rancher创建的集群，可以从rancher server的页面上直接获取集群的kubeconfig 文件；这时候所有的请求都会从rancher api-server 转发一下，也方便做审计。

考虑一下异常的场景，recher-server异常，这个时候，想要直接访问创建的集群，怎么处理？

直接到创建的master节点，假如master节点的IP是192.168.2.140，可以通过如下命令获取重新创建集群自己的kubeconfig 文件

cd /etc/kubernetes/ssl/
kubectl config set-cluster local --certificate-authority=kube-ca.pem --server=https://192.168.2.140:6443
kubectl config set-credentials local --client-certificate=kube-scheduler.pem --client-key=kube-scheduler-key.pem
kubectl config set-context local --cluster=local --user=local
kubectl config use-context local

查看效果

2022-05-29 15-46-22 的屏幕截图.png

上面的权限是有限制的
想要没有限制，可以使用下面脚本生成：

#!/bin/bash

help ()
{
   echo  ' ================================================================ '
   echo  ' --master-ip: 指定 Master 节点 IP，任意一个 K8S Master 节点 IP 即可。'
   echo  ' 使用示例：bash restore-kube-config.sh --master-ip=1.1.1.1 '
   echo  ' ================================================================'
}

case "$1" in
   -h|--help) help; exit;;
esac

if [[ $1 == '' ]]; then
   help;
   exit;
fi

CMDOPTS="$*"
for OPTS in $CMDOPTS;
do
   key=$(echo ${OPTS} | awk -F"=" '{print $1}' )
   value=$(echo ${OPTS} | awk -F"=" '{print $2}' )
   case "$key" in
       --master-ip) K8S_MASTER_NODE_IP=$value ;;
   esac
done

# 获取 Rancher Agent 镜像
RANCHER_IMAGE=$( docker images --filter=label=io.cattle.agent=true |grep 'v2.' | \
grep -v -E 'rc|alpha|<none>' | head -n 1 | awk '{print $3}' )

if [[ -d /etc/kubernetes/ssl ]]; then
 K8S_SSLDIR=/etc/kubernetes/ssl
else
 echo '/etc/kubernetes/ssl 目录不存在'
 exit 1
fi

CHECK_CLUSTER_STATE_CONFIGMAP=$( docker run --rm --entrypoint bash --net=host \
-v $K8S_SSLDIR:/etc/kubernetes/ssl:ro $RANCHER_IMAGE -c '\
if kubectl --kubeconfig /etc/kubernetes/ssl/kubecfg-kube-node.yaml \
-n kube-system get configmap full-cluster-state | grep full-cluster-state > /dev/null; then \
echo 'yes'; else echo 'no'; fi' )

if [[ $CHECK_CLUSTER_STATE_CONFIGMAP != 'yes' ]]; then

 docker run --rm --net=host \
 --entrypoint bash \
 -e K8S_MASTER_NODE_IP=$K8S_MASTER_NODE_IP \
 -v $K8S_SSLDIR:/etc/kubernetes/ssl:ro \
 $RANCHER_IMAGE \
 -c '\
 kubectl --kubeconfig /etc/kubernetes/ssl/kubecfg-kube-node.yaml \
 -n kube-system \
 get secret kube-admin -o jsonpath={.data.Config} | base64 --decode | \
 sed -e "/^[[:space:]]*server:/ s_:.*_: \"https://${K8S_MASTER_NODE_IP}:6443\"_"' > kubeconfig_admin.yaml
 
 if [[ -s kubeconfig_admin.yaml ]]; then
   echo '恢复成功，执行以下命令测试：'
   echo ''
   echo "kubectl --kubeconfig kubeconfig_admin.yaml get nodes"
 else
   echo "kubeconfig 恢复失败。"
 fi

else

 docker run --rm --entrypoint bash --net=host \
 -e K8S_MASTER_NODE_IP=$K8S_MASTER_NODE_IP \
 -v $K8S_SSLDIR:/etc/kubernetes/ssl:ro \
 $RANCHER_IMAGE \
 -c '\
 kubectl --kubeconfig /etc/kubernetes/ssl/kubecfg-kube-node.yaml \
 -n kube-system \
 get configmap full-cluster-state -o json | \
 jq -r .data.\"full-cluster-state\" | \
 jq -r .currentState.certificatesBundle.\"kube-admin\".config | \
 sed -e "/^[[:space:]]*server:/ s_:.*_: \"https://${K8S_MASTER_NODE_IP}:6443\"_"' > kubeconfig_admin.yaml
 
 if [[ -s kubeconfig_admin.yaml ]]; then
   echo '恢复成功，执行以下命令测试：'
   echo ''
   echo "kubectl --kubeconfig kubeconfig_admin.yaml get nodes"
 else
   echo "kubeconfig 恢复失败。"
 fi
fi