Official 1.13 Release Docs (#11401)
* Update metadata.generation behaviour for custom resources (#10705) * update docs promoting plugins to beta (#10796) * docs update to promote TaintBasedEvictions to beta (#10765) * First Korean l10n work for dev-1.13 (#10719) * Update outdated l10n(ko) contents (#10689) fixes #10686 * Translate concepts/overview/what-is-kubernetes in Korean (#10690) * Translate concepts/overview/what-is-kubernetes in Korean * Feedback from ClaudiaJKang * Translate concepts/overview/components in Korean (#10882) * Translate concepts/overview/components in Korean #10717 * Translate concepts/overview/components in Korean * Translate concepts/overview/components in Korean * Apply Korean glossary: 서비스 어카운트 * Translate concepts/overview/kubernetes-api in Korean (#10773) * Translate concepts/overview/kubernetes-api in Korean * Applied feedback from ianychoi * kubeadm: update the configuration docs to v1beta1 (#10959) * kubeadm: add small v1beta1 related updates (#10988) * ADD content/zh/docs/reference/setup-tools/kubeadm/kubeadm.md (#11031) * ADD content/zh/docs/reference/setup-tools/kubeadm/kubeadm.md * ADD content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md * Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm.md Accepted Co-Authored-By: YouthLab <tsui@highyouth.com> * do not change 'master' or 'worker' nodes to '主从' * Doc updates for volume scheduling GA (#10743) * Doc updates for volume scheduling GA * Make trivial change to kick build * Document nodelease feature (#10699) * advanced audit doc for ModeBlockingStrict (#10203) * Rename EncryptionConfig to EncryptionConfiguration (#11080) EncryptionConfig was renamed to EncryptedConfiguration and added to the `apiserver.config.k8s.io` API group in Kubernetes 1.13. The feature was previously in alpha and was not handling versions properly, which lead to an originally unnoticed `v1` in the docs. * content/zh/docs/reference/setup-tools/kubeadm/kubeadm-init.md * trsanlate create-cluster-kubeadm.md to chinese (#11041) * trsanlate create-cluster-kubeadm.md to chinese * Update create-cluster-kubeadm.md * update the feature stage in v1.13 (#11307) * update new feature gates to document (#11295) * refresh controller role list on rbac description page (#11290) * node labeling restriction docs (#10944) * Update 1.13 docs for CSI GA (#10893) * dynamic audit documentation (#9947) * adds dynamic audit documentation * Copyedit for clarity See also inline question/s * Fix feature state shortcode * Update feature state * changes wording for dynamic audit flag behavior * Minor copyedit * fix dynamic audit yaml * adds api enablement command to dynamic audit docs * change ordering dynamic audit appears in * add references to dynamic audit in webhook backend * reword dynamic audit reference * updates stages field for audit sink object * changes audit sink api definition; rewords policy * kubeadm: remove kube-proxy workaround (#11162) * zh-trans content/en/docs/setup/independent/install-kubeadm.md (#11338) * zh-trans content/en/docs/setup/independent/install-kubeadm.md * Update install-kubeadm.md * Update dry run feature to beta (#11140) * vSphere volume raw block support doc update (#10932) * Add docs for Windows DNS configurations (#10036) * Update docs for fields allowed at root of CRD schema (#9973) * Add docs for Windows DNS configurations * add device monitoring documentation (#9945) * kubeadm: adds upgrade instructions for 1.13 (#11138) * kubeadm: adds upgrade instructions for 1.13 Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * add minor copyedits Addressed a couple of copyedit comments a bit more cleanly. * kubeadm: add improvements to HA docs (#11094) * kubeadm: add information and diagrams for HA topologies * kubeadm: update HA doc with simplified steps * kubeadm: update HA doc with simplified steps * edit ha, add new topology topic, reorder by weight * troubleshoot markdown * fix more markdown, fix links * more markdown * more markdown * more markdown * changes after reviewer comments * add steps about Weave * update note about stacked topology * kubeadm external etcd HA upgrade 1.13 (#11364) * kubeadm external etcd HA upgrade 1.13 Signed-off-by: Ruben Orduz <rubenoz@gmail.com> * Update stacked controlplane steps * kubeadm cert documentation (#11093) * kubeadm certificate API and CSR documentation * copyedits * fix typo * PR for diff docs (#10789) * Empty commit against dev-1.13 for diff documentation * Complete Declarative maangement with diff commands * Second Korean l10n work for dev-1.13. (#11030) * Update outdated l10n(ko) contents (#10915) * Translate main menu for l10n(ko) docs (#10916) * Translate tasks/run-application/horizontal-pod-autoscale-walkthrough (#10980) * Translate content/ko/docs/concepts/overview/working-with-objects/kubernetes-object in Korean #11104 (#11332) * Pick-right-solution page translates into Korean. (#11340) * ko-trans: add jd/..., sap/..., ebay/..., homeoffice/... (#11336) * Translate concept/workloads/pods/pod-overview.md (#11092) Co-authored-by: June Yi <june.yi@samsung.com> Co-authored-by: Jesang Myung <jesang.myung@gmail.com> Co-authored-by: zerobig <38598117+zer0big@users.noreply.github.com> Co-authored-by: Claudia J.Kang <claudiajkang@gmail.com> Co-authored-by: lIuDuI <1693291525@qq.com> Co-authored-by: Woojin Na(Eddie) <cheapluv@gmail.com> * Rename encryption-at-rest related objects (#11059) EncryptionConfig was renamed to EncryptedConfiguration and added to the `apiserver.config.k8s.io` API group in Kubernetes 1.13. The feature was previously in alpha and was not handling versions properly, which lead to an originally unnoticed `v1` in the docs. Also, the `--experimental-encryption-provider-config` flag is now called just `--encryption-provider-config`. * Documenting FlexVolume Resize alpha feature. (#10097) * CR webhook conversion documentation (#10986) * CR Conversion * Addressing comments * Addressing more comments * Addressing even more comments * Addressing even^2 more comments * Remove references to etcd2 in v1.13 since support has been removed (#11414) * Remove etcd2 references as etcd2 is deprecated Link back to the v1.12 version of the etcd3 doc for the etcd2->etcd3 migration instructions. I updated the kube-apiserver reference manually, unsure if that is auto-generated somehow. The federation-apiserver can still potentially support etcd2 so I didn't touch that. * Remove outdated {master,node}.yaml files There are master/node yaml files that reference etcd2.service that are likely highly out of date. I couldn't find any docs that actually reference these templates so I removed them * Address review comments * Final Korean l10n work for dev-1.13 (#11440) * Update outdated l10n(ko) contents (#11425) fixes #11424 * Remove references to etcd2 in content/ko (#11416) * Resolve conflicts against master for /ko contents (#11438) * Fix unopened caution shortcode * kubeadm: update the reference docs for 1.13 (#10960) * docs update to promote TaintBasedEvictions to beta (#10765) * First Korean l10n work for dev-1.13 (#10719) * Update outdated l10n(ko) contents (#10689) fixes #10686 * Translate concepts/overview/what-is-kubernetes in Korean (#10690) * Translate concepts/overview/what-is-kubernetes in Korean * Feedback from ClaudiaJKang * Translate concepts/overview/components in Korean (#10882) * Translate concepts/overview/components in Korean #10717 * Translate concepts/overview/components in Korean * Translate concepts/overview/components in Korean * Apply Korean glossary: 서비스 어카운트 * Translate concepts/overview/kubernetes-api in Korean (#10773) * Translate concepts/overview/kubernetes-api in Korean * Applied feedback from ianychoi * kubeadm: update the configuration docs to v1beta1 (#10959) * kubeadm: add small v1beta1 related updates (#10988) * update new feature gates to document (#11295) * Update dry run feature to beta (#11140) * kubeadm: add improvements to HA docs (#11094) * kubeadm: add information and diagrams for HA topologies * kubeadm: update HA doc with simplified steps * kubeadm: update HA doc with simplified steps * edit ha, add new topology topic, reorder by weight * troubleshoot markdown * fix more markdown, fix links * more markdown * more markdown * more markdown * changes after reviewer comments * add steps about Weave * update note about stacked topology * kubeadm: update reference docs - add section about working with phases under kubeadm-init.md - update GA / beta status of features - kubeadm alpha phase was moved to kubeadm init phase - new commands were added under kubeadm alpha - included new CoreDNS usage examples * Generate components and tools reference * Add generated federation API Reference (#11491) * Add generated federation API Reference * Add front matter to federation reference * Remove whitespace from federation front matter * Remove more whitespace from federation front matter * Remove superfluous kubefed reference * Add frontmatter to generated kubefed reference * Fix kubefed reference page frontmatter * Generate kubectl reference docs 1.13 (#11487) * Generate kubectl reference docs 1.13 * Fix links in kubectl reference * Add 1.13 API reference (#11489) * Update config.toml (#11486) * Update config.toml Preparing for 1.13 release, updating the config.toml and dropping the 1.8 docs reference. * update dot releases and docsbranch typo * adding .Site. to Params.currentUrl (#11503) see https://github.com/kubernetes/website/pull/11502 for context * Add 1.13 Release notes (#11499)
This commit is contained in:
Jim Angel
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
b1dde5578c
commit
27b7b453a9
@@ -1,142 +0,0 @@
|
||||
#cloud-config
|
||||
|
||||
---
|
||||
write-files:
|
||||
- path: /etc/conf.d/nfs
|
||||
permissions: '0644'
|
||||
content: |
|
||||
OPTS_RPC_MOUNTD=""
|
||||
- path: /opt/bin/wupiao
|
||||
permissions: '0755'
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen
|
||||
[ -n "$1" ] && \
|
||||
until curl -o /dev/null -sIf http://${1}; do \
|
||||
sleep 1 && echo .;
|
||||
done;
|
||||
exit $?
|
||||
|
||||
hostname: master
|
||||
coreos:
|
||||
etcd2:
|
||||
name: master
|
||||
listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
|
||||
advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001
|
||||
initial-cluster-token: k8s_etcd
|
||||
listen-peer-urls: http://$private_ipv4:2380,http://$private_ipv4:7001
|
||||
initial-advertise-peer-urls: http://$private_ipv4:2380
|
||||
initial-cluster: master=http://$private_ipv4:2380
|
||||
initial-cluster-state: new
|
||||
fleet:
|
||||
metadata: "role=master"
|
||||
units:
|
||||
- name: etcd2.service
|
||||
command: start
|
||||
- name: generate-serviceaccount-key.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Generate service-account key file
|
||||
|
||||
[Service]
|
||||
ExecStartPre=-/usr/bin/mkdir -p /opt/bin
|
||||
ExecStart=/bin/openssl genrsa -out /opt/bin/kube-serviceaccount.key 2048 2>/dev/null
|
||||
RemainAfterExit=yes
|
||||
Type=oneshot
|
||||
- name: setup-network-environment.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Setup Network Environment
|
||||
Documentation=https://github.com/kelseyhightower/setup-network-environment
|
||||
Requires=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStartPre=-/usr/bin/mkdir -p /opt/bin
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/setup-network-environment -z /opt/bin/setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment
|
||||
ExecStart=/opt/bin/setup-network-environment
|
||||
RemainAfterExit=yes
|
||||
Type=oneshot
|
||||
- name: fleet.service
|
||||
command: start
|
||||
- name: flanneld.service
|
||||
command: start
|
||||
drop-ins:
|
||||
- name: 50-network-config.conf
|
||||
content: |
|
||||
[Unit]
|
||||
Requires=etcd2.service
|
||||
[Service]
|
||||
ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}'
|
||||
- name: docker.service
|
||||
command: start
|
||||
- name: kube-apiserver.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Kubernetes API Server
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
Requires=setup-network-environment.service etcd2.service generate-serviceaccount-key.service
|
||||
After=setup-network-environment.service etcd2.service generate-serviceaccount-key.service
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=/etc/network-environment
|
||||
ExecStartPre=-/usr/bin/mkdir -p /opt/bin
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-apiserver -z /opt/bin/kube-apiserver https://storage.googleapis.com/kubernetes-release/release/v1.1.2/bin/linux/amd64/kube-apiserver
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver
|
||||
ExecStartPre=/opt/bin/wupiao 127.0.0.1:2379/v2/machines
|
||||
ExecStart=/opt/bin/kube-apiserver \
|
||||
--service-account-key-file=/opt/bin/kube-serviceaccount.key \
|
||||
--service-account-lookup=false \
|
||||
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
|
||||
--runtime-config=api/v1 \
|
||||
--allow-privileged=true \
|
||||
--insecure-bind-address=0.0.0.0 \
|
||||
--insecure-port=8080 \
|
||||
--kubelet-https=true \
|
||||
--secure-port=6443 \
|
||||
--service-cluster-ip-range=10.100.0.0/16 \
|
||||
--etcd-servers=http://127.0.0.1:2379 \
|
||||
--public-address-override=${DEFAULT_IPV4} \
|
||||
--logtostderr=true
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
- name: kube-controller-manager.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Kubernetes Controller Manager
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
Requires=kube-apiserver.service
|
||||
After=kube-apiserver.service
|
||||
|
||||
[Service]
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-controller-manager -z /opt/bin/kube-controller-manager https://storage.googleapis.com/kubernetes-release/release/v1.1.2/bin/linux/amd64/kube-controller-manager
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager
|
||||
ExecStart=/opt/bin/kube-controller-manager \
|
||||
--service-account-private-key-file=/opt/bin/kube-serviceaccount.key \
|
||||
--master=127.0.0.1:8080 \
|
||||
--logtostderr=true
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
- name: kube-scheduler.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Kubernetes Scheduler
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
Requires=kube-apiserver.service
|
||||
After=kube-apiserver.service
|
||||
|
||||
[Service]
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-scheduler -z /opt/bin/kube-scheduler https://storage.googleapis.com/kubernetes-release/release/v1.1.2/bin/linux/amd64/kube-scheduler
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler
|
||||
ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
update:
|
||||
group: alpha
|
||||
reboot-strategy: off
|
||||
@@ -1,92 +0,0 @@
|
||||
#cloud-config
|
||||
write-files:
|
||||
- path: /opt/bin/wupiao
|
||||
permissions: '0755'
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen
|
||||
[ -n "$1" ] && [ -n "$2" ] && while ! curl --output /dev/null \
|
||||
--silent --head --fail \
|
||||
http://${1}:${2}; do sleep 1 && echo -n .; done;
|
||||
exit $?
|
||||
coreos:
|
||||
etcd2:
|
||||
listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
|
||||
advertise-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
|
||||
initial-cluster: master=http://<master-private-ip>:2380
|
||||
proxy: on
|
||||
fleet:
|
||||
metadata: "role=node"
|
||||
units:
|
||||
- name: etcd2.service
|
||||
command: start
|
||||
- name: fleet.service
|
||||
command: start
|
||||
- name: flanneld.service
|
||||
command: start
|
||||
- name: docker.service
|
||||
command: start
|
||||
- name: setup-network-environment.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Setup Network Environment
|
||||
Documentation=https://github.com/kelseyhightower/setup-network-environment
|
||||
Requires=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStartPre=-/usr/bin/mkdir -p /opt/bin
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/setup-network-environment -z /opt/bin/setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment
|
||||
ExecStart=/opt/bin/setup-network-environment
|
||||
RemainAfterExit=yes
|
||||
Type=oneshot
|
||||
- name: kube-proxy.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Kubernetes Proxy
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
Requires=setup-network-environment.service
|
||||
After=setup-network-environment.service
|
||||
|
||||
[Service]
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-proxy -z /opt/bin/kube-proxy https://storage.googleapis.com/kubernetes-release/release/v1.1.2/bin/linux/amd64/kube-proxy
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy
|
||||
# wait for kubernetes master to be up and ready
|
||||
ExecStartPre=/opt/bin/wupiao <master-private-ip> 8080
|
||||
ExecStart=/opt/bin/kube-proxy \
|
||||
--master=<master-private-ip>:8080 \
|
||||
--logtostderr=true
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
- name: kube-kubelet.service
|
||||
command: start
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Kubernetes Kubelet
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
Requires=setup-network-environment.service
|
||||
After=setup-network-environment.service
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=/etc/network-environment
|
||||
ExecStartPre=/usr/bin/curl -L -o /opt/bin/kubelet -z /opt/bin/kubelet https://storage.googleapis.com/kubernetes-release/release/v1.1.2/bin/linux/amd64/kubelet
|
||||
ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet
|
||||
# wait for kubernetes master to be up and ready
|
||||
ExecStartPre=/opt/bin/wupiao <master-private-ip> 8080
|
||||
ExecStart=/opt/bin/kubelet \
|
||||
--address=0.0.0.0 \
|
||||
--port=10250 \
|
||||
--hostname-override=${DEFAULT_IPV4} \
|
||||
--api-servers=<master-private-ip>:8080 \
|
||||
--allow-privileged=true \
|
||||
--logtostderr=true \
|
||||
--healthz-bind-address=0.0.0.0 \
|
||||
--healthz-port=10248
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
update:
|
||||
group: alpha
|
||||
reboot-strategy: off
|
||||
@@ -8,15 +8,16 @@ weight: 40
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
The kubeadm configuration exposes the following fields that can override the default flags passed to control plane components such as the APIServer, ControllerManager and Scheduler:
|
||||
The kubeadm `ClusterConfiguration` object exposes the field `extraArgs` that can override the default flags passed to control plane
|
||||
components such as the APIServer, ControllerManager and Scheduler. The components are defined using the following fields:
|
||||
|
||||
- `APIServerExtraArgs`
|
||||
- `ControllerManagerExtraArgs`
|
||||
- `SchedulerExtraArgs`
|
||||
- `apiServer`
|
||||
- `controllerManager`
|
||||
- `scheduler`
|
||||
|
||||
These fields consist of `key: value` pairs. To override a flag for a control plane component:
|
||||
The `extraArgs` field consist of `key: value` pairs. To override a flag for a control plane component:
|
||||
|
||||
1. Add the appropriate field to your configuration.
|
||||
1. Add the appropriate fields to your configuration.
|
||||
2. Add the flags to override to the field.
|
||||
|
||||
For more details on each field in the configuration you can navigate to our
|
||||
@@ -32,16 +33,17 @@ For details, see the [reference documentation for kube-apiserver](/docs/referenc
|
||||
|
||||
Example usage:
|
||||
```yaml
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
apiVersion: kubeadm.k8s.io/v1beta1
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: v1.12.0
|
||||
kubernetesVersion: v1.13.0
|
||||
metadata:
|
||||
name: 1.12-sample
|
||||
apiServerExtraArgs:
|
||||
advertise-address: 192.168.0.103
|
||||
anonymous-auth: false
|
||||
enable-admission-plugins: AlwaysPullImages,DefaultStorageClass
|
||||
audit-log-path: /home/johndoe/audit.log
|
||||
name: 1.13-sample
|
||||
apiServer:
|
||||
extraArgs:
|
||||
advertise-address: 192.168.0.103
|
||||
anonymous-auth: false
|
||||
enable-admission-plugins: AlwaysPullImages,DefaultStorageClass
|
||||
audit-log-path: /home/johndoe/audit.log
|
||||
```
|
||||
|
||||
## ControllerManager flags
|
||||
@@ -50,15 +52,16 @@ For details, see the [reference documentation for kube-controller-manager](/docs
|
||||
|
||||
Example usage:
|
||||
```yaml
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
apiVersion: kubeadm.k8s.io/v1beta1
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: v1.12.0
|
||||
kubernetesVersion: v1.13.0
|
||||
metadata:
|
||||
name: 1.12-sample
|
||||
controllerManagerExtraArgs:
|
||||
cluster-signing-key-file: /home/johndoe/keys/ca.key
|
||||
bind-address: 0.0.0.0
|
||||
deployment-controller-sync-period: 50
|
||||
name: 1.13-sample
|
||||
controllerManager:
|
||||
extraArgs:
|
||||
cluster-signing-key-file: /home/johndoe/keys/ca.key
|
||||
bind-address: 0.0.0.0
|
||||
deployment-controller-sync-period: 50
|
||||
```
|
||||
|
||||
## Scheduler flags
|
||||
@@ -67,15 +70,16 @@ For details, see the [reference documentation for kube-scheduler](/docs/referenc
|
||||
|
||||
Example usage:
|
||||
```yaml
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
apiVersion: kubeadm.k8s.io/v1beta1
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: v1.12.0
|
||||
kubernetesVersion: v1.13.0
|
||||
metadata:
|
||||
name: 1.12-sample
|
||||
schedulerExtraArgs:
|
||||
address: 0.0.0.0
|
||||
config: /home/johndoe/schedconfig.yaml
|
||||
kubeconfig: /home/johndoe/kubeconfig.yaml
|
||||
name: 1.13-sample
|
||||
scheduler:
|
||||
extraArgs:
|
||||
address: 0.0.0.0
|
||||
config: /home/johndoe/schedconfig.yaml
|
||||
kubeconfig: /home/johndoe/kubeconfig.yaml
|
||||
```
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
@@ -37,21 +37,20 @@ but you may also build them from source for other OSes.
|
||||
|
||||
| Area | Maturity Level |
|
||||
|---------------------------|--------------- |
|
||||
| Command line UX | beta |
|
||||
| Implementation | beta |
|
||||
| Config file API | alpha |
|
||||
| Self-hosting | alpha |
|
||||
| kubeadm alpha subcommands | alpha |
|
||||
| Command line UX | GA |
|
||||
| Implementation | GA |
|
||||
| Config file API | beta |
|
||||
| CoreDNS | GA |
|
||||
| kubeadm alpha subcommands | alpha |
|
||||
| High availability | alpha |
|
||||
| DynamicKubeletConfig | alpha |
|
||||
| Self-hosting | alpha |
|
||||
|
||||
|
||||
kubeadm's overall feature state is **Beta** and will soon be graduated to
|
||||
**General Availability (GA)** during 2018. Some sub-features, like self-hosting
|
||||
or the configuration file API are still under active development. The
|
||||
implementation of creating the cluster may change slightly as the tool evolves,
|
||||
but the overall implementation should be pretty stable. Any commands under
|
||||
`kubeadm alpha` are by definition, supported on an alpha level.
|
||||
kubeadm's overall feature state is **GA**. Some sub-features, like the configuration
|
||||
file API are still under active development. The implementation of creating the cluster
|
||||
may change slightly as the tool evolves, but the overall implementation should be pretty stable.
|
||||
Any commands under `kubeadm alpha` are by definition, supported on an alpha level.
|
||||
|
||||
|
||||
### Support timeframes
|
||||
@@ -70,6 +69,7 @@ timeframe; which also applies to `kubeadm`.
|
||||
| v1.10.x | March 2018 | December 2018 |
|
||||
| v1.11.x | June 2018 | March 2019 |
|
||||
| v1.12.x | September 2018 | June 2019 |
|
||||
| v1.13.x | December 2018 | September 2019 |
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
@@ -391,7 +391,7 @@ And once the CoreDNS pod is up and running, you can continue by joining your nod
|
||||
If your network is not working or CoreDNS is not in the Running state, check
|
||||
out our [troubleshooting docs](/docs/setup/independent/troubleshooting-kubeadm/).
|
||||
|
||||
### Master Isolation
|
||||
### Control plane node isolation
|
||||
|
||||
By default, your cluster will not schedule pods on the master for security
|
||||
reasons. If you want to be able to schedule pods on the master, e.g. for a
|
||||
@@ -508,7 +508,7 @@ and `scp` using that other user instead.
|
||||
The `admin.conf` file gives the user _superuser_ privileges over the cluster.
|
||||
This file should be used sparingly. For normal users, it's recommended to
|
||||
generate an unique credential to which you whitelist privileges. You can do
|
||||
this with the `kubeadm alpha phase kubeconfig user --client-name <CN>`
|
||||
this with the `kubeadm alpha kubeconfig user --client-name <CN>`
|
||||
command. That command will print out a KubeConfig file to STDOUT which you
|
||||
should save to a file and distribute to your user. After that, whitelist
|
||||
privileges by using `kubectl create (cluster)rolebinding`.
|
||||
@@ -598,6 +598,8 @@ kubeadm deb/rpm packages and binaries are built for amd64, arm (32-bit), arm64,
|
||||
following the [multi-platform
|
||||
proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/multi-platform.md).
|
||||
|
||||
Multiplatform container images for the control plane and addons are also supported since v1.12.
|
||||
|
||||
Only some of the network providers offer solutions for all platforms. Please consult the list of
|
||||
network providers above or the documentation from each provider to figure out whether the provider
|
||||
supports your chosen platform.
|
||||
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
reviewers:
|
||||
- sig-cluster-lifecycle
|
||||
title: Options for Highly Available Topology
|
||||
content_template: templates/concept
|
||||
weight: 50
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
This page explains the two options for configuring the topology of your highly available (HA) Kubernetes clusters.
|
||||
|
||||
You can set up an HA cluster:
|
||||
|
||||
- With stacked control plane nodes, where etcd nodes are colocated with control plane nodes
|
||||
- With external etcd nodes, where etcd runs on separate nodes from the control plane
|
||||
|
||||
You should carefully consider the advantages and disadvantages of each topology before setting up an HA cluster.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture body %}}
|
||||
|
||||
## Stacked etcd topology
|
||||
|
||||
A stacked HA cluster is a [topology](https://en.wikipedia.org/wiki/Network_topology) where the distributed
|
||||
data storage cluster provided by etcd is stacked on top of the cluster formed by the nodes managed by
|
||||
kubeadm that run control plane components.
|
||||
|
||||
Each control plane node runs an instance of the `kube-apiserver`, `kube-scheduler`, and `kube-controller-manager`.
|
||||
The `kube-apiserver` is exposed to worker nodes using a load balancer.
|
||||
|
||||
Each control plane node creates a local etcd member and this etcd member communicate only with
|
||||
the `kube-apiserver` of this node. The same applies to the local `kube-controller-manager`
|
||||
and `kube-scheduler` instances.
|
||||
|
||||
This topology couples the control planes and etcd members on the same nodes. It is simpler to set up than a cluster
|
||||
with external etcd nodes, and simpler to manage for replication.
|
||||
|
||||
However, a stacked cluster runs the risk of failed coupling. If one node goes down, both an etcd member and a control
|
||||
plane instance are lost, and redundancy is compromised. You can mitigate this risk by adding more control plane nodes.
|
||||
|
||||
You should therefore run a minimum of three stacked control plane nodes for an HA cluster.
|
||||
|
||||
This is the default topology in kubeadm. A local etcd member is created automatically
|
||||
on control plane nodes when using `kubeadm init` and `kubeadm join --experimental-control-plane`.
|
||||
|
||||
|
||||
|
||||
## External etcd topology
|
||||
|
||||
An HA cluster with external etcd is a [topology](https://en.wikipedia.org/wiki/Network_topology) where the distributed data storage cluster provided by etcd is external to the cluster formed by the nodes that run control plane components.
|
||||
|
||||
Like the stacked etcd topology, each control plane node in an external etcd topology runs an instance of the `kube-apiserver`, `kube-scheduler`, and `kube-controller-manager`. And the `kube-apiserver` is exposed to worker nodes using a load balancer. However, etcd members run on separate hosts, and each etcd host communicates with the `kube-apiserver` of each control plane node.
|
||||
|
||||
This topology decouples the control plane and etcd member. It therefore provides an HA setup where
|
||||
losing a control plane instance or an etcd member has less impact and does not affect
|
||||
the cluster redundancy as much as the stacked HA topology.
|
||||
|
||||
However, this topology requires twice the number of hosts as the stacked HA topology.
|
||||
A minimum of three hosts for control plane nodes and three hosts for etcd nodes are required for an HA cluster with this topology.
|
||||
|
||||
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
|
||||
- [Set up a highly available cluster with kubeadm](/docs/setup/independent/high-availability/)
|
||||
|
||||
{{% /capture %}}
|
||||
@@ -3,7 +3,7 @@ reviewers:
|
||||
- sig-cluster-lifecycle
|
||||
title: Creating Highly Available Clusters with kubeadm
|
||||
content_template: templates/task
|
||||
weight: 50
|
||||
weight: 60
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
@@ -11,15 +11,23 @@ weight: 50
|
||||
This page explains two different approaches to setting up a highly available Kubernetes
|
||||
cluster using kubeadm:
|
||||
|
||||
- With stacked masters. This approach requires less infrastructure. etcd members
|
||||
- With stacked control plane nodes. This approach requires less infrastructure. The etcd members
|
||||
and control plane nodes are co-located.
|
||||
- With an external etcd cluster. This approach requires more infrastructure. The
|
||||
control plane nodes and etcd members are separated.
|
||||
|
||||
Before proceeding, you should carefully consideer which approach best meets the needs of your applications
|
||||
and environment. [This comparison topic](/docs/setup/independent/ha-topology/) outlines the advantages and disadvantages of each.
|
||||
|
||||
Your clusters must run Kubernetes version 1.12 or later. You should also be aware that
|
||||
setting up HA clusters with kubeadm is still experimental. You might encounter issues
|
||||
with upgrading your clusters, for example. We encourage you to try either approach,
|
||||
and provide feedback.
|
||||
setting up HA clusters with kubeadm is still experimental and will be further simplified
|
||||
in future versions. You might encounter issues with upgrading your clusters, for example.
|
||||
We encourage you to try either approach, and provide us with feedback in the kubeadm
|
||||
[issue tracker](https://github.com/kubernetes/kubeadm/issues/new).
|
||||
|
||||
Note that the alpha feature gate `HighAvailability` is deprecated in v1.12 and removed in v1.13.
|
||||
|
||||
See also [The HA upgrade documentation](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-ha).
|
||||
|
||||
{{< caution >}}
|
||||
This page does not address running your cluster on a cloud provider. In a cloud
|
||||
@@ -40,9 +48,10 @@ For both methods you need this infrastructure:
|
||||
requirements](/docs/setup/independent/install-kubeadm/#before-you-begin) for
|
||||
the workers
|
||||
- Full network connectivity between all machines in the cluster (public or
|
||||
private network is fine)
|
||||
- SSH access from one device to all nodes in the system
|
||||
private network)
|
||||
- sudo privileges on all machines
|
||||
- SSH access from one device to all nodes in the system
|
||||
- `kubeadm` and `kubelet` installed on all machines. `kubectl` is optional.
|
||||
|
||||
For the external etcd cluster only, you also need:
|
||||
|
||||
@@ -60,15 +69,60 @@ networking provider, make sure to replace any default values as needed.
|
||||
## First steps for both methods
|
||||
|
||||
{{< note >}}
|
||||
All commands in this guide on any control plane or etcd node should be run as root.
|
||||
**Note**: All commands on any control plane or etcd node should be
|
||||
run as root.
|
||||
{{< /note >}}
|
||||
|
||||
- Find your pod CIDR. For details, see [the CNI network
|
||||
documentation](/docs/setup/independent/create-cluster-kubeadm/#pod-network).
|
||||
The example uses Calico, so the pod CIDR is `192.168.0.0/16`.
|
||||
- Some CNI network plugins like Calico require a CIDR such as `192.168.0.0/16` and
|
||||
some like Weave do not. See the see [the CNI network
|
||||
documentation](/docs/setup/independent/create-cluster-kubeadm/#pod-network).
|
||||
To add a pod CIDR set the `podSubnet: 192.168.0.0/16` field under
|
||||
the `networking` object of `ClusterConfiguration`.
|
||||
|
||||
### Create load balancer for kube-apiserver
|
||||
|
||||
{{< note >}}
|
||||
There are many configurations for load balancers. The following example is only one
|
||||
option. Your cluster requirements may need a different configuration.
|
||||
{{< /note >}}
|
||||
|
||||
1. Create a kube-apiserver load balancer with a name that resolves to DNS.
|
||||
|
||||
- In a cloud environment you should place your control plane nodes behind a TCP
|
||||
forwarding load balancer. This load balancer distributes traffic to all
|
||||
healthy control plane nodes in its target list. The health check for
|
||||
an apiserver is a TCP check on the port the kube-apiserver listens on
|
||||
(default value `:6443`).
|
||||
|
||||
- It is not recommended to use an IP address directly in a cloud environment.
|
||||
|
||||
- The load balancer must be able to communicate with all control plane nodes
|
||||
on the apiserver port. It must also allow incoming traffic on its
|
||||
listening port.
|
||||
|
||||
- [HAProxy](http://www.haproxy.org/) can be used as a load balancer.
|
||||
|
||||
- Make sure the address of the load balancer always matches
|
||||
the address of kubeadm's `ControlPlaneEndpoint`.
|
||||
|
||||
1. Add the first control plane nodes to the load balancer and test the
|
||||
connection:
|
||||
|
||||
```sh
|
||||
nc -v LOAD_BALANCER_IP PORT
|
||||
```
|
||||
|
||||
- A connection refused error is expected because the apiserver is not yet
|
||||
running. A timeout, however, means the load balancer cannot communicate
|
||||
with the control plane node. If a timeout occurs, reconfigure the load
|
||||
balancer to communicate with the control plane node.
|
||||
|
||||
1. Add the remaining control plane nodes to the load balancer target group.
|
||||
|
||||
### Configure SSH
|
||||
|
||||
SSH is required if you want to control all nodes from a single machine.
|
||||
|
||||
1. Enable ssh-agent on your main device that has access to all other nodes in
|
||||
the system:
|
||||
|
||||
@@ -97,167 +151,81 @@ All commands in this guide on any control plane or etcd node should be run as ro
|
||||
sudo -E -s
|
||||
```
|
||||
|
||||
### Create load balancer for kube-apiserver
|
||||
## Stacked control plane and etcd nodes
|
||||
|
||||
{{< note >}}
|
||||
There are many configurations for load balancers. The following example is only one
|
||||
option. Your cluster requirements may need a different configuration.
|
||||
{{< /note >}}
|
||||
### Steps for the first control plane node
|
||||
|
||||
1. Create a kube-apiserver load balancer with a name that resolves to DNS.
|
||||
1. On the first control plane node, create a configuration file called `kubeadm-config.yaml`:
|
||||
|
||||
- In a cloud environment you should place your control plane nodes behind a TCP
|
||||
forwarding load balancer. This load balancer distributes traffic to all
|
||||
healthy control plane nodes in its target list. The health check for
|
||||
an apiserver is a TCP check on the port the kube-apiserver listens on
|
||||
(default value `:6443`).
|
||||
apiVersion: kubeadm.k8s.io/v1beta1
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServer:
|
||||
certSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
|
||||
- It is not recommended to use an IP address directly in a cloud environment.
|
||||
- `kubernetesVersion` should be set to the Kubernetes version to use. This
|
||||
example uses `stable`.
|
||||
- `controlPlaneEndpoint` should match the address or DNS and port of the load balancer.
|
||||
- It's recommended that the versions of kubeadm, kubelet, kubectl and Kubernetes match.
|
||||
|
||||
- The load balancer must be able to communicate with all control plane nodes
|
||||
on the apiserver port. It must also allow incoming traffic on its
|
||||
listening port.
|
||||
|
||||
1. Add the first control plane nodes to the load balancer and test the
|
||||
connection:
|
||||
1. Make sure that the node is in a clean state:
|
||||
|
||||
```sh
|
||||
nc -v LOAD_BALANCER_IP PORT
|
||||
sudo kubeadm init --config=kubeadm-config.yaml
|
||||
```
|
||||
|
||||
You should see something like:
|
||||
|
||||
```sh
|
||||
...
|
||||
You can now join any number of machines by running the following on each node
|
||||
as root:
|
||||
|
||||
kubeadm join 192.168.0.200:6443 --token j04n3m.octy8zely83cy2ts --discovery-token-ca-cert-hash sha256:84938d2a22203a8e56a787ec0c6ddad7bc7dbd52ebabc62fd5f4dbea72b14d1f
|
||||
```
|
||||
|
||||
- A connection refused error is expected because the apiserver is not yet
|
||||
running. A timeout, however, means the load balancer cannot communicate
|
||||
with the control plane node. If a timeout occurs, reconfigure the load
|
||||
balancer to communicate with the control plane node.
|
||||
1. Copy this output to a text file. You will need it later to join other control plane nodes to the
|
||||
cluster.
|
||||
|
||||
1. Add the remaining control plane nodes to the load balancer target group.
|
||||
1. Apply the Weave CNI plugin:
|
||||
|
||||
## Stacked control plane nodes
|
||||
```sh
|
||||
kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"
|
||||
```
|
||||
|
||||
### Bootstrap the first stacked control plane node
|
||||
1. Type the following and watch the pods of the components get started:
|
||||
|
||||
{{< note >}}
|
||||
Optionally replace the string `stable` with a different version of Kubernetes, for example `v1.12.0`.
|
||||
{{< /note >}}
|
||||
```sh
|
||||
kubectl get pod -n kube-system -w
|
||||
```
|
||||
|
||||
1. Create a `kubeadm-config.yaml` template file:
|
||||
- It's recommended that you join new control plane nodes only after the first node has finished initializing.
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
name: "CP0_HOSTNAME"
|
||||
listen-client-urls: "https://127.0.0.1:2379,https://CP0_IP:2379"
|
||||
advertise-client-urls: "https://CP0_IP:2379"
|
||||
listen-peer-urls: "https://CP0_IP:2380"
|
||||
initial-advertise-peer-urls: "https://CP0_IP:2380"
|
||||
initial-cluster: "CP0_HOSTNAME=https://CP0_IP:2380"
|
||||
serverCertSANs:
|
||||
- CP0_HOSTNAME
|
||||
- CP0_IP
|
||||
peerCertSANs:
|
||||
- CP0_HOSTNAME
|
||||
- CP0_IP
|
||||
networking:
|
||||
# This CIDR is a Calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
1. Copy the certificate files from the first control plane node to the rest:
|
||||
|
||||
1. Replace the following variables in the template with the appropriate
|
||||
values for your cluster:
|
||||
In the following example, replace `CONTROL_PLANE_IPS` with the IP addresses of the
|
||||
other control plane nodes.
|
||||
```sh
|
||||
USER=ubuntu # customizable
|
||||
CONTROL_PLANE_IPS="10.0.0.7 10.0.0.8"
|
||||
for host in ${CONTROL_PLANE_IPS}; do
|
||||
scp /etc/kubernetes/pki/ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/ca.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/sa.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/sa.pub "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/front-proxy-ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/front-proxy-ca.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/etcd/ca.crt "${USER}"@$host:etcd-ca.crt
|
||||
scp /etc/kubernetes/pki/etcd/ca.key "${USER}"@$host:etcd-ca.key
|
||||
scp /etc/kubernetes/admin.conf "${USER}"@$host:
|
||||
done
|
||||
```
|
||||
|
||||
* `LOAD_BALANCER_DNS`
|
||||
* `LOAD_BALANCER_PORT`
|
||||
* `CP0_HOSTNAME`
|
||||
* `CP0_IP`
|
||||
### Steps for the rest of the control plane nodes
|
||||
|
||||
1. Run `kubeadm init --config kubeadm-config.yaml`
|
||||
|
||||
### Copy required files to other control plane nodes
|
||||
|
||||
The following certificates and other required files were created when you ran `kubeadm init`.
|
||||
Copy these files to your other control plane nodes:
|
||||
|
||||
- `/etc/kubernetes/pki/ca.crt`
|
||||
- `/etc/kubernetes/pki/ca.key`
|
||||
- `/etc/kubernetes/pki/sa.key`
|
||||
- `/etc/kubernetes/pki/sa.pub`
|
||||
- `/etc/kubernetes/pki/front-proxy-ca.crt`
|
||||
- `/etc/kubernetes/pki/front-proxy-ca.key`
|
||||
- `/etc/kubernetes/pki/etcd/ca.crt`
|
||||
- `/etc/kubernetes/pki/etcd/ca.key`
|
||||
|
||||
Copy the admin kubeconfig to the other control plane nodes:
|
||||
|
||||
- `/etc/kubernetes/admin.conf`
|
||||
|
||||
In the following example, replace
|
||||
`CONTROL_PLANE_IPS` with the IP addresses of the other control plane nodes.
|
||||
|
||||
```sh
|
||||
USER=ubuntu # customizable
|
||||
CONTROL_PLANE_IPS="10.0.0.7 10.0.0.8"
|
||||
for host in ${CONTROL_PLANE_IPS}; do
|
||||
scp /etc/kubernetes/pki/ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/ca.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/sa.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/sa.pub "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/front-proxy-ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/front-proxy-ca.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/etcd/ca.crt "${USER}"@$host:etcd-ca.crt
|
||||
scp /etc/kubernetes/pki/etcd/ca.key "${USER}"@$host:etcd-ca.key
|
||||
scp /etc/kubernetes/admin.conf "${USER}"@$host:
|
||||
done
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
Remember that your config may differ from this example.
|
||||
{{< /note >}}
|
||||
|
||||
### Add the second stacked control plane node
|
||||
|
||||
1. Create a second, different `kubeadm-config.yaml` template file:
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
name: "CP1_HOSTNAME"
|
||||
listen-client-urls: "https://127.0.0.1:2379,https://CP1_IP:2379"
|
||||
advertise-client-urls: "https://CP1_IP:2379"
|
||||
listen-peer-urls: "https://CP1_IP:2380"
|
||||
initial-advertise-peer-urls: "https://CP1_IP:2380"
|
||||
initial-cluster: "CP0_HOSTNAME=https://CP0_IP:2380,CP1_HOSTNAME=https://CP1_IP:2380"
|
||||
initial-cluster-state: existing
|
||||
serverCertSANs:
|
||||
- CP1_HOSTNAME
|
||||
- CP1_IP
|
||||
peerCertSANs:
|
||||
- CP1_HOSTNAME
|
||||
- CP1_IP
|
||||
networking:
|
||||
# This CIDR is a calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace the following variables in the template with the appropriate values for your cluster:
|
||||
|
||||
- `LOAD_BALANCER_DNS`
|
||||
- `LOAD_BALANCER_PORT`
|
||||
- `CP0_HOSTNAME`
|
||||
- `CP0_IP`
|
||||
- `CP1_HOSTNAME`
|
||||
- `CP1_IP`
|
||||
|
||||
1. Move the copied files to the correct locations:
|
||||
1. Move the files created by the previous step where `scp` was used:
|
||||
|
||||
```sh
|
||||
USER=ubuntu # customizable
|
||||
@@ -273,180 +241,54 @@ Remember that your config may differ from this example.
|
||||
mv /home/${USER}/admin.conf /etc/kubernetes/admin.conf
|
||||
```
|
||||
|
||||
1. Run the kubeadm phase commands to bootstrap the kubelet:
|
||||
This process writes all the requested files in the `/etc/kubernetes` folder.
|
||||
|
||||
1. Start `kubeadm join` on this node using the join command that was previously given to you by `kubeadm init` on
|
||||
the first node. It should look something like this:
|
||||
|
||||
```sh
|
||||
kubeadm alpha phase certs all --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubelet config write-to-disk --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubelet write-env-file --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubeconfig kubelet --config kubeadm-config.yaml
|
||||
systemctl start kubelet
|
||||
sudo kubeadm join 192.168.0.200:6443 --token j04n3m.octy8zely83cy2ts --discovery-token-ca-cert-hash sha256:84938d2a22203a8e56a787ec0c6ddad7bc7dbd52ebabc62fd5f4dbea72b14d1f --experimental-control-plane
|
||||
```
|
||||
|
||||
1. Run the commands to add the node to the etcd cluster:
|
||||
- Notice the addition of the `--experimental-control-plane` flag. This flag automates joining this
|
||||
control plane node to the cluster.
|
||||
|
||||
1. Type the following and watch the pods of the components get started:
|
||||
|
||||
```sh
|
||||
export CP0_IP=10.0.0.7
|
||||
export CP0_HOSTNAME=cp0
|
||||
export CP1_IP=10.0.0.8
|
||||
export CP1_HOSTNAME=cp1
|
||||
|
||||
kubeadm alpha phase etcd local --config kubeadm-config.yaml
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
kubectl exec -n kube-system etcd-${CP0_HOSTNAME} -- etcdctl --ca-file /etc/kubernetes/pki/etcd/ca.crt --cert-file /etc/kubernetes/pki/etcd/peer.crt --key-file /etc/kubernetes/pki/etcd/peer.key --endpoints=https://${CP0_IP}:2379 member add ${CP1_HOSTNAME} https://${CP1_IP}:2380
|
||||
kubectl get pod -n kube-system -w
|
||||
```
|
||||
|
||||
- This command causes the etcd cluster to become unavailable for a
|
||||
brief period, after the node is added to the running cluster, and before the
|
||||
new node is joined to the etcd cluster.
|
||||
1. Repeat these steps for the rest of the control plane nodes.
|
||||
|
||||
1. Deploy the control plane components and mark the node as a master:
|
||||
## External etcd nodes
|
||||
|
||||
```sh
|
||||
kubeadm alpha phase kubeconfig all --config kubeadm-config.yaml
|
||||
kubeadm alpha phase controlplane all --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubelet config annotate-cri --config kubeadm-config.yaml
|
||||
kubeadm alpha phase mark-master --config kubeadm-config.yaml
|
||||
```
|
||||
|
||||
### Add the third stacked control plane node
|
||||
|
||||
1. Create a third, different `kubeadm-config.yaml` template file:
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
name: "CP2_HOSTNAME"
|
||||
listen-client-urls: "https://127.0.0.1:2379,https://CP2_IP:2379"
|
||||
advertise-client-urls: "https://CP2_IP:2379"
|
||||
listen-peer-urls: "https://CP2_IP:2380"
|
||||
initial-advertise-peer-urls: "https://CP2_IP:2380"
|
||||
initial-cluster: "CP0_HOSTNAME=https://CP0_IP:2380,CP1_HOSTNAME=https://CP1_IP:2380,CP2_HOSTNAME=https://CP2_IP:2380"
|
||||
initial-cluster-state: existing
|
||||
serverCertSANs:
|
||||
- CP2_HOSTNAME
|
||||
- CP2_IP
|
||||
peerCertSANs:
|
||||
- CP2_HOSTNAME
|
||||
- CP2_IP
|
||||
networking:
|
||||
# This CIDR is a calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace the following variables in the template with the appropriate values for your cluster:
|
||||
|
||||
- `LOAD_BALANCER_DNS`
|
||||
- `LOAD_BALANCER_PORT`
|
||||
- `CP0_HOSTNAME`
|
||||
- `CP0_IP`
|
||||
- `CP1_HOSTNAME`
|
||||
- `CP1_IP`
|
||||
- `CP2_HOSTNAME`
|
||||
- `CP2_IP`
|
||||
|
||||
1. Move the copied files to the correct locations:
|
||||
|
||||
```sh
|
||||
USER=ubuntu # customizable
|
||||
mkdir -p /etc/kubernetes/pki/etcd
|
||||
mv /home/${USER}/ca.crt /etc/kubernetes/pki/
|
||||
mv /home/${USER}/ca.key /etc/kubernetes/pki/
|
||||
mv /home/${USER}/sa.pub /etc/kubernetes/pki/
|
||||
mv /home/${USER}/sa.key /etc/kubernetes/pki/
|
||||
mv /home/${USER}/front-proxy-ca.crt /etc/kubernetes/pki/
|
||||
mv /home/${USER}/front-proxy-ca.key /etc/kubernetes/pki/
|
||||
mv /home/${USER}/etcd-ca.crt /etc/kubernetes/pki/etcd/ca.crt
|
||||
mv /home/${USER}/etcd-ca.key /etc/kubernetes/pki/etcd/ca.key
|
||||
mv /home/${USER}/admin.conf /etc/kubernetes/admin.conf
|
||||
```
|
||||
|
||||
1. Run the kubeadm phase commands to bootstrap the kubelet:
|
||||
|
||||
```sh
|
||||
kubeadm alpha phase certs all --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubelet config write-to-disk --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubelet write-env-file --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubeconfig kubelet --config kubeadm-config.yaml
|
||||
systemctl start kubelet
|
||||
```
|
||||
|
||||
1. Run the commands to add the node to the etcd cluster:
|
||||
|
||||
```sh
|
||||
export CP0_IP=10.0.0.7
|
||||
export CP0_HOSTNAME=cp0
|
||||
export CP2_IP=10.0.0.9
|
||||
export CP2_HOSTNAME=cp2
|
||||
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
kubectl exec -n kube-system etcd-${CP0_HOSTNAME} -- etcdctl --ca-file /etc/kubernetes/pki/etcd/ca.crt --cert-file /etc/kubernetes/pki/etcd/peer.crt --key-file /etc/kubernetes/pki/etcd/peer.key --endpoints=https://${CP0_IP}:2379 member add ${CP2_HOSTNAME} https://${CP2_IP}:2380
|
||||
kubeadm alpha phase etcd local --config kubeadm-config.yaml
|
||||
```
|
||||
|
||||
1. Deploy the control plane components and mark the node as a master:
|
||||
|
||||
```sh
|
||||
kubeadm alpha phase kubeconfig all --config kubeadm-config.yaml
|
||||
kubeadm alpha phase controlplane all --config kubeadm-config.yaml
|
||||
kubeadm alpha phase kubelet config annotate-cri --config kubeadm-config.yaml
|
||||
kubeadm alpha phase mark-master --config kubeadm-config.yaml
|
||||
```
|
||||
|
||||
## External etcd
|
||||
|
||||
### Set up the cluster
|
||||
### Set up the etcd cluster
|
||||
|
||||
- Follow [these instructions](/docs/setup/independent/setup-ha-etcd-with-kubeadm/)
|
||||
to set up the etcd cluster.
|
||||
|
||||
#### Copy required files from an etcd node to all control plane nodes
|
||||
|
||||
In the following example, replace `USER` and `CONTROL_PLANE_HOSTS` values with values
|
||||
for your environment.
|
||||
|
||||
```sh
|
||||
# Make a list of required etcd certificate files
|
||||
cat << EOF > etcd-pki-files.txt
|
||||
/etc/kubernetes/pki/etcd/ca.crt
|
||||
/etc/kubernetes/pki/apiserver-etcd-client.crt
|
||||
/etc/kubernetes/pki/apiserver-etcd-client.key
|
||||
EOF
|
||||
|
||||
# create the archive
|
||||
tar -czf etcd-pki.tar.gz -T etcd-pki-files.txt
|
||||
|
||||
# copy the archive to the control plane nodes
|
||||
USER=ubuntu
|
||||
CONTROL_PLANE_HOSTS="10.0.0.7 10.0.0.8 10.0.0.9"
|
||||
for host in $CONTROL_PLANE_HOSTS; do
|
||||
scp etcd-pki.tar.gz "${USER}"@$host:
|
||||
done
|
||||
```
|
||||
to set up the etcd cluster.
|
||||
|
||||
### Set up the first control plane node
|
||||
|
||||
{{< note >}}
|
||||
Optionally replace the string `stable` with a different version of Kubernetes, for example `v1.11.3`.
|
||||
{{< /note >}}
|
||||
1. Copy the following files from any node from the etcd cluster to this node:
|
||||
|
||||
1. Extract the etcd certificates
|
||||
```sh
|
||||
export CONTROL_PLANE="ubuntu@10.0.0.7"
|
||||
+scp /etc/kubernetes/pki/etcd/ca.crt "${CONTROL_PLANE}":
|
||||
+scp /etc/kubernetes/pki/apiserver-etcd-client.crt "${CONTROL_PLANE}":
|
||||
+scp /etc/kubernetes/pki/apiserver-etcd-client.key "${CONTROL_PLANE}":
|
||||
```
|
||||
|
||||
mkdir -p /etc/kubernetes/pki
|
||||
tar -xzf etcd-pki.tar.gz -C /etc/kubernetes/pki --strip-components=3
|
||||
- Replace the value of `CONTROL_PLANE` with the `user@host` of this machine.
|
||||
|
||||
1. Create a `kubeadm-config.yaml`:
|
||||
1. Create a file called `kubeadm-config.yaml` with the following contents:
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
apiVersion: kubeadm.k8s.io/v1beta1
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
apiServer:
|
||||
certSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
external:
|
||||
@@ -457,82 +299,38 @@ Optionally replace the string `stable` with a different version of Kubernetes, f
|
||||
caFile: /etc/kubernetes/pki/etcd/ca.crt
|
||||
certFile: /etc/kubernetes/pki/apiserver-etcd-client.crt
|
||||
keyFile: /etc/kubernetes/pki/apiserver-etcd-client.key
|
||||
networking:
|
||||
# This CIDR is a calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace the following variables in the template with the appropriate values for your cluster:
|
||||
- The difference between stacked etcd and external etcd here is that we are using the `external` field for `etcd` in the kubeadm config. In the case of the stacked etcd topology this is managed automatically.
|
||||
|
||||
- `LOAD_BALANCER_DNS`
|
||||
- `LOAD_BALANCER_PORT`
|
||||
- `ETCD_0_IP`
|
||||
- `ETCD_1_IP`
|
||||
- `ETCD_2_IP`
|
||||
- Replace the following variables in the template with the appropriate values for your cluster:
|
||||
|
||||
1. Run `kubeadm init --config kubeadm-config.yaml`
|
||||
1. Copy the output from the join command
|
||||
- `LOAD_BALANCER_DNS`
|
||||
- `LOAD_BALANCER_PORT`
|
||||
- `ETCD_0_IP`
|
||||
- `ETCD_1_IP`
|
||||
- `ETCD_2_IP`
|
||||
|
||||
### Copy required files to the correct locations
|
||||
1. Run `kubeadm init --config kubeadm-config.yaml` on this node.
|
||||
|
||||
The following pki files were created during the `kubeadm init` step and must be shared with
|
||||
all other control plane nodes.
|
||||
1. Write the join command that is returned to a text file for later use.
|
||||
|
||||
- `/etc/kubernetes/pki/ca.crt`
|
||||
- `/etc/kubernetes/pki/ca.key`
|
||||
- `/etc/kubernetes/pki/sa.key`
|
||||
- `/etc/kubernetes/pki/sa.pub`
|
||||
- `/etc/kubernetes/pki/front-proxy-ca.crt`
|
||||
- `/etc/kubernetes/pki/front-proxy-ca.key`
|
||||
1. Apply the Weave CNI plugin:
|
||||
|
||||
In the following example, replace the list of
|
||||
`CONTROL_PLANE_IPS` values with the IP addresses of the other control plane nodes.
|
||||
```sh
|
||||
kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"
|
||||
```
|
||||
|
||||
```sh
|
||||
# make a list of required kubernetes certificate files
|
||||
cat << EOF > certificate_files.txt
|
||||
/etc/kubernetes/pki/ca.crt
|
||||
/etc/kubernetes/pki/ca.key
|
||||
/etc/kubernetes/pki/sa.key
|
||||
/etc/kubernetes/pki/sa.pub
|
||||
/etc/kubernetes/pki/front-proxy-ca.crt
|
||||
/etc/kubernetes/pki/front-proxy-ca.key
|
||||
EOF
|
||||
### Steps for the rest of the control plane nodes
|
||||
|
||||
# create the archive
|
||||
tar -czf control-plane-certificates.tar.gz -T certificate_files.txt
|
||||
To add the rest of the control plane nodes, follow [these instructions](#steps-for-the-rest-of-the-control-plane-nodes).
|
||||
The steps are the same as for the stacked etcd setup, with the exception that a local
|
||||
etcd member is not created.
|
||||
|
||||
USER=ubuntu # customizable
|
||||
CONTROL_PLANE_IPS="10.0.0.7 10.0.0.8"
|
||||
for host in ${CONTROL_PLANE_IPS}; do
|
||||
scp control-plane-certificates.tar.gz "${USER}"@$host:
|
||||
done
|
||||
```
|
||||
To summarize:
|
||||
|
||||
### Set up the other control plane nodes
|
||||
|
||||
1. Extract the required certificates
|
||||
|
||||
mkdir -p /etc/kubernetes/pki
|
||||
tar -xzf etcd-pki.tar.gz -C /etc/kubernetes/pki --strip-components 3
|
||||
tar -xzf control-plane-certificates.tar.gz -C /etc/kubernetes/pki --strip-components 3
|
||||
|
||||
1. Verify the location of the copied files.
|
||||
Your `/etc/kubernetes` directory should look like this:
|
||||
|
||||
- `/etc/kubernetes/pki/apiserver-etcd-client.crt`
|
||||
- `/etc/kubernetes/pki/apiserver-etcd-client.key`
|
||||
- `/etc/kubernetes/pki/ca.crt`
|
||||
- `/etc/kubernetes/pki/ca.key`
|
||||
- `/etc/kubernetes/pki/front-proxy-ca.crt`
|
||||
- `/etc/kubernetes/pki/front-proxy-ca.key`
|
||||
- `/etc/kubernetes/pki/sa.key`
|
||||
- `/etc/kubernetes/pki/sa.pub`
|
||||
- `/etc/kubernetes/pki/etcd/ca.crt`
|
||||
|
||||
1. Run the copied `kubeadm join` command from above. Add the flag "--experimental-control-plane".
|
||||
The final command will look something like this:
|
||||
|
||||
kubeadm join ha.k8s.example.com:6443 --token 5ynki1.3erp9i3yo7gqg1nv --discovery-token-ca-cert-hash sha256:a00055bd8c710a9906a3d91b87ea02976334e1247936ac061d867a0f014ecd81 --experimental-control-plane
|
||||
- Make sure the first control plane node is fully initialized.
|
||||
- Copy certificates between the first control plane node and the other control plane nodes.
|
||||
- Join each control plane node with the join command you saved to a text file, plus add the `--experimental-control-plane` flag.
|
||||
|
||||
## Common tasks after bootstrapping control plane
|
||||
|
||||
@@ -545,6 +343,6 @@ in the master configuration file.
|
||||
### Install workers
|
||||
|
||||
Each worker node can now be joined to the cluster with the command returned from any of the
|
||||
`kubeadm init` commands.
|
||||
`kubeadm init` commands. The flag `--experimental-control-plane` should not be added to worker nodes.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
@@ -3,7 +3,7 @@ reviewers:
|
||||
- sig-cluster-lifecycle
|
||||
title: Configuring each kubelet in your cluster using kubeadm
|
||||
content_template: templates/concept
|
||||
weight: 40
|
||||
weight: 80
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
@@ -3,7 +3,7 @@ reviewers:
|
||||
- sig-cluster-lifecycle
|
||||
title: Set up a High Availability etcd cluster with kubeadm
|
||||
content_template: templates/task
|
||||
weight: 60
|
||||
weight: 70
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
@@ -83,7 +83,7 @@ this example.
|
||||
HOST=${ETCDHOSTS[$i]}
|
||||
NAME=${NAMES[$i]}
|
||||
cat << EOF > /tmp/${HOST}/kubeadmcfg.yaml
|
||||
apiVersion: "kubeadm.k8s.io/v1alpha3"
|
||||
apiVersion: "kubeadm.k8s.io/v1beta1"
|
||||
kind: ClusterConfiguration
|
||||
etcd:
|
||||
local:
|
||||
@@ -114,7 +114,7 @@ this example.
|
||||
generated the configuration files for kubeadm).
|
||||
|
||||
```
|
||||
kubeadm alpha phase certs etcd-ca
|
||||
kubeadm init phase certs etcd-ca
|
||||
```
|
||||
|
||||
This creates two files
|
||||
@@ -125,25 +125,25 @@ this example.
|
||||
1. Create certificates for each member
|
||||
|
||||
```sh
|
||||
kubeadm alpha phase certs etcd-server --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs etcd-peer --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs etcd-healthcheck-client --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs apiserver-etcd-client --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-server --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-peer --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-healthcheck-client --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs apiserver-etcd-client --config=/tmp/${HOST2}/kubeadmcfg.yaml
|
||||
cp -R /etc/kubernetes/pki /tmp/${HOST2}/
|
||||
# cleanup non-reusable certificates
|
||||
find /etc/kubernetes/pki -not -name ca.crt -not -name ca.key -type f -delete
|
||||
|
||||
kubeadm alpha phase certs etcd-server --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs etcd-peer --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs etcd-healthcheck-client --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs apiserver-etcd-client --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-server --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-peer --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-healthcheck-client --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs apiserver-etcd-client --config=/tmp/${HOST1}/kubeadmcfg.yaml
|
||||
cp -R /etc/kubernetes/pki /tmp/${HOST1}/
|
||||
find /etc/kubernetes/pki -not -name ca.crt -not -name ca.key -type f -delete
|
||||
|
||||
kubeadm alpha phase certs etcd-server --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs etcd-peer --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs etcd-healthcheck-client --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm alpha phase certs apiserver-etcd-client --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-server --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-peer --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs etcd-healthcheck-client --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
kubeadm init phase certs apiserver-etcd-client --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
# No need to move the certs because they are for HOST0
|
||||
|
||||
# clean up certs that should not be copied off this host
|
||||
@@ -233,9 +233,9 @@ this example.
|
||||
for etcd.
|
||||
|
||||
```sh
|
||||
root@HOST0 $ kubeadm alpha phase etcd local --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
root@HOST1 $ kubeadm alpha phase etcd local --config=/home/ubuntu/kubeadmcfg.yaml
|
||||
root@HOST2 $ kubeadm alpha phase etcd local --config=/home/ubuntu/kubeadmcfg.yaml
|
||||
root@HOST0 $ kubeadm init phase etcd local --config=/tmp/${HOST0}/kubeadmcfg.yaml
|
||||
root@HOST1 $ kubeadm init phase etcd local --config=/home/ubuntu/kubeadmcfg.yaml
|
||||
root@HOST2 $ kubeadm init phase etcd local --config=/home/ubuntu/kubeadmcfg.yaml
|
||||
```
|
||||
|
||||
1. Optional: Check the cluster health
|
||||
@@ -243,7 +243,7 @@ this example.
|
||||
```sh
|
||||
docker run --rm -it \
|
||||
--net host \
|
||||
-v /etc/kubernetes:/etc/kubernetes quay.io/coreos/etcd:v3.2.18 etcdctl \
|
||||
-v /etc/kubernetes:/etc/kubernetes quay.io/coreos/etcd:${ETCD_TAG} etcdctl \
|
||||
--cert-file /etc/kubernetes/pki/etcd/peer.crt \
|
||||
--key-file /etc/kubernetes/pki/etcd/peer.key \
|
||||
--ca-file /etc/kubernetes/pki/etcd/ca.crt \
|
||||
@@ -251,6 +251,8 @@ this example.
|
||||
...
|
||||
cluster is healthy
|
||||
```
|
||||
- Set `${ETCD_TAG}` to the version tag of your etcd image. For example `v3.2.24`.
|
||||
- Set `${HOST0}`to the IP address of the host you are testing.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Troubleshooting kubeadm
|
||||
content_template: templates/concept
|
||||
weight: 70
|
||||
weight: 90
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
@@ -194,7 +194,7 @@ Error from server: Get https://10.19.0.41:10250/containerLogs/default/mysql-ddc6
|
||||
curl http://169.254.169.254/metadata/v1/interfaces/public/0/anchor_ipv4/address
|
||||
```
|
||||
|
||||
The workaround is to tell `kubelet` which IP to use using `--node-ip`. When using Digital Ocean, it can be the public one (assigned to `eth0`) or the private one (assigned to `eth1`) should you want to use the optional private network. The [`KubeletExtraArgs` section of the kubeadm `NodeRegistrationOptions` structure](https://github.com/kubernetes/kubernetes/blob/release-1.12/cmd/kubeadm/app/apis/kubeadm/v1alpha3/types.go#L163-L166) can be used for this.
|
||||
The workaround is to tell `kubelet` which IP to use using `--node-ip`. When using Digital Ocean, it can be the public one (assigned to `eth0`) or the private one (assigned to `eth1`) should you want to use the optional private network. The [`KubeletExtraArgs` section of the kubeadm `NodeRegistrationOptions` structure](https://github.com/kubernetes/kubernetes/blob/release-1.13/cmd/kubeadm/app/apis/kubeadm/v1beta1/types.go) can be used for this.
|
||||
|
||||
Then restart `kubelet`:
|
||||
|
||||
@@ -203,46 +203,6 @@ Error from server: Get https://10.19.0.41:10250/containerLogs/default/mysql-ddc6
|
||||
systemctl restart kubelet
|
||||
```
|
||||
|
||||
## Services with externalTrafficPolicy=Local are not reachable
|
||||
|
||||
On nodes where the hostname for the kubelet is overridden using the `--hostname-override` option, kube-proxy will default to treating 127.0.0.1 as the node IP, which results in rejecting connections for Services configured for `externalTrafficPolicy=Local`. This situation can be verified by checking the output of `kubectl -n kube-system logs <kube-proxy pod name>`:
|
||||
|
||||
```sh
|
||||
W0507 22:33:10.372369 1 server.go:586] Failed to retrieve node info: nodes "ip-10-0-23-78" not found
|
||||
W0507 22:33:10.372474 1 proxier.go:463] invalid nodeIP, initializing kube-proxy with 127.0.0.1 as nodeIP
|
||||
```
|
||||
|
||||
A workaround for this is to modify the kube-proxy DaemonSet in the following way:
|
||||
|
||||
```sh
|
||||
kubectl -n kube-system patch --type json daemonset kube-proxy -p "$(cat <<'EOF'
|
||||
[
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/template/spec/containers/0/env",
|
||||
"value": [
|
||||
{
|
||||
"name": "NODE_NAME",
|
||||
"valueFrom": {
|
||||
"fieldRef": {
|
||||
"apiVersion": "v1",
|
||||
"fieldPath": "spec.nodeName"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/template/spec/containers/0/command/-",
|
||||
"value": "--hostname-override=${NODE_NAME}"
|
||||
}
|
||||
]
|
||||
EOF
|
||||
)"
|
||||
|
||||
```
|
||||
|
||||
## `coredns` pods have `CrashLoopBackOff` or `Error` state
|
||||
|
||||
If you have nodes that are running SELinux with an older version of Docker you might experience a scenario
|
||||
|
||||
+1182
-708
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user