07-2.部署 kubelet 组件

kubelet 运行在每个 worker 节点上，接收 kube-apiserver 发送的请求，管理 Pod 容器，执行交互式命令，如 exec、run、logs 等。

kubelet 启动时自动向 kube-apiserver 注册节点信息，内置的 cadvisor 统计和监控节点的资源使用情况。

为确保安全，部署时关闭了 kubelet 的非安全 http 端口，对请求进行认证和授权，拒绝未授权的访问(如 apiserver、heapster 的请求)。

注意：如果没有特殊指明，本文档的所有操作均在 zhangjun-k8s01 节点上执行，然后远程分发文件和执行命令。

下载和分发 kubelet 二进制文件

参考 06-1.部署master节点.md。

安装依赖包

参考 07-0.部署worker节点.md。

创建 kubelet bootstrap kubeconfig 文件

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_name in ${NODE_NAMES[@]}
  4.   do
  5.     echo ">>> ${node_name}"
  7.     # 创建 token
  8.     export BOOTSTRAP_TOKEN=$(kubeadm token create \
  9.       --description kubelet-bootstrap-token \
  10.       --groups system:bootstrappers:${node_name} \
  11.       --kubeconfig ~/.kube/config)
  13.     # 设置集群参数
  14.     kubectl config set-cluster kubernetes \
  15.       --certificate-authority=/etc/kubernetes/cert/ca.pem \
  16.       --embed-certs=true \
  17.       --server=${KUBE_APISERVER} \
  18.       --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  20.     # 设置客户端认证参数
  21.     kubectl config set-credentials kubelet-bootstrap \
  22.       --token=${BOOTSTRAP_TOKEN} \
  23.       --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  25.     # 设置上下文参数
  26.     kubectl config set-context default \
  27.       --cluster=kubernetes \
  28.       --user=kubelet-bootstrap \
  29.       --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  31.     # 设置默认上下文
  32.     kubectl config use-context default --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig
  33.   done
  • 向 kubeconfig 写入的是 token，bootstrap 结束后 kube-controller-manager 为 kubelet 创建 client 和 server 证书；

查看 kubeadm 为各节点创建的 token：

  1. $ kubeadm token list --kubeconfig ~/.kube/config
  2. TOKEN                     TTL       EXPIRES                     USAGES                   DESCRIPTION               EXTRA GROUPS
  3. 3gzd53.ahl5unc2d09yjid9   23h       2019-05-27T11:29:57+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:zhangjun-k8s02
  4. 82jfrm.um1mkjkr7w2c7ex9   23h       2019-05-27T11:29:56+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:zhangjun-k8s01
  5. b1f7np.lwnnzur3i8ymtkur   23h       2019-05-27T11:29:57+08:00   authentication,signing   kubelet-bootstrap-token   system:bootstrappers:zhangjun-k8s03
  • token 有效期为 1 天，超期后将不能再被用来 boostrap kubelet，且会被 kube-controller-manager 的 tokencleaner 清理；
  • kube-apiserver 接收 kubelet 的 bootstrap token 后，将请求的 user 设置为 system:bootstrap:<Token ID>，group 设置为 system:bootstrappers，后续将为这个 group 设置 ClusterRoleBinding；

查看各 token 关联的 Secret：

  1. $ kubectl get secrets  -n kube-system|grep bootstrap-token
  2. bootstrap-token-3gzd53                           bootstrap.kubernetes.io/token         7      33s
  3. bootstrap-token-82jfrm                           bootstrap.kubernetes.io/token         7      34s
  4. bootstrap-token-b1f7np                           bootstrap.kubernetes.io/token         7      33s

分发 bootstrap kubeconfig 文件到所有 worker 节点

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_name in ${NODE_NAMES[@]}
  4.   do
  5.     echo ">>> ${node_name}"
  6.     scp kubelet-bootstrap-${node_name}.kubeconfig root@${node_name}:/etc/kubernetes/kubelet-bootstrap.kubeconfig
  7.   done

创建和分发 kubelet 参数配置文件

从 v1.10 开始，部分 kubelet 参数需在配置文件中配置，kubelet --help 会提示：

  1. DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag

创建 kubelet 参数配置文件模板（可配置项参考代码中注释 ）：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. cat > kubelet-config.yaml.template <<EOF
  4. kind: KubeletConfiguration
  5. apiVersion: kubelet.config.k8s.io/v1beta1
  6. address: "##NODE_IP##"
  7. staticPodPath: ""
  8. syncFrequency: 1m
  9. fileCheckFrequency: 20s
  10. httpCheckFrequency: 20s
  11. staticPodURL: ""
  12. port: 10250
  13. readOnlyPort: 0
  14. rotateCertificates: true
  15. serverTLSBootstrap: true
  16. authentication:
  17.   anonymous:
  18.     enabled: false
  19.   webhook:
  20.     enabled: true
  21.   x509:
  22.     clientCAFile: "/etc/kubernetes/cert/ca.pem"
  23. authorization:
  24.   mode: Webhook
  25. registryPullQPS: 0
  26. registryBurst: 20
  27. eventRecordQPS: 0
  28. eventBurst: 20
  29. enableDebuggingHandlers: true
  30. enableContentionProfiling: true
  31. healthzPort: 10248
  32. healthzBindAddress: "##NODE_IP##"
  33. clusterDomain: "${CLUSTER_DNS_DOMAIN}"
  34. clusterDNS:
  35.   - "${CLUSTER_DNS_SVC_IP}"
  36. nodeStatusUpdateFrequency: 10s
  37. nodeStatusReportFrequency: 1m
  38. imageMinimumGCAge: 2m
  39. imageGCHighThresholdPercent: 85
  40. imageGCLowThresholdPercent: 80
  41. volumeStatsAggPeriod: 1m
  42. kubeletCgroups: ""
  43. systemCgroups: ""
  44. cgroupRoot: ""
  45. cgroupsPerQOS: true
  46. cgroupDriver: cgroupfs
  47. runtimeRequestTimeout: 10m
  48. hairpinMode: promiscuous-bridge
  49. maxPods: 220
  50. podCIDR: "${CLUSTER_CIDR}"
  51. podPidsLimit: -1
  52. resolvConf: /etc/resolv.conf
  53. maxOpenFiles: 1000000
  54. kubeAPIQPS: 1000
  55. kubeAPIBurst: 2000
  56. serializeImagePulls: false
  57. evictionHard:
  58.   memory.available:  "100Mi"
  59. nodefs.available:  "10%"
  60. nodefs.inodesFree: "5%"
  61. imagefs.available: "15%"
  62. evictionSoft: {}
  63. enableControllerAttachDetach: true
  64. failSwapOn: true
  65. containerLogMaxSize: 20Mi
  66. containerLogMaxFiles: 10
  67. systemReserved: {}
  68. kubeReserved: {}
  69. systemReservedCgroup: ""
  70. kubeReservedCgroup: ""
  71. enforceNodeAllocatable: ["pods"]
  72. EOF
  • address：kubelet 安全端口（https，10250）监听的地址，不能为 127.0.0.1，否则 kube-apiserver、heapster 等不能调用 kubelet 的 API；
  • readOnlyPort=0：关闭只读端口(默认 10255)，等效为未指定；
  • authentication.anonymous.enabled：设置为 false，不允许匿名访问 10250 端口；
  • authentication.x509.clientCAFile：指定签名客户端证书的 CA 证书，开启 HTTP 证书认证；
  • authentication.webhook.enabled=true：开启 HTTPs bearer token 认证；
  • 对于未通过 x509 证书和 webhook 认证的请求(kube-apiserver 或其他客户端)，将被拒绝，提示 Unauthorized；
  • authroization.mode=Webhook：kubelet 使用 SubjectAccessReview API 查询 kube-apiserver 某 user、group 是否具有操作资源的权限(RBAC)；
  • featureGates.RotateKubeletClientCertificate、featureGates.RotateKubeletServerCertificate：自动 rotate 证书，证书的有效期取决于 kube-controller-manager 的 —experimental-cluster-signing-duration 参数；
  • 需要 root 账户运行；

为各节点创建和分发 kubelet 配置文件：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_ip in ${NODE_IPS[@]}
  4.   do 
  5.     echo ">>> ${node_ip}"
  6.     sed -e "s/##NODE_IP##/${node_ip}/" kubelet-config.yaml.template > kubelet-config-${node_ip}.yaml.template
  7.     scp kubelet-config-${node_ip}.yaml.template root@${node_ip}:/etc/kubernetes/kubelet-config.yaml
  8.   done

创建和分发 kubelet systemd unit 文件

创建 kubelet systemd unit 文件模板：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. cat > kubelet.service.template <<EOF
  4. [Unit]
  5. Description=Kubernetes Kubelet
  6. Documentation=https://github.com/GoogleCloudPlatform/kubernetes
  7. After=docker.service
  8. Requires=docker.service
  10. [Service]
  11. WorkingDirectory=${K8S_DIR}/kubelet
  12. ExecStart=/opt/k8s/bin/kubelet \\
  13.   --allow-privileged=true \\
  14.   --bootstrap-kubeconfig=/etc/kubernetes/kubelet-bootstrap.kubeconfig \\
  15.   --cert-dir=/etc/kubernetes/cert \\
  16.   --cni-conf-dir=/etc/cni/net.d \\
  17.   --container-runtime=docker \\
  18.   --container-runtime-endpoint=unix:///var/run/dockershim.sock \\
  19.   --root-dir=${K8S_DIR}/kubelet \\
  20.   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\
  21.   --config=/etc/kubernetes/kubelet-config.yaml \\
  22.   --hostname-override=##NODE_NAME## \\
  23.   --pod-infra-container-image=registry.cn-beijing.aliyuncs.com/images_k8s/pause-amd64:3.1 \\
  24.   --image-pull-progress-deadline=15m \\
  25.   --volume-plugin-dir=${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/ \\
  26.   --logtostderr=true \\
  27.   --v=2
  28. Restart=always
  29. RestartSec=5
  30. StartLimitInterval=0
  32. [Install]
  33. WantedBy=multi-user.target
  34. EOF
  • 如果设置了 --hostname-override 选项，则 kube-proxy 也需要设置该选项，否则会出现找不到 Node 的情况；
  • --bootstrap-kubeconfig：指向 bootstrap kubeconfig 文件，kubelet 使用该文件中的用户名和 token 向 kube-apiserver 发送 TLS Bootstrapping 请求；
  • K8S approve kubelet 的 csr 请求后，在 --cert-dir 目录创建证书和私钥文件，然后写入 --kubeconfig 文件；
  • --pod-infra-container-image 不使用 redhat 的 pod-infrastructure:latest 镜像，它不能回收容器的僵尸；

为各节点创建和分发 kubelet systemd unit 文件：

  1. cd /opt/k8s/work
  2. source /opt/k8s/bin/environment.sh
  3. for node_name in ${NODE_NAMES[@]}
  4.   do 
  5.     echo ">>> ${node_name}"
  6.     sed -e "s/##NODE_NAME##/${node_name}/" kubelet.service.template > kubelet-${node_name}.service
  7.     scp kubelet-${node_name}.service root@${node_name}:/etc/systemd/system/kubelet.service
  8.   done

Bootstrap Token Auth 和授予权限

kubelet 启动时查找 --kubeletconfig 参数对应的文件是否存在，如果不存在则使用 --bootstrap-kubeconfig 指定的 kubeconfig 文件向 kube-apiserver 发送证书签名请求 (CSR)。

kube-apiserver 收到 CSR 请求后，对其中的 Token 进行认证，认证通过后将请求的 user 设置为 system:bootstrap:<Token ID>，group 设置为 system:bootstrappers，这一过程称为 Bootstrap Token Auth。

默认情况下，这个 user 和 group 没有创建 CSR 的权限，kubelet 启动失败，错误日志如下：

  1. $ sudo journalctl -u kubelet -a |grep -A 2 'certificatesigningrequests'
  2. May 26 12:13:41 zhangjun-k8s01 kubelet[128468]: I0526 12:13:41.798230  128468 certificate_manager.go:366] Rotating certificates
  3. May 26 12:13:41 zhangjun-k8s01 kubelet[128468]: E0526 12:13:41.801997  128468 certificate_manager.go:385] Failed while requesting a signed certificate from the master: cannot cre
  4. ate certificate signing request: certificatesigningrequests.certificates.k8s.io is forbidden: User "system:bootstrap:82jfrm" cannot create resource "certificatesigningrequests" i
  5. n API group "certificates.k8s.io" at the cluster scope
  6. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.044828  128468 kubelet.go:2244] node "zhangjun-k8s01" not found
  7. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.078658  128468 reflector.go:126] k8s.io/kubernetes/pkg/kubelet/kubelet.go:442: Failed to list *v1.Service: Unauthor
  8. ized
  9. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.079873  128468 reflector.go:126] k8s.io/kubernetes/pkg/kubelet/kubelet.go:451: Failed to list *v1.Node: Unauthorize
  10. d
  11. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.082683  128468 reflector.go:126] k8s.io/client-go/informers/factory.go:133: Failed to list *v1beta1.CSIDriver: Unau
  12. thorized
  13. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.084473  128468 reflector.go:126] k8s.io/kubernetes/pkg/kubelet/config/apiserver.go:47: Failed to list *v1.Pod: Unau
  14. thorized
  15. May 26 12:13:42 zhangjun-k8s01 kubelet[128468]: E0526 12:13:42.088466  128468 reflector.go:126] k8s.io/client-go/informers/factory.go:133: Failed to list *v1beta1.RuntimeClass: U
  16. nauthorized

解决办法是：创建一个 clusterrolebinding，将 group system:bootstrappers 和 clusterrole system:node-bootstrapper 绑定：

  1. $ kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --group=system:bootstrappers

启动 kubelet 服务

  1. source /opt/k8s/bin/environment.sh
  2. for node_ip in ${NODE_IPS[@]}
  3.   do
  4.     echo ">>> ${node_ip}"
  5.     ssh root@${node_ip} "mkdir -p ${K8S_DIR}/kubelet/kubelet-plugins/volume/exec/"
  6.     ssh root@${node_ip} "/usr/sbin/swapoff -a"
  7.     ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kubelet && systemctl restart kubelet"
  8.   done
  • 启动服务前必须先创建工作目录；
  • 关闭 swap 分区，否则 kubelet 会启动失败；
  1. $ journalctl -u kubelet |tail
  2. 8月 15 12:16:49 zhangjun-k8s01 kubelet[7807]: I0815 12:16:49.578598    7807 feature_gate.go:230] feature gates: &{map[RotateKubeletClientCertificate:true RotateKubeletServerCertificate:true]}
  3. 8月 15 12:16:49 zhangjun-k8s01 kubelet[7807]: I0815 12:16:49.578698    7807 feature_gate.go:230] feature gates: &{map[RotateKubeletClientCertificate:true RotateKubeletServerCertificate:true]}
  4. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.205871    7807 mount_linux.go:214] Detected OS with systemd
  5. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.205939    7807 server.go:408] Version: v1.11.2
  6. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206013    7807 feature_gate.go:230] feature gates: &{map[RotateKubeletClientCertificate:true RotateKubeletServerCertificate:true]}
  7. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206101    7807 feature_gate.go:230] feature gates: &{map[RotateKubeletServerCertificate:true RotateKubeletClientCertificate:true]}
  8. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206217    7807 plugins.go:97] No cloud provider specified.
  9. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206237    7807 server.go:524] No cloud provider specified: "" from the config file: ""
  10. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.206264    7807 bootstrap.go:56] Using bootstrap kubeconfig to generate TLS client cert, key and kubeconfig file
  11. 8月 15 12:16:50 zhangjun-k8s01 kubelet[7807]: I0815 12:16:50.208628    7807 bootstrap.go:86] No valid private key and/or certificate found, reusing existing private key or creating a new one

kubelet 启动后使用 —bootstrap-kubeconfig 向 kube-apiserver 发送 CSR 请求，当这个 CSR 被 approve 后，kube-controller-manager 为 kubelet 创建 TLS 客户端证书、私钥和 —kubeletconfig 文件。

注意：kube-controller-manager 需要配置 --cluster-signing-cert-file 和 --cluster-signing-key-file 参数，才会为 TLS Bootstrap 创建证书和私钥。

  1. $ kubectl get csr
  2. NAME                                                   AGE       REQUESTOR                 CONDITION
  3. csr-5f4vh   31s   system:bootstrap:82jfrm   Pending
  4. csr-5rw7s   29s   system:bootstrap:b1f7np   Pending
  5. csr-m29fm   31s   system:bootstrap:3gzd53   Pending
  7. $ kubectl get nodes
  8. No resources found.
  • 三个 worker 节点的 csr 均处于 pending 状态；

自动 approve CSR 请求

创建三个 ClusterRoleBinding，分别用于自动 approve client、renew client、renew server 证书：

  1. cd /opt/k8s/work
  2. cat > csr-crb.yaml <<EOF
  3.  # Approve all CSRs for the group "system:bootstrappers"
  4.  kind: ClusterRoleBinding
  5.  apiVersion: rbac.authorization.k8s.io/v1
  6.  metadata:
  7.    name: auto-approve-csrs-for-group
  8.  subjects:
  9.  - kind: Group
  10.    name: system:bootstrappers
  11.    apiGroup: rbac.authorization.k8s.io
  12.  roleRef:
  13.    kind: ClusterRole
  14.    name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
  15.    apiGroup: rbac.authorization.k8s.io
  16. ---
  17.  # To let a node of the group "system:nodes" renew its own credentials
  18.  kind: ClusterRoleBinding
  19.  apiVersion: rbac.authorization.k8s.io/v1
  20.  metadata:
  21.    name: node-client-cert-renewal
  22.  subjects:
  23.  - kind: Group
  24.    name: system:nodes
  25.    apiGroup: rbac.authorization.k8s.io
  26.  roleRef:
  27.    kind: ClusterRole
  28.    name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
  29.    apiGroup: rbac.authorization.k8s.io
  30. ---
  31. # A ClusterRole which instructs the CSR approver to approve a node requesting a
  32. # serving cert matching its client cert.
  33. kind: ClusterRole
  34. apiVersion: rbac.authorization.k8s.io/v1
  35. metadata:
  36.   name: approve-node-server-renewal-csr
  37. rules:
  38. - apiGroups: ["certificates.k8s.io"]
  39.   resources: ["certificatesigningrequests/selfnodeserver"]
  40.   verbs: ["create"]
  41. ---
  42.  # To let a node of the group "system:nodes" renew its own server credentials
  43.  kind: ClusterRoleBinding
  44.  apiVersion: rbac.authorization.k8s.io/v1
  45.  metadata:
  46.    name: node-server-cert-renewal
  47.  subjects:
  48.  - kind: Group
  49.    name: system:nodes
  50.    apiGroup: rbac.authorization.k8s.io
  51.  roleRef:
  52.    kind: ClusterRole
  53.    name: approve-node-server-renewal-csr
  54.    apiGroup: rbac.authorization.k8s.io
  55. EOF
  56. kubectl apply -f csr-crb.yaml
  • auto-approve-csrs-for-group：自动 approve node 的第一次 CSR； 注意第一次 CSR 时，请求的 Group 为 system:bootstrappers；
  • node-client-cert-renewal：自动 approve node 后续过期的 client 证书，自动生成的证书 Group 为 system:nodes;
  • node-server-cert-renewal：自动 approve node 后续过期的 server 证书，自动生成的证书 Group 为 system:nodes;

查看 kubelet 的情况

等待一段时间(1-10 分钟)，三个节点的 CSR 都被自动 approved：

  1. $ kubectl get csr
  2. NAME                                                   AGE       REQUESTOR                 CONDITION
  3. csr-5f4vh   7m59s   system:bootstrap:82jfrm      Approved,Issued
  4. csr-5r7j7   4m45s   system:node:zhangjun-k8s03   Pending
  5. csr-5rw7s   7m57s   system:bootstrap:b1f7np      Approved,Issued
  6. csr-9snww   6m37s   system:bootstrap:82jfrm      Approved,Issued
  7. csr-c7z56   4m46s   system:node:zhangjun-k8s02   Pending
  8. csr-j55lh   4m46s   system:node:zhangjun-k8s01   Pending
  9. csr-m29fm   7m59s   system:bootstrap:3gzd53      Approved,Issued
  10. csr-rc8w7   6m37s   system:bootstrap:3gzd53      Approved,Issued
  11. csr-vd52r   6m36s   system:bootstrap:b1f7np      Approved,Issued
  • Pending 的 CSR 用于创建 kubelet server 证书，需要手动 approve，参考后文。

所有节点均 ready：

  1. $ kubectl get nodes
  2. NAME             STATUS   ROLES    AGE    VERSION
  3. zhangjun-k8s01   Ready    <none>   5m5s   v1.14.2
  4. zhangjun-k8s02   Ready    <none>   5m5s   v1.14.2
  5. zhangjun-k8s03   Ready    <none>   5m4s   v1.14.2

kube-controller-manager 为各 node 生成了 kubeconfig 文件和公私钥：

  1. $ ls -l /etc/kubernetes/kubelet.kubeconfig
  2. -rw------- 1 root root 2306 May 26 12:17 /etc/kubernetes/kubelet.kubeconfig
  4. $ ls -l /etc/kubernetes/cert/|grep kubelet
  5. -rw------- 1 root root 1281 May 26 12:19 kubelet-client-2019-05-26-12-19-25.pem
  6. lrwxrwxrwx 1 root root   59 May 26 12:19 kubelet-client-current.pem -> /etc/kubernetes/cert/kubelet-client-2019-05-26-12-19-25.pem
  • 没有自动生成 kubelet server 证书；

手动 approve server cert csr

基于安全性考虑，CSR approving controllers 不会自动 approve kubelet server 证书签名请求，需要手动 approve：

  1. $ kubectl get csr
  2. NAME        AGE     REQUESTOR                    CONDITION
  3. csr-5f4vh   9m25s   system:bootstrap:82jfrm      Approved,Issued
  4. csr-5r7j7   6m11s   system:node:zhangjun-k8s03   Pending
  5. csr-5rw7s   9m23s   system:bootstrap:b1f7np      Approved,Issued
  6. csr-9snww   8m3s    system:bootstrap:82jfrm      Approved,Issued
  7. csr-c7z56   6m12s   system:node:zhangjun-k8s02   Pending
  8. csr-j55lh   6m12s   system:node:zhangjun-k8s01   Pending
  9. csr-m29fm   9m25s   system:bootstrap:3gzd53      Approved,Issued
  10. csr-rc8w7   8m3s    system:bootstrap:3gzd53      Approved,Issued
  11. csr-vd52r   8m2s    system:bootstrap:b1f7np      Approved,Issued
  13. $ kubectl certificate approve csr-5r7j7
  14. certificatesigningrequest.certificates.k8s.io/csr-5r7j7 approved
  16. $ kubectl certificate approve csr-c7z56
  17. certificatesigningrequest.certificates.k8s.io/csr-c7z56 approved
  19. $ kubectl certificate approve csr-j55lh
  20. certificatesigningrequest.certificates.k8s.io/csr-j55lh approved
  22. $  ls -l /etc/kubernetes/cert/kubelet-*
  23. -rw------- 1 root root 1281 May 26 12:19 /etc/kubernetes/cert/kubelet-client-2019-05-26-12-19-25.pem
  24. lrwxrwxrwx 1 root root   59 May 26 12:19 /etc/kubernetes/cert/kubelet-client-current.pem -> /etc/kubernetes/cert/kubelet-client-2019-05-26-12-19-25.pem
  25. -rw------- 1 root root 1326 May 26 12:26 /etc/kubernetes/cert/kubelet-server-2019-05-26-12-26-39.pem
  26. lrwxrwxrwx 1 root root   59 May 26 12:26 /etc/kubernetes/cert/kubelet-server-current.pem -> /etc/kubernetes/cert/kubelet-server-2019-05-26-12-26-39.pem

kubelet 提供的 API 接口

kubelet 启动后监听多个端口，用于接收 kube-apiserver 或其它客户端发送的请求：

  1. $ sudo netstat -lnpt|grep kubelet
  2. tcp        0      0 127.0.0.1:46571         0.0.0.0:*               LISTEN      129697/kubelet
  3. tcp        0      0 172.27.137.240:10248    0.0.0.0:*               LISTEN      129697/kubelet
  4. tcp        0      0 172.27.137.240:10250    0.0.0.0:*               LISTEN      129697/kubelet
  • 10248: healthz http 服务；
  • 10250: https 服务，访问该端口时需要认证和授权（即使访问 /healthz 也需要）；
  • 未开启只读端口 10255；
  • 从 K8S v1.10 开始，去除了 --cadvisor-port 参数（默认 4194 端口），不支持访问 cAdvisor UI & API。

例如执行 kubectl exec -it nginx-ds-5rmws -- sh 命令时，kube-apiserver 会向 kubelet 发送如下请求：

  1. POST /exec/default/nginx-ds-5rmws/my-nginx?command=sh&input=1&output=1&tty=1

kubelet 接收 10250 端口的 https 请求，可以访问如下资源：

  • /pods、/runningpods
  • /metrics、/metrics/cadvisor、/metrics/probes
  • /spec
  • /stats、/stats/container
  • /logs
  • /run/、/exec/, /attach/, /portForward/, /containerLogs/

详情参考：https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/server/server.go#L434:3

由于关闭了匿名认证，同时开启了 webhook 授权，所有访问 10250 端口 https API 的请求都需要被认证和授权。

预定义的 ClusterRole system:kubelet-api-admin 授予访问 kubelet 所有 API 的权限(kube-apiserver 使用的 kubernetes 证书 User 授予了该权限)：

  1. $ kubectl describe clusterrole system:kubelet-api-admin
  2. Name:         system:kubelet-api-admin
  3. Labels:       kubernetes.io/bootstrapping=rbac-defaults
  4. Annotations:  rbac.authorization.kubernetes.io/autoupdate=true
  5. PolicyRule:
  6.   Resources      Non-Resource URLs  Resource Names  Verbs
  7.   ---------      -----------------  --------------  -----
  8.   nodes          []                 []              [get list watch proxy]
  9.   nodes/log      []                 []              [*]
  10.   nodes/metrics  []                 []              [*]
  11.   nodes/proxy    []                 []              [*]
  12.   nodes/spec     []                 []              [*]
  13.   nodes/stats    []                 []              [*]

kubelet api 认证和授权

kubelet 配置了如下认证参数：

  • authentication.anonymous.enabled：设置为 false，不允许匿名访问 10250 端口；
  • authentication.x509.clientCAFile：指定签名客户端证书的 CA 证书，开启 HTTPs 证书认证；
  • authentication.webhook.enabled=true：开启 HTTPs bearer token 认证；

同时配置了如下授权参数：

  • authroization.mode=Webhook：开启 RBAC 授权；

kubelet 收到请求后，使用 clientCAFile 对证书签名进行认证，或者查询 bearer token 是否有效。如果两者都没通过，则拒绝请求，提示 Unauthorized：

  1. $ curl -s --cacert /etc/kubernetes/cert/ca.pem https://172.27.137.240:10250/metrics
  2. Unauthorized
  4. $ curl -s --cacert /etc/kubernetes/cert/ca.pem -H "Authorization: Bearer 123456" https://172.27.137.240:10250/metrics
  5. Unauthorized

通过认证后，kubelet 使用 SubjectAccessReview API 向 kube-apiserver 发送请求，查询证书或 token 对应的 user、group 是否有操作资源的权限(RBAC)；

证书认证和授权

  1. $ # 权限不足的证书；
  2. $ curl -s --cacert /etc/kubernetes/cert/ca.pem --cert /etc/kubernetes/cert/kube-controller-manager.pem --key /etc/kubernetes/cert/kube-controller-manager-key.pem https://172.27.137.240:10250/metrics
  3. Forbidden (user=system:kube-controller-manager, verb=get, resource=nodes, subresource=metrics)
  5. $ # 使用部署 kubectl 命令行工具时创建的、具有最高权限的 admin 证书；
  6. $ curl -s --cacert /etc/kubernetes/cert/ca.pem --cert /opt/k8s/work/admin.pem --key /opt/k8s/work/admin-key.pem https://172.27.137.240:10250/metrics|head
  7. # HELP apiserver_audit_event_total Counter of audit events generated and sent to the audit backend.
  8. # TYPE apiserver_audit_event_total counter
  9. apiserver_audit_event_total 0
  10. # HELP apiserver_audit_requests_rejected_total Counter of apiserver requests rejected due to an error in audit logging backend.
  11. # TYPE apiserver_audit_requests_rejected_total counter
  12. apiserver_audit_requests_rejected_total 0
  13. # HELP apiserver_client_certificate_expiration_seconds Distribution of the remaining lifetime on the certificate used to authenticate a request.
  14. # TYPE apiserver_client_certificate_expiration_seconds histogram
  15. apiserver_client_certificate_expiration_seconds_bucket{le="0"} 0
  16. apiserver_client_certificate_expiration_seconds_bucket{le="1800"} 0
  • --cacert、--cert、--key 的参数值必须是文件路径，如上面的 ./admin.pem 不能省略 ./，否则返回 401 Unauthorized；

bear token 认证和授权

创建一个 ServiceAccount，将它和 ClusterRole system:kubelet-api-admin 绑定，从而具有调用 kubelet API 的权限：

  1. kubectl create sa kubelet-api-test
  2. kubectl create clusterrolebinding kubelet-api-test --clusterrole=system:kubelet-api-admin --serviceaccount=default:kubelet-api-test
  3. SECRET=$(kubectl get secrets | grep kubelet-api-test | awk '{print $1}')
  4. TOKEN=$(kubectl describe secret ${SECRET} | grep -E '^token' | awk '{print $2}')
  5. echo ${TOKEN}
  1. $ curl -s --cacert /etc/kubernetes/cert/ca.pem -H "Authorization: Bearer ${TOKEN}" https://172.27.137.240:10250/metrics|head
  2. # HELP apiserver_audit_event_total Counter of audit events generated and sent to the audit backend.
  3. # TYPE apiserver_audit_event_total counter
  4. apiserver_audit_event_total 0
  5. # HELP apiserver_audit_requests_rejected_total Counter of apiserver requests rejected due to an error in audit logging backend.
  6. # TYPE apiserver_audit_requests_rejected_total counter
  7. apiserver_audit_requests_rejected_total 0
  8. # HELP apiserver_client_certificate_expiration_seconds Distribution of the remaining lifetime on the certificate used to authenticate a request.
  9. # TYPE apiserver_client_certificate_expiration_seconds histogram
  10. apiserver_client_certificate_expiration_seconds_bucket{le="0"} 0
  11. apiserver_client_certificate_expiration_seconds_bucket{le="1800"} 0

cadvisor 和 metrics

cadvisor 是内嵌在 kubelet 二进制中的，统计所在节点各容器的资源(CPU、内存、磁盘、网卡)使用情况的服务。

浏览器访问 https://172.27.137.240:10250/metrics 和 https://172.27.137.240:10250/metrics/cadvisor 分别返回 kubelet 和 cadvisor 的 metrics。

kubelet-metrics cadvisor-metrics

注意：

  • kubelet.config.json 设置 authentication.anonymous.enabled 为 false，不允许匿名证书访问 10250 的 https 服务；
  • 参考A.浏览器访问kube-apiserver安全端口.md，创建和导入相关证书，然后访问上面的 10250 端口；

获取 kubelet 的配置

从 kube-apiserver 获取各节点 kubelet 的配置：

  1. $ # 使用部署 kubectl 命令行工具时创建的、具有最高权限的 admin 证书；
  2. $ source /opt/k8s/bin/environment.sh
  3. $ sudo curl -sSL --cacert /etc/kubernetes/cert/ca.pem --cert /opt/k8s/work/admin.pem --key /opt/k8s/work/admin-key.pem ${KUBE_APISERVER}/api/v1/nodes/zhangjun-k8s01/proxy/configz | jq \
  4.   '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"'
  5. {
  6.   "syncFrequency": "1m0s",
  7.   "fileCheckFrequency": "20s",
  8.   "httpCheckFrequency": "20s",
  9.   "address": "172.27.137.240",
  10.   "port": 10250,
  11.   "rotateCertificates": true,
  12.   "serverTLSBootstrap": true,
  13.   "authentication": {
  14.     "x509": {
  15.       "clientCAFile": "/etc/kubernetes/cert/ca.pem"
  16.     },
  17.     "webhook": {
  18.       "enabled": true,
  19.       "cacheTTL": "2m0s"
  20.     },
  21.     "anonymous": {
  22.       "enabled": false
  23.     }
  24.   },
  25.   "authorization": {
  26.     "mode": "Webhook",
  27.     "webhook": {
  28.       "cacheAuthorizedTTL": "5m0s",
  29.       "cacheUnauthorizedTTL": "30s"
  30.     }
  31.   },
  32.   "registryPullQPS": 0,
  33.   "registryBurst": 20,
  34.   "eventRecordQPS": 0,
  35.   "eventBurst": 20,
  36.   "enableDebuggingHandlers": true,
  37.   "enableContentionProfiling": true,
  38.   "healthzPort": 10248,
  39.   "healthzBindAddress": "172.27.137.240",
  40.   "oomScoreAdj": -999,
  41.   "clusterDomain": "cluster.local",
  42.   "clusterDNS": [
  43.     "10.254.0.2"
  44.   ],
  45.   "streamingConnectionIdleTimeout": "4h0m0s",
  46.   "nodeStatusUpdateFrequency": "10s",
  47.   "nodeStatusReportFrequency": "1m0s",
  48.   "nodeLeaseDurationSeconds": 40,
  49.   "imageMinimumGCAge": "2m0s",
  50.   "imageGCHighThresholdPercent": 85,
  51.   "imageGCLowThresholdPercent": 80,
  52.   "volumeStatsAggPeriod": "1m0s",
  53.   "cgroupsPerQOS": true,
  54.   "cgroupDriver": "cgroupfs",
  55.   "cpuManagerPolicy": "none",
  56.   "cpuManagerReconcilePeriod": "10s",
  57.   "runtimeRequestTimeout": "10m0s",
  58.   "hairpinMode": "promiscuous-bridge",
  59.   "maxPods": 220,
  60.   "podCIDR": "172.30.0.0/16",
  61.   "podPidsLimit": -1,
  62.   "resolvConf": "/etc/resolv.conf",
  63.   "cpuCFSQuota": true,
  64.   "cpuCFSQuotaPeriod": "100ms",
  65.   "maxOpenFiles": 1000000,
  66.   "contentType": "application/vnd.kubernetes.protobuf",
  67.   "kubeAPIQPS": 1000,
  68.   "kubeAPIBurst": 2000,
  69.   "serializeImagePulls": false,
  70.   "evictionHard": {
  71.     "memory.available": "100Mi"
  72.   },
  73.   "evictionPressureTransitionPeriod": "5m0s",
  74.   "enableControllerAttachDetach": true,
  75.   "makeIPTablesUtilChains": true,
  76.   "iptablesMasqueradeBit": 14,
  77.   "iptablesDropBit": 15,
  78.   "failSwapOn": true,
  79.   "containerLogMaxSize": "20Mi",
  80.   "containerLogMaxFiles": 10,
  81.   "configMapAndSecretChangeDetectionStrategy": "Watch",
  82.   "enforceNodeAllocatable": [
  83.     "pods"
  84.   ],
  85.   "kind": "KubeletConfiguration",
  86.   "apiVersion": "kubelet.config.k8s.io/v1beta1"
  87. }

或者参考代码中的注释。

参考

  1. kubelet 认证和授权：https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/