354 lines
12 KiB
Markdown
354 lines
12 KiB
Markdown
---
|
||
title: 云控制器管理器
|
||
content_type: concept
|
||
weight: 40
|
||
---
|
||
|
||
<!--
|
||
title: Cloud Controller Manager
|
||
content_type: concept
|
||
weight: 40
|
||
-->
|
||
|
||
<!-- overview -->
|
||
|
||
{{< feature-state state="beta" for_k8s_version="v1.11" >}}
|
||
|
||
<!--
|
||
Cloud infrastructure technologies let you run Kubernetes on public, private, and hybrid clouds.
|
||
Kubernetes believes in automated, API-driven infrastructure without tight coupling between
|
||
components.
|
||
-->
|
||
使用云基础设施技术，你可以在公有云、私有云或者混合云环境中运行 Kubernetes。
|
||
Kubernetes 的信条是基于自动化的、API 驱动的基础设施，同时避免组件间紧密耦合。
|
||
|
||
{{< glossary_definition term_id="cloud-controller-manager" length="all" prepend="组件 cloud-controller-manager 是指云控制器管理器，">}}
|
||
|
||
<!--
|
||
The cloud-controller-manager is structured using a plugin
|
||
mechanism that allows different cloud providers to integrate their platforms with Kubernetes.
|
||
-->
|
||
`cloud-controller-manager` 组件是基于一种插件机制来构造的，
|
||
这种机制使得不同的云厂商都能将其平台与 Kubernetes 集成。
|
||
|
||
<!-- body -->
|
||
<!--
|
||
## Design
|
||
|
||
|
||
|
||
The cloud controller manager runs in the control plane as a replicated set of processes
|
||
(usually, these are containers in Pods). Each cloud-controller-manager implements
|
||
multiple {{< glossary_tooltip text="controllers" term_id="controller" >}} in a single
|
||
process.
|
||
-->
|
||
## 设计 {#design}
|
||
|
||
{{< figure src="/zh-cn/docs/images/components-of-kubernetes.svg" alt="此图展示了 Kubernetes 集群的组件" class="diagram-medium" >}}
|
||
|
||
云控制器管理器以一组多副本的进程集合的形式运行在控制面中，通常表现为 Pod
|
||
中的容器。每个 `cloud-controller-manager`
|
||
在同一进程中实现多个{{< glossary_tooltip text="控制器" term_id="controller" >}}。
|
||
|
||
{{< note >}}
|
||
<!--
|
||
You can also run the cloud controller manager as a Kubernetes
|
||
{{< glossary_tooltip text="addon" term_id="addons" >}} rather than as part
|
||
of the control plane.
|
||
-->
|
||
你也可以用 Kubernetes {{< glossary_tooltip text="插件" term_id="addons" >}}
|
||
的形式而不是控制面中的一部分来运行云控制器管理器。
|
||
{{< /note >}}
|
||
|
||
<!--
|
||
## Cloud controller manager functions {#functions-of-the-ccm}
|
||
|
||
The controllers inside the cloud controller manager include:
|
||
-->
|
||
## 云控制器管理器的功能 {#functions-of-the-ccm}
|
||
|
||
云控制器管理器中的控制器包括：
|
||
|
||
<!--
|
||
### Node controller
|
||
|
||
The node controller is responsible for updating {{< glossary_tooltip text="Node" term_id="node" >}} objects
|
||
when new servers are created in your cloud infrastructure. The node controller obtains information about the
|
||
hosts running inside your tenancy with the cloud provider. The node controller performs the following functions:
|
||
-->
|
||
### 节点控制器 {#node-controller}
|
||
|
||
节点控制器负责在云基础设施中创建了新服务器时为之更新{{< glossary_tooltip text="节点（Node）" term_id="node" >}}对象。
|
||
节点控制器从云提供商获取当前租户中主机的信息。节点控制器执行以下功能：
|
||
|
||
<!--
|
||
1. Update a Node object with the corresponding server's unique identifier obtained from the cloud provider API.
|
||
1. Annotating and labelling the Node object with cloud-specific information, such as the region the node
|
||
is deployed into and the resources (CPU, memory, etc) that it has available.
|
||
1. Obtain the node's hostname and network addresses.
|
||
1. Verifying the node's health. In case a node becomes unresponsive, this controller checks with
|
||
your cloud provider's API to see if the server has been deactivated / deleted / terminated.
|
||
If the node has been deleted from the cloud, the controller deletes the Node object from your Kubernetes
|
||
cluster.
|
||
-->
|
||
1. 使用从云平台 API 获取的对应服务器的唯一标识符更新 Node 对象；
|
||
2. 利用特定云平台的信息为 Node 对象添加注解和标签，例如节点所在的区域
|
||
（Region）和所具有的资源（CPU、内存等等）；
|
||
3. 获取节点的网络地址和主机名；
|
||
4. 检查节点的健康状况。如果节点无响应，控制器通过云平台 API
|
||
查看该节点是否已从云中禁用、删除或终止。如果节点已从云中删除，
|
||
则控制器从 Kubernetes 集群中删除 Node 对象。
|
||
|
||
<!--
|
||
Some cloud provider implementations split this into a node controller and a separate node
|
||
lifecycle controller.
|
||
-->
|
||
某些云驱动实现中，这些任务被划分到一个节点控制器和一个节点生命周期控制器中。
|
||
|
||
<!--
|
||
### Route controller
|
||
|
||
The route controller is responsible for configuring routes in the cloud
|
||
appropriately so that containers on different nodes in your Kubernetes
|
||
cluster can communicate with each other.
|
||
|
||
Depending on the cloud provider, the route controller might also allocate blocks
|
||
of IP addresses for the Pod network.
|
||
-->
|
||
### 路由控制器 {#route-controller}
|
||
|
||
Route 控制器负责适当地配置云平台中的路由，以便 Kubernetes 集群中不同节点上的容器之间可以相互通信。
|
||
|
||
取决于云驱动本身，路由控制器可能也会为 Pod 网络分配 IP 地址块。
|
||
|
||
<!--
|
||
### Service controller
|
||
|
||
{{< glossary_tooltip text="Services" term_id="service" >}} integrate with cloud
|
||
infrastructure components such as managed load balancers, IP addresses, network
|
||
packet filtering, and target health checking. The service controller interacts with your
|
||
cloud provider's APIs to set up load balancers and other infrastructure components
|
||
when you declare a Service resource that requires them.
|
||
-->
|
||
### 服务控制器 {#service-controller}
|
||
|
||
{{< glossary_tooltip text="服务（Service）" term_id="service" >}}与受控的负载均衡器、
|
||
IP 地址、网络包过滤、目标健康检查等云基础设施组件集成。
|
||
服务控制器与云驱动的 API 交互，以配置负载均衡器和其他基础设施组件。
|
||
你所创建的 Service 资源会需要这些组件服务。
|
||
|
||
<!--
|
||
## Authorization
|
||
|
||
This section breaks down the access that the cloud controller manager requires
|
||
on various API objects, in order to perform its operations.
|
||
-->
|
||
## 鉴权 {#authorization}
|
||
|
||
本节分别讲述云控制器管理器为了完成自身工作而产生的对各类 API 对象的访问需求。
|
||
|
||
<!--
|
||
### Node controller {#authorization-node-controller}
|
||
|
||
The Node controller only works with Node objects. It requires full access
|
||
to read and modify Node objects.
|
||
-->
|
||
### 节点控制器 {#authorization-node-controller}
|
||
|
||
节点控制器只操作 Node 对象。它需要读取和修改 Node 对象的完全访问权限。
|
||
|
||
`v1/Node`：
|
||
|
||
- get
|
||
- list
|
||
- create
|
||
- update
|
||
- patch
|
||
- watch
|
||
- delete
|
||
|
||
<!--
|
||
### Route controller {#authorization-route-controller}
|
||
|
||
The route controller listens to Node object creation and configures
|
||
routes appropriately. It requires Get access to Node objects.
|
||
-->
|
||
### 路由控制器 {#authorization-route-controller}
|
||
|
||
路由控制器会监听 Node 对象的创建事件，并据此配置路由设施。
|
||
它需要读取 Node 对象的 Get 权限。
|
||
|
||
`v1/Node`：
|
||
|
||
- get
|
||
|
||
<!--
|
||
### Service controller {#authorization-service-controller}
|
||
|
||
The service controller watches for Service object **create**, **update** and **delete** events and then
|
||
configures Endpoints for those Services appropriately (for EndpointSlices, the
|
||
kube-controller-manager manages these on demand).
|
||
|
||
To access Services, it requires **list**, and **watch** access. To update Services, it requires
|
||
**patch** and **update** access.
|
||
|
||
To set up Endpoints resources for the Services, it requires access to **create**, **list**,
|
||
**get**, **watch**, and **update**.
|
||
-->
|
||
### 服务控制器 {#authorization-service-controller}
|
||
|
||
服务控制器监测 Service 对象的 **create**、**update** 和 **delete** 事件，
|
||
并配置对应服务的 Endpoints 对象
|
||
（对于 EndpointSlices，kube-controller-manager 按需对其进行管理）。
|
||
|
||
为了访问 Service 对象，它需要 **list** 和 **watch** 访问权限。
|
||
为了更新 Service 对象，它需要 **patch** 和 **update** 访问权限。
|
||
|
||
为了能够配置 Service 对应的 Endpoints 资源，
|
||
它需要 **create**、**list**、**get**、**watch** 和 **update** 等访问权限。
|
||
|
||
`v1/Service`：
|
||
|
||
- list
|
||
- get
|
||
- watch
|
||
- patch
|
||
- update
|
||
|
||
<!--
|
||
### Others {#authorization-miscellaneous}
|
||
|
||
The implementation of the core of the cloud controller manager requires access to create Event
|
||
objects, and to ensure secure operation, it requires access to create ServiceAccounts.
|
||
-->
|
||
### 其他 {#authorization-miscellaneous}
|
||
|
||
在云控制器管理器的实现中，其核心部分需要创建 Event 对象的访问权限，
|
||
并创建 ServiceAccount 资源以保证操作安全性的权限。
|
||
|
||
`v1/Event`:
|
||
|
||
- create
|
||
- patch
|
||
- update
|
||
|
||
`v1/ServiceAccount`:
|
||
|
||
- create
|
||
|
||
<!--
|
||
The {{< glossary_tooltip term_id="rbac" text="RBAC" >}} ClusterRole for the cloud
|
||
controller manager looks like:
|
||
-->
|
||
用于云控制器管理器 {{< glossary_tooltip term_id="rbac" text="RBAC" >}}
|
||
的 ClusterRole 如下例所示：
|
||
|
||
```yaml
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRole
|
||
metadata:
|
||
name: cloud-controller-manager
|
||
rules:
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- events
|
||
verbs:
|
||
- create
|
||
- patch
|
||
- update
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- nodes
|
||
verbs:
|
||
- '*'
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- nodes/status
|
||
verbs:
|
||
- patch
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- services
|
||
verbs:
|
||
- list
|
||
- patch
|
||
- update
|
||
- watch
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- serviceaccounts
|
||
verbs:
|
||
- create
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- persistentvolumes
|
||
verbs:
|
||
- get
|
||
- list
|
||
- update
|
||
- watch
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- endpoints
|
||
verbs:
|
||
- create
|
||
- get
|
||
- list
|
||
- watch
|
||
- update
|
||
```
|
||
|
||
## {{% heading "whatsnext" %}}
|
||
|
||
<!--
|
||
* [Cloud Controller Manager Administration](/docs/tasks/administer-cluster/running-cloud-controller/#cloud-controller-manager)
|
||
has instructions on running and managing the cloud controller manager.
|
||
|
||
* To upgrade a HA control plane to use the cloud controller manager, see
|
||
[Migrate Replicated Control Plane To Use Cloud Controller Manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/).
|
||
|
||
* Want to know how to implement your own cloud controller manager, or extend an existing project?
|
||
-->
|
||
* [云控制器管理器的管理](/zh-cn/docs/tasks/administer-cluster/running-cloud-controller/#cloud-controller-manager)
|
||
给出了运行和管理云控制器管理器的指南。
|
||
|
||
* 要升级 HA 控制平面以使用云控制器管理器，
|
||
请参见[将复制的控制平面迁移以使用云控制器管理器](/zh-cn/docs/tasks/administer-cluster/controller-manager-leader-migration/)。
|
||
|
||
* 想要了解如何实现自己的云控制器管理器，或者对现有项目进行扩展么？
|
||
|
||
<!--
|
||
- The cloud controller manager uses Go interfaces, specifically, `CloudProvider` interface defined in
|
||
[`cloud.go`](https://github.com/kubernetes/cloud-provider/blob/release-1.21/cloud.go#L42-L69)
|
||
from [kubernetes/cloud-provider](https://github.com/kubernetes/cloud-provider) to allow
|
||
implementations from any cloud to be plugged in.
|
||
-->
|
||
- 云控制器管理器使用 Go 语言的接口（具体指在
|
||
[kubernetes/cloud-provider](https://github.com/kubernetes/cloud-provider)
|
||
项目中 [`cloud.go`](https://github.com/kubernetes/cloud-provider/blob/release-1.26/cloud.go#L43-L69)
|
||
文件中所定义的 `CloudProvider` 接口），从而使得针对各种云平台的具体实现都可以接入。
|
||
|
||
<!--
|
||
- The implementation of the shared controllers highlighted in this document (Node, Route, and Service),
|
||
and some scaffolding along with the shared cloudprovider interface, is part of the Kubernetes core.
|
||
Implementations specific to cloud providers are outside the core of Kubernetes and implement
|
||
the `CloudProvider` interface.
|
||
-->
|
||
- 本文中列举的共享控制器（节点控制器、路由控制器和服务控制器等）的实现以及其他一些生成具有
|
||
CloudProvider 接口的框架的代码，都是 Kubernetes 的核心代码。
|
||
特定于云驱动的实现虽不是 Kubernetes 核心成分，仍要实现 `CloudProvider` 接口。
|
||
|
||
<!--
|
||
- For more information about developing plugins,
|
||
see [Developing Cloud Controller Manager](/docs/tasks/administer-cluster/developing-cloud-controller-manager/).
|
||
-->
|
||
- 关于如何开发插件的详细信息，
|
||
可参考[开发云控制器管理器](/zh-cn/docs/tasks/administer-cluster/developing-cloud-controller-manager/)文档。
|