From 31de9f07a3d3e04c82cdb4bc3af0cecdc1cd0d0e Mon Sep 17 00:00:00 2001 From: Fabrizio Pandini Date: Wed, 29 Nov 2017 18:44:59 +0100 Subject: [PATCH] Improve Kubeadm reference doc (#6103) * automatically-generated kubeadm reference doc * user-mantained kubeadm reference doc --- _data/reference.yml | 12 +- docs/reference/generated/kubeadm.md | 1040 ----------------- .../setup-tools/kubeadm/generated/README.md | 1 + .../setup-tools/kubeadm/generated/kubeadm.md | 39 + .../kubeadm/generated/kubeadm_alpha.md | 8 + .../kubeadm/generated/kubeadm_alpha_phase.md | 8 + .../generated/kubeadm_alpha_phase_addon.md | 8 + .../kubeadm_alpha_phase_addon_all.md | 45 + .../kubeadm_alpha_phase_addon_kube-dns.md | 33 + .../kubeadm_alpha_phase_addon_kube-proxy.md | 26 + .../kubeadm_alpha_phase_bootstrap-token.md | 14 + ...kubeadm_alpha_phase_bootstrap-token_all.md | 43 + ...lpha_phase_bootstrap-token_cluster-info.md | 22 + ...eadm_alpha_phase_bootstrap-token_create.md | 35 + ...ubeadm_alpha_phase_bootstrap-token_node.md | 14 + ...bootstrap-token_node_allow-auto-approve.md | 22 + ...se_bootstrap-token_node_allow-post-csrs.md | 22 + .../generated/kubeadm_alpha_phase_certs.md | 8 + .../kubeadm_alpha_phase_certs_all.md | 39 + ...ha_phase_certs_apiserver-kubelet-client.md | 23 + .../kubeadm_alpha_phase_certs_apiserver.md | 29 + .../generated/kubeadm_alpha_phase_certs_ca.md | 23 + ...ubeadm_alpha_phase_certs_front-proxy-ca.md | 23 + ...dm_alpha_phase_certs_front-proxy-client.md | 23 + .../generated/kubeadm_alpha_phase_certs_sa.md | 23 + .../kubeadm_alpha_phase_controlplane.md | 8 + .../kubeadm_alpha_phase_controlplane_all.md | 44 + ...eadm_alpha_phase_controlplane_apiserver.md | 32 + ...a_phase_controlplane_controller-manager.md | 23 + ...eadm_alpha_phase_controlplane_scheduler.md | 22 + .../generated/kubeadm_alpha_phase_etcd.md | 8 + .../kubeadm_alpha_phase_etcd_local.md | 32 + .../kubeadm_alpha_phase_kubeconfig.md | 8 + .../kubeadm_alpha_phase_kubeconfig_admin.md | 24 + .../kubeadm_alpha_phase_kubeconfig_all.md | 36 + ...pha_phase_kubeconfig_controller-manager.md | 24 + .../kubeadm_alpha_phase_kubeconfig_kubelet.md | 27 + ...ubeadm_alpha_phase_kubeconfig_scheduler.md | 24 + .../kubeadm_alpha_phase_kubeconfig_user.md | 32 + .../kubeadm_alpha_phase_mark-master.md | 32 + .../kubeadm_alpha_phase_preflight.md | 8 + .../kubeadm_alpha_phase_preflight_master.md | 21 + .../kubeadm_alpha_phase_preflight_node.md | 21 + .../kubeadm_alpha_phase_selfhosting.md | 8 + ...ase_selfhosting_convert-from-staticpods.md | 41 + .../kubeadm_alpha_phase_upload-config.md | 30 + .../kubeadm/generated/kubeadm_completion.md | 49 + .../kubeadm/generated/kubeadm_config.md | 23 + .../generated/kubeadm_config_upload.md | 18 + .../kubeadm_config_upload_from-file.md | 30 + .../kubeadm_config_upload_from-flags.md | 47 + .../kubeadm/generated/kubeadm_config_view.md | 22 + .../kubeadm/generated/kubeadm_init.md | 40 + .../kubeadm/generated/kubeadm_join.md | 75 ++ .../kubeadm/generated/kubeadm_reset.md | 20 + .../kubeadm/generated/kubeadm_token.md | 36 + .../kubeadm/generated/kubeadm_token_create.md | 36 + .../kubeadm/generated/kubeadm_token_delete.md | 24 + .../generated/kubeadm_token_generate.md | 29 + .../kubeadm/generated/kubeadm_token_list.md | 21 + .../kubeadm/generated/kubeadm_upgrade.md | 30 + .../generated/kubeadm_upgrade_apply.md | 40 + .../kubeadm/generated/kubeadm_upgrade_plan.md | 30 + .../kubeadm/generated/kubeadm_version.md | 18 + .../setup-tools/kubeadm/kubeadm-alpha.md | 261 +++++ .../setup-tools/kubeadm/kubeadm-config.md | 31 + .../setup-tools/kubeadm/kubeadm-init.md | 417 +++++++ .../setup-tools/kubeadm/kubeadm-join.md | 227 ++++ .../setup-tools/kubeadm/kubeadm-reset.md | 31 + .../setup-tools/kubeadm/kubeadm-token.md | 34 + .../setup-tools/kubeadm/kubeadm-upgrade.md | 24 + .../setup-tools/kubeadm/kubeadm-version.md | 15 + docs/reference/setup-tools/kubeadm/kubeadm.md | 21 + skip_title_check.txt | 62 + skip_toc_check.txt | 66 +- 75 files changed, 2822 insertions(+), 1043 deletions(-) delete mode 100644 docs/reference/generated/kubeadm.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/README.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_addon.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_addon_all.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_addon_kube-dns.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_addon_kube-proxy.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_all.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_cluster-info.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_create.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node_allow-auto-approve.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_all.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver-kubelet-client.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_ca.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_front-proxy-ca.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_front-proxy-client.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_sa.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_controlplane.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_controlplane_all.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_controlplane_apiserver.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_controlplane_controller-manager.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_controlplane_scheduler.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_controller-manager.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_kubelet.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_scheduler.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_user.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_mark-master.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_preflight.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_preflight_master.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_preflight_node.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_selfhosting.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_upload-config.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_completion.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_config.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_config_upload.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_config_upload_from-file.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_config_upload_from-flags.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_config_view.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_token_delete.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_token_list.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md create mode 100644 docs/reference/setup-tools/kubeadm/generated/kubeadm_version.md create mode 100755 docs/reference/setup-tools/kubeadm/kubeadm-alpha.md create mode 100644 docs/reference/setup-tools/kubeadm/kubeadm-config.md create mode 100755 docs/reference/setup-tools/kubeadm/kubeadm-init.md create mode 100755 docs/reference/setup-tools/kubeadm/kubeadm-join.md create mode 100644 docs/reference/setup-tools/kubeadm/kubeadm-reset.md create mode 100644 docs/reference/setup-tools/kubeadm/kubeadm-token.md create mode 100755 docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md create mode 100644 docs/reference/setup-tools/kubeadm/kubeadm-version.md create mode 100644 docs/reference/setup-tools/kubeadm/kubeadm.md diff --git a/_data/reference.yml b/_data/reference.yml index 5c9ba3d2c1..318061ac22 100644 --- a/_data/reference.yml +++ b/_data/reference.yml @@ -70,7 +70,17 @@ toc: - title: Setup Tools section: - - docs/reference/generated/kubeadm.md + - title: Kubeadm + section: + - docs/reference/setup-tools/kubeadm/kubeadm.md + - docs/reference/setup-tools/kubeadm/kubeadm-init.md + - docs/reference/setup-tools/kubeadm/kubeadm-join.md + - docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md + - docs/reference/setup-tools/kubeadm/kubeadm-config.md + - docs/reference/setup-tools/kubeadm/kubeadm-reset.md + - docs/reference/setup-tools/kubeadm/kubeadm-token.md + - docs/reference/setup-tools/kubeadm/kubeadm-version.md + - docs/reference/setup-tools/kubeadm/kubeadm-alpha.md - title: Kubefed section: - docs/reference/generated/kubefed.md diff --git a/docs/reference/generated/kubeadm.md b/docs/reference/generated/kubeadm.md deleted file mode 100644 index 525df75f5b..0000000000 --- a/docs/reference/generated/kubeadm.md +++ /dev/null @@ -1,1040 +0,0 @@ ---- -approvers: -- mikedanese -- luxas -- errordeveloper -- jbeda -title: Kubeadm -notitle: true ---- -# kubeadm Setup Tool Reference Guide - -This document provides information on how to use kubeadm's advanced options. - -* TOC -{:toc} - -Running `kubeadm init` bootstraps a Kubernetes master node. This consists of the -following steps: - -1. kubeadm runs a series of pre-flight checks to validate the system state - before making changes. Some checks only trigger warnings, others are - considered errors and will exit kubeadm until the problem is corrected or the - user specifies `--skip-preflight-checks`. - -1. kubeadm generates a token that additional nodes can use to register - themselves with the master in future. Optionally, the user can provide a - token via `--token`, as described in the - [section on managing tokens](#manage-tokens) below. - -1. kubeadm generates a self-signed CA to provision identities for each component - (including nodes) in the cluster. It also generates client certificates to - be used by various components. If the user has provided their own CA by - dropping it in the cert directory configured via `--cert-dir` - (`/etc/kubernetes/pki` by default) this step is skipped as described in the - [section on using custom certificates](#custom-certificates). - -1. kubeadm writes kubeconfig files in `/etc/kubernetes/` for - the kubelet, the controller-manager and the scheduler to use to connect to the - API server, each one with their respective identities, as well as an additional - kubeconfig file for administration. - -1. kubeadm generates static Pod manifests for the API server, - controller manager and scheduler; in case an external etcd is not provided, - an additional static Pod manifest will be generated for etcd. - - Static Pod manifests are written in `/etc/kubernetes/manifests`; the kubelet - watches this directory for Pods to create on startup, as described in - the [section about kubelet drop-in](#kubelet-drop-in). - - Once control plane Pods are up and running kubeadm init sequence can continue. - -1. kubeadm "labels" and "taints" the master node so that only control plane - components will run there. - -1. kubeadm makes all the necessary configurations for allowing node joining with the - [Bootstrap Tokens](https://kubernetes.io/docs/admin/bootstrap-tokens/) and - [TLS Bootstrap](https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/) - mechanism: - - - Write a ConfigMap for making available all the information required - for joining and set up related RBAC access rules. - - - Ensure access to the CSR signing API for bootstrap tokens. - - - Configure auto approval for new CSR requests. - - See [Securing your installation](#securing-more) for hardening. - -1. kubeadm installs add-on components via the API server. Right now this is - the internal DNS server and the kube-proxy DaemonSet. - -1. If `kubeadm init` is invoked with the alpha self-hosting feature enabled, - (`--feature-gates=SelfHosting=true`), the static Pod based control plane will - be transformed into a [self-hosted control plane](#self-hosting). - -Running `kubeadm join` on each node in the cluster consists of the following -steps: - -1. kubeadm downloads necessary cluster information from the API server. - By default, it uses the bootstrap token and the CA key hash to verify the - authenticity of that data. The root CA can also be discovered directly via a - file or URL. - -1. Once the cluster information are known, kubelet can start the TLS bootstrapping - process (in v.1.7 this step was managed by kubeadm). - - The TLS bootstrap uses the shared token to temporarily authenticate - with the Kubernetes Master to submit a certificate signing request (CSR); by - default the control plane will sign this CSR request automatically. - -1. Finally, kubeadm will configure the local kubelet to connect to the API - server with the definitive identity assigned to the node. - -## Usage - -Fields that support multiple values do so either with comma separation, or by -specifying the flag multiple times. - -The kubeadm command line interface is currently in **beta**. We are aiming to -not break any scripted use of the main `kubeadm init` and `kubeadm join`. -Exceptions to this are documented below. - -### `kubeadm init` - -It is usually sufficient to run `kubeadm init` without any flags, but in some -cases you might like to override the default behaviour. Here we specify all the -flags that can be used to customise the Kubernetes installation. - -**Options for `kubeadm init`:** - -- `--apiserver-advertise-address` - - This is the address the API Server will advertise to other members of the - cluster. This is also the address used to construct the suggested `kubeadm - join` line at the end of the init process. If not set (or set to 0.0.0.0) then - IP for the default interface will be used. - - This address is also added to the certificate that the API Server uses. - -- `--apiserver-bind-port` - - The port that the API server will bind on. This defaults to 6443. - -- `--apiserver-cert-extra-sans` - - Additional hostnames or IP addresses that should be added to the Subject - Alternate Name section for the certificate that the API Server will use. If you - expose the API Server through a load balancer and public DNS you could specify - this with - - ``` - --apiserver-cert-extra-sans=kubernetes.example.com,kube.example.com,10.100.245.1 - ``` - -- `--cert-dir` - - The path where to save and store the certificates. The default is - "/etc/kubernetes/pki". - -- `--config` - - A kubeadm specific [config file](#config-file). This can be used to specify an - extended set of options including passing arbitrary command line flags to the - control plane components. - - **Note**: Since 1.8, other flags are not allowed alongside `--config` except - for flags used to define kubeadm behaviour (not configuration) such as - `--skip-preflight-checks`. - -- `--dry-run` - - This flag tells kubeadm to don't apply any changes; just output what would be done. - -- `--feature-gates` - - A set of key=value pairs that describe feature gates for alpha/experimental - features. Options are: - - - SelfHosting=true\|false (ALPHA - default=false) - - - StoreCertsInSecrets=true\|false (ALPHA - default=false) - - See [self-hosted control plane](#self-hosting) for more detail. - -- `--kubernetes-version` (default 'latest') the kubernetes version to initialise - - The **v1.6** version of kubeadm only supports building clusters that are at - least **v1.6.0**. There are many reasons for this including kubeadm's use of - RBAC, the Bootstrap Token system, and enhancements to the Certificates API. With - this flag you can try any future version of Kubernetes. Check [releases - page](https://github.com/kubernetes/kubernetes/releases) for a full list of - available versions. - -- `--node-name` - - Allow to specify the node name, if something different than O.S. hostname should be used e.g. in case of Amazon EC2 instances. - - The node-name is also added to the certificate that the API Server uses. - -- `--pod-network-cidr` - - For certain networking solutions the Kubernetes master can also play a role in - allocating network ranges (CIDRs) to each node. This includes many cloud - providers and flannel. You can specify a subnet range that will be broken down - and handed out to each node with the `--pod-network-cidr` flag. This should be a - minimum of a /16 so controller-manager is able to assign /24 subnets to each - node in the cluster. If you are using flannel with [this - manifest](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml) - you should use `--pod-network-cidr=10.244.0.0/16`. Most CNI based networking - solutions do not require this flag. - -- `--service-cidr` (default '10.96.0.0/12') - - You can use the `--service-cidr` flag to override the subnet Kubernetes uses to - assign services IP addresses. If you do, you will also need to update the - `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file to reflect this - change else DNS will not function correctly. - -- `--service-dns-domain` (default 'cluster.local') - - By default, `kubeadm init` deploys a cluster that assigns services with DNS - names `..svc.cluster.local`. You can use the - `--service-dns-domain` to change the DNS name suffix. Again, you will need to - update the `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file - accordingly else DNS will not function correctly. - - **Note**: This flag has an effect (it's needed for the kube-dns Deployment - manifest and the API Server's serving certificate) but not as you might expect, - since you will have to modify the arguments to the kubelets in the cluster for - it to work fully. Specifying DNS parameters using this flag only is not enough. - Rewriting the kubelet's CLI arguments is out of scope for kubeadm as it should - be agnostic to how you run the kubelet. However, making all kubelets in the - cluster pick up information dynamically via the API _is_ in scope and is a - [planned feature](https://github.com/kubernetes/kubeadm/issues/28) for upcoming - releases. - -- `--skip-preflight-checks` - - By default, kubeadm runs a series of preflight checks to validate the system - before making any changes. Advanced users can use this flag to bypass these if - necessary. - -- `--skip-token-print` - - By default, kubeadm prints the token at the end of the init procedure. Advanced - users can use this flag to bypass these if necessary. - -- `--token` - - By default, `kubeadm init` automatically generates the token used to initialise - each new node. If you would like to manually specify this token, you can use the - `--token` flag. The token must be of the format `[a-z0-9]{6}\.[a-z0-9]{16}`. A - compatible random token can be generated `kubeadm token generate`. Tokens can - be managed through the API after the cluster is created. See the [section on - managing tokens](#manage-tokens) below. - -- `--token-ttl` - - This sets an expiration time for the token. This is specified as a duration - from the current time. After this time the token will no longer be valid and - will be removed. A value of 0 specifies that the token never expires. The - default is 24 hours. See the [section on managing tokens](#manage-tokens) below. - -### `kubeadm join` - -When joining a kubeadm initialized cluster, we need to establish bidirectional -trust. This is split into discovery (having the Node trust the Kubernetes -master) and TLS bootstrap (having the Kubernetes master trust the Node). - -There are two main schemes for discovery: - - - **Using a shared token** along with the IP address of the API server and a - hash of the root CA key: - - `kubeadm join --discovery-token abcdef.1234567890abcdef --discovery-token-ca-cert-hash sha256:1234..cdef 1.2.3.4:6443` - - - **Using a file** (a subset of the standard kubeconfig file). This file can - be a local file or downloaded via an HTTPS URL: - - `kubeadm join --discovery-file path/to/file.conf` - - `kubeadm join --discovery-file https://url/file.conf` - -Only one form can be used. If the discovery information is loaded from a URL, -HTTPS must be used and the host installed CA bundle is used to verify the -connection. For details on the security tradeoffs of these mechanisms, see the -[security model](#security-model) section below. - -The TLS bootstrap mechanism is also driven via a shared token. This is used to -temporarily authenticate with the Kubernetes master to submit a certificate -signing request (CSR) for a locally created key pair. By default kubeadm will -set up the Kubernetes master to automatically approve these signing requests. -This token is passed in with the `--tls-bootstrap-token abcdef.1234567890abcdef` -flag. - -Often times the same token is used for both parts. In this case, the `--token` flag -can be used instead of specifying the each token individually. - -Here's an example on how to use it: - -`kubeadm join --token=abcdef.1234567890abcdef --discovery-token-ca-cert-hash sha256:1234..cdef 192.168.1.1:6443` - -**Options for `kubeadm join`:** - -- `--config` - - Extended options are specified in the [kubeadm specific config file](#config-file). - -- `--discovery-file` - - A local file path or HTTPS URL. The file specified must be a kubeconfig file - with nothing but an unnamed cluster entry. This is used to find both the - location of the API server to join along with a root CA bundle to use when - talking to that server. - - This might look something like this: - - ``` yaml - apiVersion: v1 - clusters: - - cluster: - certificate-authority-data: - server: https://10.138.0.2:6443 - name: "" - contexts: [] - current-context: "" - kind: Config - preferences: {} - users: [] - ``` - -- `--discovery-token` - - The discovery token is used along with the address of the API server (as an - unnamed argument) to download and verify information about the cluster. The - most critical part of the cluster information is the root CA bundle used to - verify the identity of the server during subsequent TLS connections. - -- `--discovery-token-ca-cert-hash` - - The CA key hash is used to verify the full root CA certificate discovered during - token-based bootstrapping. It has the format `sha256:`. By - default, the hash value is returned in the `kubeadm join` command printed at the - end of `kubeadm init` or in the output of `kubeadm token create --print-join-command`. - It is in a standard format (see [RFC7469](https://tools.ietf.org/html/rfc7469#section-2.4)) - and can also be calculated by 3rd party tools or provisioning systems. For - example, using the OpenSSL CLI: - `openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'` - - _Skipping this flag is allowed in Kubernetes 1.8, but makes certain spoofing - attacks possible._ See the [security model](#security-model) for details. - Pass `--discovery-token-unsafe-skip-ca-verification` to silence warnings (which - will become errors in Kubernetes 1.9). - -- `--discovery-token-unsafe-skip-ca-verification` - - Disable the warning/error that occurs when `--discovery-token-ca-cert-hash` is - not provided. Passing this flag is an acknowledgement of the - [security tradeoffs](#security-model) involved in skipping this verification - (which may or may not be appropriate in your environment). - -- `--node-name` - - Specify the Node name. The default is to use the OS hostname. This is useful - on some cloud providers such as AWS. This name is also added to the node's - TLS certificate. - -- `--tls-bootstrap-token` - - The token used to authenticate to the API server for the purposes of TLS - bootstrapping. - -- `--token=` - - Often times the same token is used for both `--discovery-token` and - `--tls-bootstrap-token`. This option specifies the same token for both. Other - flags override this flag if present. - -- `--skip-preflight-checks` - - By default, kubeadm runs a series of preflight checks to validate the system - before making any changes. Advanced users can use this flag to bypass these if - necessary. - -### `kubeadm completion` - -Output shell completion code for the specified shell (bash or zsh). - -### `kubeadm config` - -Kubeadm v1.8.0+ automatically creates a ConfigMap with all the parameters -used during `kubeadm init`. - -If you initialized your cluster using kubeadm v1.7.x or lower, you must use -the `kubeadm config upload` command to create this ConfigMap in order -for `kubeadm upgrade` to be able to configure your upgraded cluster correctly. - -### `kubeadm reset` - -Reverts any changes made to this host by `kubeadm init` or `kubeadm join`. - -### `kubeadm token` - -Manage tokens on a running cluster. See [managing tokens](#manage-tokens) below -for further details. - -### `kubeadm alpha phases` - -**WARNING:** While kubeadm command line interface is in beta, commands under -this entry is still considered alpha and may change in future versions. - -`kubeadm phase` introduces a set of kubeadm CLI commands allowing to invoke -individually each phase of the kubeadm init sequence; phases provide a reusable -and composable API/toolbox for building your own automated cluster installer. - -**Options for `kubeadm phases`:** - -Each kubeadm phase exposes a subset of relevant options from `kubeadm init`. - -## Using kubeadm with a configuration file {#config-file} - -**WARNING:** While kubeadm command line interface is in beta, the config file is -still considered alpha and may change in future versions. - -It's possible to configure kubeadm with a configuration file instead of command -line flags, and some more advanced features may only be available as -configuration file options. This file is passed in to the `--config` option on -both `kubeadm init` and `kubeadm join`. - -### Sample Master Configuration - -```yaml -apiVersion: kubeadm.k8s.io/v1alpha1 -kind: MasterConfiguration -api: - advertiseAddress: - bindPort: -etcd: - endpoints: - - - - - caFile: - certFile: - keyFile: - dataDir: - extraArgs: - : - : - image: -networking: - dnsDomain: - serviceSubnet: - podSubnet: -kubernetesVersion: -cloudProvider: -nodeName: -authorizationModes: -- -- -token: -tokenTTL: