Merge pull request #20113 from caesarxuchao/network-proxy-master

Doc for Konnectivity service feature

content/en/docs/concepts/architecture/master-node-communication.md

@@ -97,13 +97,28 @@ public networks.
 
 ### SSH Tunnels
 
-Kubernetes supports SSH tunnels to protect the Master -> Cluster communication
+Kubernetes supports SSH tunnels to protect the Master → Cluster communication
 paths. In this configuration, the apiserver initiates an SSH tunnel to each node
 in the cluster (connecting to the ssh server listening on port 22) and passes
 all traffic destined for a kubelet, node, pod, or service through the tunnel.
 This tunnel ensures that the traffic is not exposed outside of the network in
 which the nodes are running.
 
-SSH tunnels are currently deprecated so you shouldn't opt to use them unless you know what you are doing. A replacement for this communication channel is being designed.
+SSH tunnels are currently deprecated so you shouldn't opt to use them unless you
+know what you are doing. The Konnectivity service is a replacement for this
+communication channel.
+
+### Konnectivity service
+{{< feature-state for_k8s_version="v1.18" state="beta" >}}
+
+As a replacement to the SSH tunnels, the Konnectivity service provides TCP
+level proxy for the Master → Cluster communication. The Konnectivity consists of
+two parts, the Konnectivity server and the Konnectivity agents, running in the
+Master network and the Cluster network respectively. The Konnectivity agents
+initiate connections to the Konnectivity server and maintain the connections.
+All Master → Cluster traffic then goes through these connections.
+
+See [Konnectivity Service Setup](/docs/tasks/setup-konnectivity/) on how to set
+it up in your cluster.
 
 {{% /capture %}}

content/en/docs/tasks/setup-konnectivity/_index.md

@@ -0,0 +1,5 @@
+---
+title: "Setup Konnectivity Service"
+weight: 20
+---
+

content/en/docs/tasks/setup-konnectivity/setup-konnectivity.md

@@ -0,0 +1,37 @@
+---
+title: Setup Konnectivity Service 
+content_template: templates/task
+weight: 110
+---
+
+The Konnectivity service provides TCP level proxy for the Master → Cluster
+communication.
+
+You can set it up with the following steps.
+
+First, you need to configure the API Server to use the Konnectivity service
+to direct its network traffic to cluster nodes:
+1. Set the `--egress-selector-config-file` flag of the API Server, it is the
+path to the API Server egress configuration file.
+2. At the path, create a configuration file. For example,
+
+{{< codenew file="admin/konnectivity/egress-selector-configuration.yaml" >}}
+
+Next, you need to deploy the Konnectivity service server and agents.
+[kubernetes-sigs/apiserver-network-proxy](https://github.com/kubernetes-sigs/apiserver-network-proxy)
+is a reference implementation.
+
+Deploy the Konnectivity server on your master node. The provided yaml assuming
+Kubernetes components are deployed as {{< glossary_tooltip text="static pod"
+term_id="static-pod" >}} in your cluster. If not , you can deploy it as a
+Daemonset to be reliable.
+
+{{< codenew file="admin/konnectivity/konnectivity-server.yaml" >}}
+
+Then deploy the Konnectivity agents in your cluster:
+
+{{< codenew file="admin/konnectivity/konnectivity-agent.yaml" >}}
+
+Last, if RBAC is enabled in your cluster, create the relevant RBAC rules:
+
+{{< codenew file="admin/konnectivity/konnectivity-rbac.yaml" >}}