Kubernetes 中 Konnectivity 服务的配置与部署指南-优快云博客

本文链接：https://blog.youkuaiyun.com/gitblog_00700/article/details/148549527

Kubernetes 中 Konnectivity 服务的配置与部署指南

website Kubernetes website and documentation repo: 项目地址: https://gitcode.com/gh_mirrors/webs/website

概述

Konnectivity 服务是 Kubernetes 控制平面与集群节点间通信的关键组件，它提供了 TCP 级别的代理功能。本文将详细介绍如何在 Kubernetes 集群中配置和部署 Konnectivity 服务，帮助管理员建立安全可靠的集群通信通道。

前提条件

在开始配置前，请确保：

已有一个正常运行的 Kubernetes 集群
kubectl 命令行工具已配置好并能与集群通信
集群中至少有两个不充当控制平面的工作节点
集群版本不低于 v1.20（服务账号令牌卷投射功能默认启用）

Konnectivity 服务配置详解

1. 配置出口选择器

首先需要准备一个出口选择器配置文件，该文件定义了 API 服务器如何路由流量。以下是典型配置示例：

apiVersion: apiserver.k8s.io/v1beta1
kind: EgressSelectorConfiguration
egressSelections:
- name: cluster
  connection:
    proxyProtocol: GRPC
    transport:
      uds:
        udsName: /etc/kubernetes/konnectivity-server/konnectivity-server.socket

2. 配置 API 服务器

要使 API 服务器使用 Konnectivity 服务，需要进行以下配置：

确保服务账号令牌卷投射功能已启用（v1.20+默认启用）
将 API 服务器的 --egress-selector-config-file 参数指向上述配置文件路径
如果使用 Unix 域套接字(UDS)连接，需要添加卷挂载配置到 kube-apiserver 的静态 Pod 定义中

3. 证书和 kubeconfig 准备

Konnectivity 服务需要有效的证书和 kubeconfig 文件来确保安全通信。以下是生成这些凭证的步骤：

使用 OpenSSL 生成私钥和证书签名请求(CSR)
使用集群 CA 签发服务器证书
创建专用的 kubeconfig 文件

# 生成私钥和CSR
openssl req -subj "/CN=system:konnectivity-server" -new -newkey rsa:2048 -nodes -out konnectivity.csr -keyout konnectivity.key

# 使用集群CA签发证书
openssl x509 -req -in konnectivity.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out konnectivity.crt -days 375 -sha256

# 创建kubeconfig文件
SERVER=$(kubectl config view -o jsonpath='{.clusters..server}')
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config set-credentials system:konnectivity-server --client-certificate konnectivity.crt --client-key konnectivity.key --embed-certs=true
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config set-cluster kubernetes --server "$SERVER" --certificate-authority /etc/kubernetes/pki/ca.crt --embed-certs=true
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config set-context system:konnectivity-server@kubernetes --cluster kubernetes --user system:konnectivity-server
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config use-context system:konnectivity-server@kubernetes

# 清理临时文件
rm -f konnectivity.crt konnectivity.key konnectivity.csr

部署 Konnectivity 组件

1. 部署 Konnectivity 服务器

Konnectivity 服务器可以部署为静态 Pod 或 DaemonSet。以下是静态 Pod 的配置示例：

apiVersion: v1
kind: Pod
metadata:
  name: konnectivity-server
  namespace: kube-system
spec:
  containers:
  - name: konnectivity-server
    image: registry.k8s.io/kas-network-proxy/proxy-server:v0.0.32
    args: [
      "--logtostderr=true",
      "--uds-name=/etc/kubernetes/konnectivity-server/konnectivity-server.socket",
      "--cluster-cert=/etc/kubernetes/pki/server.crt",
      "--cluster-key=/etc/kubernetes/pki/server.key",
      "--kubeconfig=/etc/kubernetes/konnectivity-server.conf",
      "--mode=grpc"
    ]
    volumeMounts:
    - name: konnectivity-uds
      mountPath: /etc/kubernetes/konnectivity-server
    - name: k8s-certs
      mountPath: /etc/kubernetes/pki
      readOnly: true
    - name: kubeconfig
      mountPath: /etc/kubernetes/konnectivity-server.conf
      readOnly: true
  volumes:
  - name: konnectivity-uds
    hostPath:
      path: /etc/kubernetes/konnectivity-server
      type: DirectoryOrCreate
  - name: k8s-certs
    hostPath:
      path: /etc/kubernetes/pki
      type: Directory
  - name: kubeconfig
    hostPath:
      path: /etc/kubernetes/konnectivity-server.conf
      type: File

2. 部署 Konnectivity 代理

代理组件需要部署在每个节点上，通常使用 DaemonSet：

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: konnectivity-agent
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: konnectivity-agent
  template:
    metadata:
      labels:
        app: konnectivity-agent
    spec:
      containers:
      - name: konnectivity-agent
        image: registry.k8s.io/kas-network-proxy/proxy-agent:v0.0.32
        args: [
          "--logtostderr=true",
          "--ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
          "--proxy-server-host=konnectivity-server.kube-system.svc",
          "--proxy-server-port=8090",
          "--service-account-token-path=/var/run/secrets/tokens/konnectivity-agent-token"
        ]
        volumeMounts:
        - name: token
          mountPath: /var/run/secrets/tokens
      serviceAccountName: konnectivity-agent
      volumes:
      - name: token
        projected:
          sources:
          - serviceAccountToken:
              path: konnectivity-agent-token
              audience: system:konnectivity-server

3. 配置 RBAC 规则

如果集群启用了 RBAC，需要为 Konnectivity 组件创建适当的权限：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:konnectivity-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: User
  name: system:konnectivity-server
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: konnectivity-agent
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:konnectivity-agent
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:node-proxier
subjects:
- kind: ServiceAccount
  name: konnectivity-agent
  namespace: kube-system