当前位置：首页 > java >正文

使用 vip 加入两台 master 节点

java 2025/8/15 17:22:49

在一个一主三从的k8s 集群，新加两台master，加入之前与已有的master节点做好 keepalive ，然后使用 vip 去加入集群

1、三台 master 搭建 keepalive

2、修改 kubeadm-config 文件

apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:- system:bootstrappers:kubeadm:default-node-tokentoken: abcdef.0123456789abcdefttl: 24h0m0susages:- signing- authentication
kind: InitConfiguration
localAPIEndpoint:advertiseAddress: 192.168.32.200  # 修改为负载均衡器或 API Server IPbindPort: 6443
nodeRegistration:criSocket: unix:///var/run/cri-dockerd.sockimagePullPolicy: IfNotPresentname: master-1taints: null
---
apiServer:certSANs:  # 添加证书 SAN 列表- "192.168.32.200"  # 负载均衡器或 API Server IP- "192.168.32.61"   # 原 master 节点 IP- "10.96.0.1"        # 服务网络 IP- "localhost"        # 本地访问（可选）- "kubernetes"       # 集群内部域名（可选）timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:local:dataDir: /var/lib/etcd
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: 1.28.0
controlPlaneEndpoint: "192.168.32.200:6443"  # 启用并设置为负载均衡器或 API Server
networking:dnsDomain: cluster.localpodSubnet: 10.244.0.0/16serviceSubnet: 10.96.0.0/12
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd

3、备份现有证书（重要！）

sudo cp -r /etc/kubernetes/pki /etc/kubernetes/pki.bak-$(date +%s)

4、删除需要重新生成的证书

sudo rm -f /etc/kubernetes/pki/apiserver.*
sudo rm -f /etc/kubernetes/pki/apiserver-etcd-client.*

5、重新生成证书

使用修改后的配置文件重新生成证书：

kubeadm init phase certs all --config=kubeadm-config.yaml

6、验证新证书的 SAN

[root@master-1 ~]# openssl x509 -noout -text -in /etc/kubernetes/pki/apiserver.crt | grep "IP Address"DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:master-1, IP Address:10.96.0.1, IP Address:192.168.32.200, IP Address:192.168.32.61

确保输出包含：

IP Address:10.96.0.1, IP Address:192.168.32.200, IP Address:192.168.32.61

7、重启 kube-apiserver 和 kubelet

systemctl restart kubelet
kubectl delete pod -n kube-syetem kube-apiserver-master-1

8、验证集群访问

kubectl get node -o wide

9、两个新节点依次加入集群

在 master-1 上查看加入集群的信息

kubeadm token create --ttl 0 --print-join-commandkubeadm init phase upload-certs --upload-certs

拼接一下得出加入命令：

kubeadm join 192.168.32.61:6443 --token aw9t1c.vvadgb18mp72hg7l --discovery-token-ca-cert-hash sha256:710cd98096f3797bc6873e063b22385f52135bf1c5e2671e62977725e3ee28b3 \--control-plane --certificate-key  4aebb50871ebc2daabcf2527bace79c46be7392f59fc7472c2f574468def630f  --cri-socket=unix:///var/run/cri-dockerd.sock

在两个新节点分别执行加入的命令