如何将现有的弹性 IP 分配给 AWS 中 kops 集群的主节点

Question

我正在尝试在 AWS 环境中部署 KOPS 集群，而不使用 Route53 DNS 配置。我对 KOPS 还很陌生，对网络拓扑结构知之甚少。在我的集群中，将有 3 个主节点。

根据我的要求，我需要从客户端（在 KOPS 集群之外）访问在这个 KOPS 集群内运行的服务。因此，我想将预先创建的弹性 IP 分配给所有主节点，因此我可以使用来自客户端的这些预先创建的弹性 IP 来访问在 KOPS 集群内运行的服务。

我的问题是如何在 KOPS 集群创建期间为所有主节点分配预先创建的弹性 IP？

以下是我目前使用的创建 KOPS 集群的命令 -

kops create cluster \
    --state=${KOPS_STATE_STORE} \
    --master-zones=${MASTER_ZONES} \
    --zones=${ZONES} \
    --name=test-kops.k8s.local \
    --vpc=${VPC_ID} \
    --image="099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200907" \
    --master-volume-size=40 \
    --master-count=${Master_Count} \
    --node-volume-size=40 \
    --node-count=${Node_Count} \
    --networking=amazon-vpc-routed-eni \
    --subnets=${SUBNET_IDS} \
    --utility-subnets=${SUBNET_IDS} \
    --network-cidr=${NETWORK_CIDR} \
    --ssh-public-key=~/.ssh/id_rsa.pub \
    --dry-run -oyaml > cluster.yaml

kops create -f cluster.yaml

kops create secret --name ${NAME} sshpublickey admin -i ~/.ssh/id_rsa.pub

kops update cluster test-kops.k8s.local --yes

cluster.yaml

apiVersion: kops.k8s.io/v1alpha2
kind: Cluster
metadata:
  creationTimestamp: null
  name: test-kops.k8s.local
spec:
  api:
    loadBalancer:
      type: Public
  authorization:
    rbac: {}
  channel: stable
  cloudProvider: aws
  configBase: s3://{s3url}
  etcdClusters:
  - cpuRequest: 200m
    etcdMembers:
    - instanceGroup: master-ap-southeast-1a-1
      name: "1"
    - instanceGroup: master-ap-southeast-1a-2
      name: "2"
    - instanceGroup: master-ap-southeast-1a-3
      name: "3"
    memoryRequest: 100Mi
    name: main
  - cpuRequest: 100m
    etcdMembers:
    - instanceGroup: master-ap-southeast-1a-1
      name: "1"
    - instanceGroup: master-ap-southeast-1a-2
      name: "2"
    - instanceGroup: master-ap-southeast-1a-3
      name: "3"
    memoryRequest: 100Mi
    name: events
  iam:
    allowContainerRegistry: true
    legacy: false
  kubelet:
    anonymousAuth: false
  kubernetesApiAccess:
  - 0.0.0.0/0
  kubernetesVersion: 1.17.12
  masterPublicName: api.test-kops.k8s.local
  networkCIDR: {vpcCIDR}
  networkID: {vpcID}
  networking:
    amazonvpc: {}
  nonMasqueradeCIDR: 100.64.0.0/10
  sshAccess:
  - 0.0.0.0/0
  subnets:
  - cidr: {subnetCIDR}
    id: {subnetID}
    name: ap-southeast-1a
    type: Public
    zone: ap-southeast-1a
  topology:
    dns:
      type: Public
    masters: public
    nodes: public

---

apiVersion: kops.k8s.io/v1alpha2
kind: InstanceGroup
metadata:
  creationTimestamp: null
  labels:
    kops.k8s.io/cluster: test-kops.k8s.local
  name: master-ap-southeast-1a-1
spec:
  image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200907
  machineType: t3.medium
  maxSize: 1
  minSize: 1
  nodeLabels:
    kops.k8s.io/instancegroup: master-ap-southeast-1a-1
  role: Master
  rootVolumeSize: 40
  subnets:
  - ap-southeast-1a
  additionalSecurityGroups:
  - {securityGroup}

---

apiVersion: kops.k8s.io/v1alpha2
kind: InstanceGroup
metadata:
  creationTimestamp: null
  labels:
    kops.k8s.io/cluster: test-kops.k8s.local
  name: master-ap-southeast-1a-2
spec:
  image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200907
  machineType: t3.medium
  maxSize: 1
  minSize: 1
  nodeLabels:
    kops.k8s.io/instancegroup: master-ap-southeast-1a-2
  role: Master
  rootVolumeSize: 40
  subnets:
  - ap-southeast-1a
  additionalSecurityGroups:
  - {securityGroup}

apiVersion: kops.k8s.io/v1alpha2
kind: InstanceGroup
metadata:
  creationTimestamp: null
  labels:
    kops.k8s.io/cluster: test-kops.k8s.local
  name: master-ap-southeast-1a-3
spec:
  image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200907
  machineType: t3.medium
  maxSize: 1
  minSize: 1
  nodeLabels:
    kops.k8s.io/instancegroup: master-ap-southeast-1a-3
  role: Master
  rootVolumeSize: 40
  subnets:
  - ap-southeast-1a
  additionalSecurityGroups:
  - {securityGroup}

---

apiVersion: kops.k8s.io/v1alpha2
kind: InstanceGroup
metadata:
  creationTimestamp: null
  labels:
    kops.k8s.io/cluster: test-kops.k8s.local
  name: nodes
spec:
  image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200907
  machineType: t3.medium
  maxSize: 5
  minSize: 2
  nodeLabels:
    kops.k8s.io/instancegroup: nodes
  role: Node
  rootVolumeSize: 40
  subnets:
  - ap-southeast-1a
  additionalSecurityGroups:
  - {securityGroup}

Answer 1

由于控制平面节点在 ASG 中运行，因此您无法将弹性 IP 直接分配给 EC2 实例。您必须通过 ELB 才能访问它们。 ELB 也不能有弹性 IP。

另一种方法是使用 DNS 记录，但由于您也在使用上面的 gossip，因此此处不适用。

在 kOps 1.19 中，可以使用 NLB 作为控制平面，但目前，kOps 不支持为其指定 EIP。由于您希望使用 IP 来访问 API 以外的其他服务，但这也可能不是您想要的。