Kubernetes : Control Plane ノードを追加する2023/10/19 |
既存の Kubernetes クラスターにノードを新規に Control Plane を追加する場合は以下のように設定します。
当例では以下のように 4 台のノードを使用してクラスターを構成しています。
※ 注 : Control Plane で etcd を起動している場合、etcd の耐障害性は 1-2 台では 0 のため、Control Plane
2 台構成では、いずれかがダウンすると etcd に接続できなくなり、クラスターを正常利用できなくなります。 +----------------------+ +----------------------+ | [ mgr.srv.world ] | | [ dlp.srv.world ] | | Manager Node | | Control Plane | +-----------+----------+ +-----------+----------+ eth0|10.0.0.25 eth0|10.0.0.30 | | ------------+--------------------------+----------- | | eth0|10.0.0.51 eth0|10.0.0.52 +-----------+----------+ +-----------+----------+ | [ node01.srv.world ] | | [ node02.srv.world ] | | Worker Node#1 | | Worker Node#2 | +----------------------+ +----------------------+ |
[1] |
新規に追加するノードで、こちらを参考に、ノード共通の設定を適用しておきます。 |
[2] | Manager ノードで、新規 Control Plane ノード用のプロキシ設定を追加します。 |
[root@mgr ~]#
vi /etc/nginx/nginx.conf # 新規 Control Plane を追加 stream { upstream k8s-api { server 10.0.0.30:6443; server 10.0.0.31:6443; } server { listen 6443; proxy_pass k8s-api; } }[root@mgr ~]# systemctl reload nginx
|
[3] | 既存の Control Plane ノードで認証トークンを確認して、証明書を任意のユーザーで新規ノードへ転送しておきます。 |
[root@dlp ~]#
[root@dlp pki]# cd /etc/kubernetes/pki [root@dlp pki]# tar czvf kube-certs.tar.gz sa.pub sa.key ca.crt ca.key front-proxy-ca.crt front-proxy-ca.key etcd/ca.crt etcd/ca.key [root@dlp pki]# scp kube-certs.tar.gz centos@10.0.0.31:~/
kubeadm token create --print-join-command kubeadm join 10.0.0.25:6443 --token zwaoit.d7983fprikz2turh --discovery-token-ca-cert-hash sha256:8a8bd725c9cbf8d03c0a724bded0afb923a067d48ca50fd8f0346fd3d0a27b6e |
[4] | 新規に追加するノードで、Control Plane ノードで確認した認証トークン用コマンドに [--control-plane] オプションを付加して実行します。 |
# 転送した証明書をコピー [root@dlp-1 ~]# mkdir /etc/kubernetes/pki [root@dlp-1 ~]# tar zxvf /home/centos/kube-certs.tar.gz -C /etc/kubernetes/pki
# Firewalld 稼働中の場合はサービス許可 [root@dlp-1 ~]# firewall-cmd --add-service={kube-apiserver,kube-control-plane,kube-control-plane-secure,kubelet,kubelet-readonly,http,https} success [root@dlp-1 ~]# firewall-cmd --runtime-to-permanent success kubeadm join 10.0.0.25:6443 --token zwaoit.d7983fprikz2turh \ --discovery-token-ca-cert-hash sha256:8a8bd725c9cbf8d03c0a724bded0afb923a067d48ca50fd8f0346fd3d0a27b6e \ --control-plane [preflight] Running pre-flight checks [preflight] Reading configuration from the cluster... [preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' [preflight] Running pre-flight checks before initializing the new control plane instance [WARNING Firewalld]: firewalld is active, please ensure ports [6443 10250] are open or your cluster may not function correctly [preflight] Pulling images required for setting up a Kubernetes cluster [preflight] This might take a minute or two, depending on the speed of your internet connection [preflight] You can also perform this action in beforehand using 'kubeadm config images pull' [ 1470.582145] overlayfs: idmapped layers are currently not supported [certs] Using certificateDir folder "/etc/kubernetes/pki" [certs] Generating "etcd/healthcheck-client" certificate and key [certs] Generating "etcd/peer" certificate and key [certs] etcd/peer serving cert is signed for DNS names [localhost dlp-1.srv.world] and IPs [10.0.0.31 127.0.0.1 ::1] [certs] Generating "etcd/server" certificate and key ..... ..... This node has joined the cluster and a new control plane instance was created: * Certificate signing request was sent to apiserver and approval was received. * The Kubelet was informed of the new secure connection details. * Control plane label and taint were applied to the new node. * The Kubernetes control plane instances scaled up. * A new etcd member was added to the local/stacked etcd cluster. To start administering your cluster from this node, you need to run the following as a regular user: mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config Run 'kubectl get nodes' to see this node join the cluster. |
[5] | Manager ノードでノード情報を確認しておきます。新規追加ノードが STATUS = Ready であれば OK です。 |
[root@mgr ~]# kubectl get nodes NAME STATUS ROLES AGE VERSION dlp-1.srv.world Ready control-plane 87s v1.28.2 dlp.srv.world Ready control-plane 176m v1.28.2 node01.srv.world Ready <none> 112m v1.28.2 node02.srv.world Ready <none> 111m v1.28.2[root@mgr ~]# kubectl get pods -A -o wide | grep dlp-1 kube-system calico-node-gj68v 0/1 Running 0 3m5s 10.0.0.31 dlp-1.srv.world <none> <none> kube-system etcd-dlp-1.srv.world 1/1 Running 0 3m4s 10.0.0.31 dlp-1.srv.world <none> <none> kube-system kube-apiserver-dlp-1.srv.world 1/1 Running 0 3m5s 10.0.0.31 dlp-1.srv.world <none> <none> kube-system kube-controller-manager-dlp-1.srv.world 1/1 Running 0 3m5s 10.0.0.31 dlp-1.srv.world <none> <none> kube-system kube-proxy-wmmr4 1/1 Running 0 3m5s 10.0.0.31 dlp-1.srv.world <none> <none> kube-system kube-scheduler-dlp-1.srv.world 1/1 Running 0 3m5s 10.0.0.31 dlp-1.srv.world <none> <none> |
Sponsored Link |
|