@
amrom 大佬，我在 3 个节点单节中关闭 2 个，然后用 kubectl 的 admin 证书替换掉 kube-controller-manager 的 kubeconfig,auth/z-kubeconfig 也是失败的。下面是我的生成 kube-controller-manager-kubeconfig.yaml 的过程。
===
这个是 csr:
{
"CN": "system:kube-controller-manager",
"hosts": [
"192.168.62.131",
"192.168.62.132",
"192.168.62.133",
"127.0.0.1",
"localhost"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "Guangdong",
"L": "Dongguan",
"O": "system:kube-controller-manager",
"OU": "Kubernetes"
}
]
}
ansible 对应的脚本：
- name: kube-controller-manager-csr.json
ansible.builtin.shell:
cmd: >-
cfssl gencert -ca {{ control_node_temp_dirs.temp_certs_dir }}/kubernetes-ca.pem
-ca-key {{ control_node_temp_dirs.temp_certs_dir }}/kubernetes-ca-key.pem
-config {{ role_path }}/ca-config.json
-profile peer {{ control_node_temp_dirs.temp_csrs_dir }}/kube-controller-manager-csr.json
| cfssljson -bare {{ control_node_temp_dirs.temp_certs_dir }}/kube-controller-manager
- name: set-cluster kube-controller-manager-kubeconfig.yaml
ansible.builtin.shell:
cmd: >-
kubectl config set-cluster {{ k8s.cluster_name }}
--certificate-authority={{ control_node_temp_dirs.temp_certs_dir }}/kubernetes-ca.pem
--embed-certs=true
--server=https://127.0.0.1:6443
--kubeconfig={{ control_node_temp_dirs.temp_kubeconfigs_dir }}/kube-controller-manager-kubeconfig.yaml
- name: set-credentials kube-controller-manager-kubeconfig.yaml
ansible.builtin.shell:
cmd: >-
kubectl config set-credentials system:kube-controller-manager
--client-certificate={{ control_node_temp_dirs.temp_certs_dir }}/kube-controller-manager.pem
--client-key={{ control_node_temp_dirs.temp_certs_dir }}/kube-controller-manager-key.pem
--embed-certs=true
--kubeconfig={{ control_node_temp_dirs.temp_kubeconfigs_dir }}/kube-controller-manager-kubeconfig.yaml
- name: set-context kube-controller-manager-kubeconfig.yaml
ansible.builtin.shell:
cmd: >-
kubectl config set-context default
--cluster={{ k8s.cluster_name }}
--user=system:kube-controller-manager
--kubeconfig={{ control_node_temp_dirs.temp_kubeconfigs_dir }}/kube-controller-manager-kubeconfig.yaml
- name: kubeconfig use-context kube-controller-manager
ansible.builtin.shell:
cmd: kubectl config use-context default --kubeconfig={{ control_node_temp_dirs.temp_kubeconfigs_dir }}/kube-controller-manager-kubeconfig.yaml