외부 시스템에서 kubernetes 클러스터를 관리할 수 있도록 설정하자

Kubernetes 클러스터에 포함되지 않는 시스템에서 클러스터를 관리하기 위해서는 마스터 노드에 접근하기 위한 몇 가지 설정을 해야 한다.

 

관리노드에 kubectl 설치

먼저 마스터 노드로 접근하기 위한 시스템에 클러스터 관리를 위한 Kubectl 패키지를 아래 명령을 통해 설치한다.

apt-get update
apt-get install -y apt-transport-https ca-certificates curl
curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
apt-get update
apt-get install -y kubectl

 

kubectl 동작 테스트

관리툴을 설치하고 노드 정보를 가져오는 명령을 수행하면 아래와 같은 에러가 발생한다. 이는 쿠버네티스 클러스터 정보에를 이 시스템에서 가지고 있지 않기 때문이다.

root@ns:~# kubectl get nodes
E0105 15:07:38.883270   27506 memcache.go:238] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused
E0105 15:07:38.884636   27506 memcache.go:238] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused
E0105 15:07:38.886388   27506 memcache.go:238] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused
E0105 15:07:38.887378   27506 memcache.go:238] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused
E0105 15:07:38.888424   27506 memcache.go:238] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused
The connection to the server localhost:8080 was refused - did you specify the right host or port?
root@ns:~#

 

클러스터 인증 정보 복사하기

클러스터의 정보는 마스터 노드의 /etc/kubernetes/admin.conf 파일에 저장되어 있다. 최초 K8s 클러스터를 구성할 때 마스터 노드에서 해당 파일을 복사했던 기억을 떠올려 보자. 초기 화 후 마지막 문단에 아래와 같은 메시지를 보았을 것이다. 저 admin.conf 파일을 아래 형태로 동일하게 복사해서 사용하면 된다.

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

 

마스터 노드에서 해당 파일을 열어보면 아래와 같이 인증 정보들이 담겨 있는 것을 확인할 수 있다. 이 파일을 관리 노드로 복사한다.

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvakNDQWVhZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJeU1USXpNVEE0TURVMU4xb1hEVE15TVRJeU9EQTRNRFUxTjFvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBS1dECnBtNE54RlYvL1Q2eDUwV09uR2hCZXdjeVgzRkFLN1BYVHQxem05aVE2YnY3eGhSeFZFVzZLZnBwZUFZUHlybDgKc3RYZ0FadkQ5NGpGdUVMZFFYUi9RUGljVG56aC83UDBsWmNoNTVoeVVwNHF2amsvdDh6S1NadlV3Mzh1eXFLMApSQ2xiM0pIcUw3ZlVYNktBNUIzaFVSeFR4MXIyTk5jZkJGOFE5alo0MzQ1ZC9NRlhZckVJcHZZYktsYUtQYkUyCms2dlBIakVXNjQ2akI3R3JCNCtNelNYYm9XZ2ZBcG1RbEZmYjM1OXltcURKN2RVTmFHUkpXYjhUOW1QNWN5OWIKRnJ4dzZXQTM5RHdCWWdZTE10YTNDWjlnRkR6UVB6R05kSlltdmh5NDE4cnRpMERDcHlWenhiaXh5OEl3MjBJNApsWW14QmY4RnFJZndLdWNwRDdFQ0F3RUFBYU5aTUZjd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZJcEtPQkIwUlVCQjVjMkhCNktPeVlna0VFdjVNQlVHQTFVZEVRUU8KTUF5Q0NtdDFZbVZ5Ym1WMFpYTXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQmdWZjJuWnZMNHFQcnBudkcwLwpRVkUxKzVNd3UrdjJlYkR0T2pIaXViZE5zSEN1RE50UW9ueitmbFFCNW9JYkxXYlFPbWRxdmQvVXJzV1JvSGVKClYrc2dnbzNLU1B3enF5VzEzUzY0YmsrRE5CN05jOGwzckt5RnFldytsRE53eHdZcGE3N3FiRlB3MEp5VWhIamgKdlRYb2tFV3pGbFdJMHVjT0xvOGdqclJkLzQ2OHVnNThyZkN1QnhWRk1ML1VreERTQ25aOFcxZXJrWWxiQkRJVgoycFNWKzZHWGltTVMzTlpVOE85Ym9NL3V2eWoxVC94QjF4c0Z0T2VLRFRYOEtsSStzMG5NYUhxZUdsMnRDOUF3CmFibUx6YUxzM2VmQzZZWitqalJEbXV3L2IvT1dMU3d5RHRlOTRXTk5obDgyTzZPeFZBRmhnVHBrdGNJdFFJdEcKeGZNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    server: https://1.1.1.1:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJVENDQWdtZ0F3SUJBZ0lJQlpFaklxd2RCbW93RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TWpFeU16RXdPREExTlRkYUZ3MHlNekV5TXpFd09EQTJNRFJhTURReApGekFWQmdOVkJBb1REbk41YzNSbGJUcHRZWE4wWlhKek1Sa3dGd1lEVlFRREV4QnJkV0psY201bGRHVnpMV0ZrCmJXbHVNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXRsL0t6bkgxSzF5MU4xK0YKYVZIMXUvY01JYThlTFc0N3NXRUYwNGdrWDFrWHVvVzBwSHhPd0pYcjVxRURpb1d3TGdud1cycGRaVnlYUkRZKwpLSk5sVWxSczhOWDJwKzZGOTVFUnVmSkVIb3BidDduUmhwREQrbzFJeE56MU9xMHVMZk5JRis3Y1dvdjh3cDV5CllXK1YwYmlhTE5pSUpiSk1xckQ4bzJVU0toYlQ3cW5ESG4wWjNSVVlBVjVaOXNyakNub2g5ZzY1OGJ3MFV6UUsKaTZEdk11eU90Y3l2NTJna2UxVFAzZXZJTnp1TUR5c3cyUHBWdkdpSjFQUGlZYkluTVp6UVVrWnVWZyttU3FZNQp1S1U3QnZrZ04vOFdxMXk0NFZqTTZCRWw4VUJpY1hITjVpcnk0TUh2MlVTZWNzYWFmdXVoOGJoQ1Ivbk1xM1NwCmNuVnhQd0lEQVFBQm8xWXdWREFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUgKQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JTS1NqZ1FkRVZBUWVYTmh3ZWlqc21JSkJCTAorVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBTVNmZWcraHloZWFuRmZsUytHZmJGQ0t1ZzRaRlJLTVlLT2U0CmphY3dBM1NDUWJWNXVqMVdnU1d5L3FnN1V2WUl4a0RZcDF4UW9Yb29zTFdWRHNLcmR2T0c5TjJLNlJVOGtMRFoKNkFXbmx5UWI5SlUwQlY0ZitTeEhIVS9FN1V1OGFZUnNuaXFFQ0FUOEFlWjg5bTQ0YzVzY0NvdG5wakpZQlNFcgo5M25LcGRvWWliLzRtYmMwT1dmRWNXckxrMDJLWkRIdjJuYXpZTTB0RXFWSVN0bUZUdUI4NG1SVXJ4RVJTZzJTCkZVSUI1YW9NL1NLK09LU2pLTmJ3blVmblJueFJPV0I2eE1YaUJHMGxFcnZoS1U3VU5uS01sVWxVTVlqRnhqK3IKLzNwdjJJUzRZemd1OU1iRzcyeWJsem03SERDalIxbDZwQ05sM001TUdzdi9UdDlIV0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBdGwvS3puSDFLMXkxTjErRmFWSDF1L2NNSWE4ZUxXNDdzV0VGMDRna1gxa1h1b1cwCnBIeE93SlhyNXFFRGlvV3dMZ253VzJwZFpWeVhSRFkrS0pObFVsUnM4TlgycCs2Rjk1RVJ1ZkpFSG9wYnQ3blIKaHBERCtvMUl4TnoxT3EwdUxmTklGKzdjV292OHdwNXlZVytWMGJpYUxOaUlKYkpNcXJEOG8yVVNLaGJUN3FuRApIbjBaM1JVWUFWNVo5c3JqQ25vaDlnNjU4YncwVXpRS2k2RHZNdXlPdGN5djUyZ2tlMVRQM2V2SU56dU1EeXN3CjJQcFZ2R2lKMVBQaVliSW5NWnpRVWtadVZnK21TcVk1dUtVN0J2a2dOLzhXcTF5NDRWak02QkVsOFVCaWNYSE4KNWlyeTRNSHYyVVNlY3NhYWZ1dWg4YmhDUi9uTXEzU3BjblZ4UHdJREFRQUJBb0lCQUFpSUxycTl4aFNEUDg4WgpYdXB3ZFNpWUJDOUhQQWd3RWdiWVhTZHFSUmxZMTYxWU4vMUIrNFV5L2xoSnpCcWM2b01jMyt2RzdCdWoyMGZMCnFkaklISU5mZzhFNG9WTjE2enFMeE9LSUhQdTR5Vld0RWNwVDEzZFBTTW84OUJRTXFnNW9SVVVwWFpHMjN0cFUKQTFIZm9JaXhORFZJNUFXdmM3ckFrUEVyOTArVXNaV3pEMEVneVlLa2tyUzFXMHJPWnZIZzIwWnc0VXVxVDlwVApOV1k0bE1XakFCYkZidXdhY0lNVGkxZzR2bzk4UVdHVU9mams1d01FWXFsM01yMWhtVGllU0luQlFrWkJOendIClEzYmo2dVQySm9UNUZPQzFGME9MM2pmQUlQU0g4UnlGUnQwOFhMZ3VRem9GeFJVNWY3SU9salppZktRc3pBYlcKQlFHZ2hqRUNnWUVBNFBHNE0zbFJKdHNIM241MUxKRjBEeThsOFlPNlVIT2JEbXdXMnQxTTZBSk9STE1Fb3YzSworZ0I4VTdETHNmTnhpVTBaOEp0THhSNUg3S25IVTlRUUVQK0pXanRpVCtscTc3aE53MTNiOCs5QnppcE9WM205CkVFTnFvY0t1VUxJQnFlejJWWDh2bWJNVnUyRHNhNWZ5QzZGR0ZhNkI0ZXEzcGNXa3R1RXR1VnNDZ1lFQXo0MkIKYmVXZ243bm5YeVVPUCtzZ1BkK3Y4R0ZJazkwRG9XeWVvUE1oZzJvVk5mMmxBZTRDVCswN0pJWkt4WmFNcHUwRQpiaElHRTdhNXhlMWwvRGdheGEvYzdORndZKzhiZk5yeUkxaXF2R3BLVVVxdEZlRjRRREYxSGxIRytFS3RUTVM5Ci9CM25VQjJQTXB2L2J1T2g0ZVg1QlpYUXdsVjA1cUxZSkxIaUNPMENnWUFOOVpJcng1U01wNzBHUnF5NDFsSHcKZTBtTWdsTTJtT1gvY0IrKzkwckZmeGNpVmtXc1k3bUw2Q25PKzhLNFNWWTdZZ2lCRVBJVHlueEdLSWNSSWJEWgpqVElWNG1lSWRBREozWk1kMDU1SnRnaE1aZjIwbWY1c212SnNGV3ZCNERvUU5IOVk4T3FnVENmR0dBNno0cHNICnM3dG9yd3FxWFdtR0pRekN1SmlnendLQmdRQ2ZybG5XcUNVVTNoMHhLVHcyVnZwZVFCdUhVQUZicVYyaXN3TzAKQm5wUk5hdU45MUFkRlBWNGNxYmU2ZWJhNzRIVTUyTlNIOUhIRnYwRVZ5bndpMldsbEREZmpoN3U4OFh0SURITQptZW41dmJqaHBCZFlUemlLQXNMOWlhTVAyNVNqREhheVludFZPdml4MGkwS0xsMmNnNmM3OGRCRHd5V0dUK0VGCkVrbzUzUUtCZ1FEVGlqdTJRcUY0TkdxWVhINk5PaS8yUC95ZWpodW1ZVUJuekM3aFJTUXQ0bUhYc3grQjVRenYKZVp0b1JDWjVqcVJibTVzWEIxaFNkYkhCdEtOYUlvd0xtdDljWG1ESFdWVFhRWldDMC9hYnlUSW1EQUg3Q2VUYwoxbTV6d0RKc0Zmd3NPSkFRaW9WUHBhVDlHWUoxRk5rbmQ3VGFybEU3WGxUNVYwUVJNd0x5aHc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=

 

인증정보를 포함하여 테스트

복사한 파일을 kubectl의 --kubeconfig 옵션으로 실행하면 마스터 노드에 접속해서 정보를 얻어올 수 있다.

root@ns:~# kubectl get nodes --kubeconfig admin.conf
NAME      STATUS   ROLES           AGE     VERSION
kuber01   Ready    control-plane   4d21h   v1.25.5
kuber02   Ready    <none>          4d21h   v1.25.5
kuber03   Ready    <none>          4d21h   v1.25.5

 

기본 환경 설정에 적용하기

초기 설정 처럼 파일을 복사하고 설정을 마치면 별도로 파일을 명령줄에 입력하지 않고 아래처럼 관리가 가능하다.

root@ns:~# mkdir -p ~/.kube
root@ns:~# cp admin.conf ~/.kube/config
root@ns:~# chown $(id -u):$(id -g) $HOME/.kube/config
root@ns:~# kubectl get nodes
NAME      STATUS   ROLES           AGE     VERSION
kuber01   Ready    control-plane   4d21h   v1.25.5
kuber02   Ready    <none>          4d21h   v1.25.5
kuber03   Ready    <none>          4d21h   v1.25.5