernetes.
if [ ! -f "$SOFTWARE/kubernetes-server-${VERSION}-linux-amd64.tar.gz" ]; then
     wget $DOWNLOAD_URL -P $SOFTWARE >>/tmp/install.log  2>&1
fi
cd $SOFTWARE && tar -xzf kubernetes-server-${VERSION}-linux-amd64.tar.gz -C ./
cp -fp kubernetes/server/bin/$KUBE_NAME $K8S_BIN_PATH
ln -sf  $K8S_BIN_PATH/${KUBE_NAME} /usr/local/bin
chmod -R 755 $K8S_INSTALL_PATH

2.3 創(chuàng)建kubelet配置文件

```# configure default system config
cat >${K8S_CONF_PATH}/kubelet-config.yaml <kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: "${LISTEN_IP}"
staticPodPath: ""
syncFrequency: 1m
fileCheckFrequency: 20s
httpCheckFrequency: 20s
staticPodURL: ""
port: 10250
readOnlyPort: 0
rotateCertificates: true
serverTLSBootstrap: true
authentication:
anonymous:
enabled: false
webhook:
enabled: true
cacheTTL: 2m0s
x509:
clientCAFile: "${CA_DIR}/ca.pem"
authorization:
mode: Webhook
registryPullQPS: 0
registryBurst: 20
eventRecordQPS: 0
eventBurst: 20
enableDebuggingHandlers: true
enableContentionProfiling: true
healthzPort: 10248
healthzBindAddress: "${LISTEN_IP}"
clusterDomain: "${CLUSTER_DNS_DOMAIN}"
clusterDNS:

• "${CLUSTER_DNS_IP}"
  nodeStatusUpdateFrequency: 10s
  nodeStatusReportFrequency: 1m
  imageMinimumGCAge: 2m
  imageGCHighThresholdPercent: 85
  imageGCLowThresholdPercent: 80
  volumeStatsAggPeriod: 1m
  kubeletCgroups: ""
  systemCgroups: ""
  cgroupRoot: ""
  cgroupsPerQOS: true
  cgroupDriver: cgroupfs
  runtimeRequestTimeout: 10m
  hairpinMode: promiscuous-bridge
  maxPods: 220
  podCIDR: "${CLUSTER_PODS_CIDR}"
  podPidsLimit: -1
  resolvConf: /etc/resolv.conf
  maxOpenFiles: 1000000
  kubeAPIQPS: 1000
  kubeAPIBurst: 2000
  serializeImagePulls: false
  evictionHard:
  memory.available: "100Mi"
  nodefs.available: "10%"
  nodefs.inodesFree: "5%"
  imagefs.available: "15%"
  evictionSoft: {}
  enableControllerAttachDetach: true
  failSwapOn: true
  containerLogMaxSize: 20Mi
  containerLogMaxFiles: 10
  systemReserved: {}
  kubeReserved: {}
  systemReservedCgroup: ""
  kubeReservedCgroup: ""
  enforceNodeAllocatable: ["pods"]
  EOF

  
  * address：kubelet 安全端口（https，10250）監(jiān)聽的地址，不能為 127.0.0.1，否則 kube-apiserver、heapster 等不能調(diào)用 kubelet 的 API；
  * readOnlyPort=0：關(guān)閉只讀端口(默認(rèn) 10255)，等效為未指定；
  * authentication.anonymous.enabled：設(shè)置為 false，不允許匿名?訪問 10250 端口；
  * authentication.x509.clientCAFile：指定簽名客戶端證書的 CA 證書，開啟 HTTP 證書認(rèn)證；
  * authentication.webhook.enabled=true：開啟 HTTPs bearer token 認(rèn)證；
  * 對(duì)于未通過 x509 證書和 webhook 認(rèn)證的請求(kube-apiserver 或其他客戶端)，將被拒絕，提示 Unauthorized；
  * authroization.mode=Webhook：kubelet 使用 SubjectAcce***eview API 查詢 kube-apiserver 某 user、group 是否具有操作資源的權(quán)限(RBAC)；
  * featureGates.RotateKubeletClientCertificate、featureGates.RotateKubeletServerCertificate：自動(dòng) rotate 證書，證書的有效期取決于 kube-controller-manager 的 --experimental-cluster-signing-duration 參數(shù)；
  * 需要 root 賬戶運(yùn)行；

2.4 創(chuàng)建kubelet 啟動(dòng)服務(wù)

cat >/usr/lib/systemd/system/${KUBE_NAME}.service<