Merge branch 'master' into dns-troubleshooting
This commit is contained in:
Jared
@@ -7,16 +7,20 @@ Add-ons extend the functionality of Kubernetes.
|
||||
|
||||
This page lists some of the available add-ons and links to their respective installation instructions.
|
||||
|
||||
Add-ons in each section are sorted alphabetically - the ordering does not imply any preferential status.
|
||||
|
||||
## Networking and Network Policy
|
||||
|
||||
* [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
|
||||
* [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider.
|
||||
* [Calico](http://docs.projectcalico.org/v1.6/getting-started/kubernetes/installation/hosted/) is a secure L3 networking and network policy provider.
|
||||
* [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy.
|
||||
* [Flannel](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml) is a overlay network provider that can be used with Kubernetes.
|
||||
* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize).
|
||||
* [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
|
||||
|
||||
## Visualization & Control
|
||||
|
||||
* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.
|
||||
* [Dashboard](https://github.com/kubernetes/dashboard#kubernetes-dashboard) is a dashboard web interface for Kubernetes.
|
||||
* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.
|
||||
|
||||
## Legacy Add-ons
|
||||
|
||||
|
||||
@@ -101,7 +101,7 @@ quoting facilities of HTTP. For example: if the bearer token is
|
||||
header as shown below.
|
||||
|
||||
```http
|
||||
Authentication: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
|
||||
Authorization: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
|
||||
```
|
||||
|
||||
### Static Password File
|
||||
|
||||
@@ -61,17 +61,17 @@ itself. To attempt an eviction (perhaps more REST-precisely, to attempt to
|
||||
{
|
||||
"apiVersion": "policy/v1alpha1",
|
||||
"kind": "Eviction",
|
||||
"name": "quux",
|
||||
"namespace": "default"
|
||||
"metadata": {
|
||||
"name": "quux",
|
||||
"namespace": "default"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
and here is how you would attempt this with `curl`
|
||||
You can attempt an eviction using `curl`:
|
||||
|
||||
```bash
|
||||
curl -v -X POST -H 'Content-type: application/json'
|
||||
http://127.0.0.1:8080/api/v1/namespaces/default/pods/quux/eviction -d
|
||||
eviction.json
|
||||
$ curl -v -H 'Content-type: application/json' http://127.0.0.1:8080/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json
|
||||
```
|
||||
|
||||
The API can respond in one of three ways.
|
||||
|
||||
@@ -42,7 +42,7 @@ federation-apiserver
|
||||
--cloud-provider string The provider for cloud services. Empty string for no provider.
|
||||
--cors-allowed-origins value List of allowed origins for CORS, comma separated. An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. (default [])
|
||||
--delete-collection-workers int Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
|
||||
--deserialization-cache-size int Number of deserialized json objects to cache in memory. (default 50000)
|
||||
--deserialization-cache-size int Number of deserialized json objects to cache in memory.
|
||||
--enable-swagger-ui Enables swagger ui on the apiserver at /swagger-ui
|
||||
--etcd-cafile string SSL Certificate Authority file used to secure etcd communication.
|
||||
--etcd-certfile string SSL certification file used to secure etcd communication.
|
||||
@@ -79,7 +79,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--service-node-port-range value A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
|
||||
--storage-backend string The storage backend for persistence. Options: 'etcd2' (default), 'etcd3'.
|
||||
--storage-media-type string The media type to use to store objects in storage. Defaults to application/json. Some resources may only support a specific media type and will ignore this setting. (default "application/json")
|
||||
--storage-versions string The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,federation/v1beta1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,v1")
|
||||
--storage-versions string The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates.k8s.io/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,federation/v1beta1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,v1")
|
||||
--target-ram-mb int Memory limit for apiserver in MB (used to configure sizes of caches, etc.)
|
||||
--tls-cert-file string File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
|
||||
--tls-private-key-file string File containing x509 private key matching --tls-cert-file.
|
||||
@@ -88,7 +88,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--watch-cache-sizes value List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled. (default [])
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -44,7 +44,7 @@ federation-controller-manager
|
||||
--zone-name string Zone name, like example.com.
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -45,7 +45,7 @@ kube-apiserver
|
||||
--cloud-provider string The provider for cloud services. Empty string for no provider.
|
||||
--cors-allowed-origins value List of allowed origins for CORS, comma separated. An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. (default [])
|
||||
--delete-collection-workers int Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
|
||||
--deserialization-cache-size int Number of deserialized json objects to cache in memory. (default 50000)
|
||||
--deserialization-cache-size int Number of deserialized json objects to cache in memory.
|
||||
--enable-garbage-collector Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager. (default true)
|
||||
--enable-swagger-ui Enables swagger ui on the apiserver at /swagger-ui
|
||||
--etcd-cafile string SSL Certificate Authority file used to secure etcd communication.
|
||||
@@ -95,7 +95,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--ssh-user string If non-empty, use secure SSH proxy to the nodes, using this user name
|
||||
--storage-backend string The storage backend for persistence. Options: 'etcd2' (default), 'etcd3'.
|
||||
--storage-media-type string The media type to use to store objects in storage. Defaults to application/json. Some resources may only support a specific media type and will ignore this setting. (default "application/json")
|
||||
--storage-versions string The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,v1")
|
||||
--storage-versions string The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates.k8s.io/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,v1")
|
||||
--target-ram-mb int Memory limit for apiserver in MB (used to configure sizes of caches, etc.)
|
||||
--tls-cert-file string File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
|
||||
--tls-private-key-file string File containing x509 private key matching --tls-cert-file.
|
||||
@@ -104,7 +104,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--watch-cache-sizes value List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled. (default [])
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -42,7 +42,7 @@ kube-controller-manager
|
||||
--concurrent-serviceaccount-token-syncs value The number of service account token objects that are allowed to sync concurrently. Larger number = more responsive token generation, but more CPU (and network) load (default 5)
|
||||
--concurrent_rc_syncs value The number of replication controllers that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
|
||||
--configure-cloud-routes Should CIDRs allocated by allocate-node-cidrs be configured on the cloud provider. (default true)
|
||||
--controller-start-interval duration Interval between starting controller managers.
|
||||
--controller-start-interval duration Interval between starting controller managers. (default 0s)
|
||||
--daemonset-lookup-cache-size value The the size of lookup cache for daemonsets. Larger number = more responsive daemonsets, but more MEM load. (default 1024)
|
||||
--deployment-controller-sync-period duration Period for syncing the deployments. (default 30s)
|
||||
--enable-dynamic-provisioning Enable dynamic provisioning for environments that support it. (default true)
|
||||
@@ -98,7 +98,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--unhealthy-zone-threshold value Fraction of Nodes in a zone which needs to be not Ready (minimum 3) for zone to be treated as unhealthy. (default 0.55)
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -27,8 +27,8 @@ kube-proxy
|
||||
--cleanup-iptables If true cleanup iptables rules and exit.
|
||||
--cluster-cidr string The CIDR range of pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.
|
||||
--config-sync-period duration How often configuration from the apiserver is refreshed. Must be greater than 0. (default 15m0s)
|
||||
--conntrack-max value Maximum number of NAT connections to track (0 to leave as-is).
|
||||
--conntrack-max-per-core value Maximum number of NAT connections to track per CPU core (0 to leave as-is). This is only considered if conntrack-max is 0. (default 32768)
|
||||
--conntrack-max-per-core value Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min). (default 32768)
|
||||
--conntrack-min value Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is). (default 131072)
|
||||
--conntrack-tcp-timeout-established duration Idle timeout for established TCP connections (0 to leave as-is) (default 24h0m0s)
|
||||
--feature-gates value A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
|
||||
AllAlpha=true|false (ALPHA - default=false)
|
||||
@@ -54,7 +54,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--udp-timeout duration How long an idle UDP connection will be kept open (e.g. '250ms', '2s'). Must be greater than 0. Only applicable for proxy-mode=userspace (default 250ms)
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -27,11 +27,11 @@ kube-scheduler
|
||||
--algorithm-provider string The scheduling algorithm provider to use, one of: DefaultProvider | ClusterAutoscalerProvider (default "DefaultProvider")
|
||||
--failure-domains string Indicate the "all topologies" set for an empty topologyKey when it's used for PreferredDuringScheduling pod anti-affinity. (default "kubernetes.io/hostname,failure-domain.beta.kubernetes.io/zone,failure-domain.beta.kubernetes.io/region")
|
||||
--feature-gates value A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
|
||||
DynamicKubeletConfig=true|false (ALPHA - default=false)
|
||||
DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
AllAlpha=true|false (ALPHA - default=false)
|
||||
AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
|
||||
AppArmor=true|false (BETA - default=true)
|
||||
DynamicKubeletConfig=true|false (ALPHA - default=false)
|
||||
DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--google-json-key string The Google Cloud Platform Service Account JSON Key to use for authentication.
|
||||
--hard-pod-affinity-symmetric-weight int RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. --hard-pod-affinity-symmetric-weight represents the weight of implicit PreferredDuringScheduling affinity rule. (default 1)
|
||||
--kube-api-burst value Burst to use while talking with kubernetes apiserver (default 100)
|
||||
@@ -49,7 +49,7 @@ AppArmor=true|false (BETA - default=true)
|
||||
--scheduler-name string Name of the scheduler, used to select which pods will be processed by this scheduler, based on pod's annotation with key 'scheduler.alpha.kubernetes.io/name' (default "default-scheduler")
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
+110
-25
@@ -3,32 +3,50 @@ assignees:
|
||||
- mikedanese
|
||||
- luxas
|
||||
- errordeveloper
|
||||
- jbeda
|
||||
|
||||
---
|
||||
|
||||
|
||||
This document provides information on how to use kubeadm's advanced options.
|
||||
|
||||
Running kubeadm init bootstraps a Kubernetes cluster. This consists of the
|
||||
Running `kubeadm init` bootstraps a Kubernetes cluster. This consists of the
|
||||
following steps:
|
||||
|
||||
1. kubeadm generates a token that additional nodes can use to register themselves
|
||||
with the master in future.
|
||||
1. kubeadm runs a series of pre-flight checks to validate the system state
|
||||
before making changes. Some checks only trigger warnings, others are
|
||||
considered errors and will exit kubeadm until the problem is corrected or
|
||||
the user specifies `--skip-preflight-checks`.
|
||||
|
||||
1. kubeadm generates a token that additional nodes can use to register
|
||||
themselves with the master in future. Optionally, the user can provide a token.
|
||||
|
||||
1. kubeadm generates a self-signed CA using openssl to provision identities
|
||||
for each node in the cluster, and for the API server to secure communication
|
||||
with clients.
|
||||
|
||||
1. Outputting a kubeconfig file for the kubelet to use to connect to the API server,
|
||||
as well as an additional kubeconfig file for administration.
|
||||
1. Outputting a kubeconfig file for the kubelet to use to connect to the API
|
||||
server, as well as an additional kubeconfig file for administration.
|
||||
|
||||
1. kubeadm generates Kubernetes resource manifests for the API server, controller manager
|
||||
and scheduler, and placing them in `/etc/kubernetes/manifests`. The kubelet watches
|
||||
this directory for static resources to create on startup. These are the core
|
||||
components of Kubernetes, and once they are up and running we can use `kubectl`
|
||||
to set up/manage any additional components.
|
||||
1. kubeadm generates Kubernetes resource manifests for the API server,
|
||||
controller manager and scheduler, and placing them in
|
||||
`/etc/kubernetes/manifests`. The kubelet watches this directory for static
|
||||
resources to create on startup. These are the core components of Kubernetes, and
|
||||
once they are up and running we can use `kubectl` to set up/manage any
|
||||
additional components.
|
||||
|
||||
1. kubeadm installs any add-on components, such as DNS or discovery, via the API server.
|
||||
1. kubeadm installs any add-on components, such as DNS or discovery, via the API
|
||||
server.
|
||||
|
||||
Running `kubeadm join` on each node in the cluster consists of the following steps:
|
||||
|
||||
1. Use the token to talk to the API server and securely get the root CA
|
||||
certificate.
|
||||
|
||||
1. Creates a local key pair. Prepares a certificate signing request (CSR) and
|
||||
sends that off to the API server for signing.
|
||||
|
||||
1. Configures the local kubelet to connect to the API server
|
||||
|
||||
## Usage
|
||||
|
||||
@@ -87,17 +105,16 @@ and `--external-etcd-keyfile` flags.
|
||||
|
||||
- `--pod-network-cidr`
|
||||
|
||||
By default, `kubeadm init` does not set node CIDR's for pods and allows you to
|
||||
bring your own networking configuration through a CNI compatible network
|
||||
controller addon such as [Weave Net](https://github.com/weaveworks/weave-kube),
|
||||
[Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm)
|
||||
or [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm).
|
||||
If you are using a compatible cloud provider or flannel, you can specify a
|
||||
subnet to use for each pod on the cluster with the `--pod-network-cidr` flag.
|
||||
This should be a minimum of a /16 so that kubeadm is able to assign /24 subnets
|
||||
to each node in the cluster.
|
||||
For certain networking solutions the Kubernetes master can also play a role in
|
||||
allocating network ranges (CIDRs) to each node. This includes many cloud providers
|
||||
and flannel. You can specify a subnet range that will be broken down and handed out
|
||||
to each node with the `--pod-network-cidr` flag. This should be a minimum of a /16 so
|
||||
controller-manager is able to assign /24 subnets to each node in the cluster.
|
||||
If you are using flannel with [this manifest](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml)
|
||||
you should use `--pod-network-cidr=10.244.0.0/16`. Most CNI based networking solutions
|
||||
do not require this flag.
|
||||
|
||||
- `--service-cidr` (default '10.12.0.0/12')
|
||||
- `--service-cidr` (default '10.96.0.0/12')
|
||||
|
||||
You can use the `--service-cidr` flag to override the subnet Kubernetes uses to
|
||||
assign pods IP addresses. If you do, you will also need to update the
|
||||
@@ -112,13 +129,19 @@ to change the DNS name suffix. Again, you will need to update the
|
||||
`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file accordingly else DNS will
|
||||
not function correctly.
|
||||
|
||||
- `--skip-preflight-checks`
|
||||
|
||||
By default, `kubeadm` runs a series of preflight checks to validate the system
|
||||
before making any changes. Advanced users can use this flag to bypass these if
|
||||
necessary.
|
||||
|
||||
- `--token`
|
||||
|
||||
By default, `kubeadm init` automatically generates the token used to initialise
|
||||
each new node. If you would like to manually specify this token, you can use the
|
||||
`--token` flag. The token must be of the format '<6 character string>.<16 character string>'.
|
||||
`--token` flag. The token must be of the format `<6 character string>.<16 character string>`.
|
||||
|
||||
- `--use-kubernetes-version` (default 'v1.4.1') the kubernetes version to initialise
|
||||
- `--use-kubernetes-version` (default 'v1.4.4') the kubernetes version to initialise
|
||||
|
||||
`kubeadm` was originally built for Kubernetes version **v1.4.0**, older versions are not
|
||||
supported. With this flag you can try any future version, e.g. **v1.5.0-beta.1**
|
||||
@@ -127,18 +150,80 @@ for a full list of available versions).
|
||||
|
||||
### `kubeadm join`
|
||||
|
||||
`kubeadm join` has one mandatory flag, the token used to secure cluster bootstrap,
|
||||
and one mandatory argument, the master IP address.
|
||||
When you use kubeadm join, you must supply the token used to secure cluster
|
||||
boostrap as a mandatory flag, and the master IP address as a mandatory argument.
|
||||
|
||||
Here's an example on how to use it:
|
||||
|
||||
`kubeadm join --token=the_secret_token 192.168.1.1`
|
||||
|
||||
- `--skip-preflight-checks`
|
||||
|
||||
By default, `kubeadm` runs a series of preflight checks to validate the system
|
||||
before making any changes. Advanced users can use this flag to bypass these if
|
||||
necessary.
|
||||
|
||||
- `--token=<token>`
|
||||
|
||||
By default, when `kubeadm init` runs, a token is generated and revealed in the output.
|
||||
That's the token you should use here.
|
||||
|
||||
## Automating kubeadm
|
||||
|
||||
Rather than copying the token you obtained from `kubeadm init` to each node, as
|
||||
in the basic `kubeadm` tutorials, you can parallelize the token distribution for
|
||||
easier automation. To implement this automation, you must know the IP address
|
||||
that the master will have after it is started.
|
||||
|
||||
1. Generate a token. This token must have the form `<6 character string>.<16
|
||||
character string>`
|
||||
|
||||
Here is a simple python one-liner for this:
|
||||
|
||||
```
|
||||
python -c 'import random; print "%0x.%0x" % (random.SystemRandom().getrandbits(3*8), random.SystemRandom().getrandbits(8*8))'
|
||||
```
|
||||
|
||||
1. Start both the master node and the worker nodes concurrently with this token. As they come up they should find each other and form the cluster.
|
||||
|
||||
Once the cluster is up, you can grab the admin credentials from the master node at `/etc/kubernetes/admin.conf` and use that to talk to the cluster.
|
||||
|
||||
## Environment variables
|
||||
|
||||
There are some environment variables that modify the way that `kubeadm` works. Most users will have no need to set these.
|
||||
|
||||
| Variable | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `KUBE_KUBERNETES_DIR` | `/etc/kubernetes` | Where most configuration files are written to and read from |
|
||||
| `KUBE_HOST_PKI_PATH` | `/etc/kubernetes/pki` | Directory for master PKI assets |
|
||||
| `KUBE_HOST_ETCD_PATH` | `/var/lib/etcd` | Local etcd state for Kubernetes cluster |
|
||||
| `KUBE_HYPERKUBE_IMAGE` | `` | If set, use a single hyperkube image with this name. If not set, individual images per server component will be used. |
|
||||
| `KUBE_DISCOVERY_IMAGE` | `gcr.io/google_containers/kube-discovery-<arch>:1.0` | The bootstrap discovery helper image to use. |
|
||||
| `KUBE_ETCD_IMAGE` | `gcr.io/google_containers/etcd-<arch>:2.2.5` | The etcd container image to use. |
|
||||
| `KUBE_COMPONENT_LOGLEVEL` | `--v=4` | Logging configuration for all Kubernetes components |
|
||||
|
||||
|
||||
## Releases and release notes
|
||||
|
||||
If you already have kubeadm installed and want to upgrade, run `apt-get update && apt-get upgrade` or `yum update` to get the latest version of kubeadm.
|
||||
|
||||
- Second release between v1.4 and v1.5: `v1.5.0-alpha.2.421+a6bea3d79b8bba`
|
||||
- Switch to the 10.96.0.0/12 subnet: [#35290](https://github.com/kubernetes/kubernetes/pull/35290)
|
||||
- Fix kubeadm on AWS by including /etc/ssl/certs in the controller-manager [#33681](https://github.com/kubernetes/kubernetes/pull/33681)
|
||||
- The API was refactored and is now componentconfig: [#33728](https://github.com/kubernetes/kubernetes/pull/33728), [#34147](https://github.com/kubernetes/kubernetes/pull/34147) and [#34555](https://github.com/kubernetes/kubernetes/pull/34555)
|
||||
- Allow kubeadm to get config options from a file: [#34501](https://github.com/kubernetes/kubernetes/pull/34501), [#34885](https://github.com/kubernetes/kubernetes/pull/34885) and [#34891](https://github.com/kubernetes/kubernetes/pull/34891)
|
||||
- Implement preflight checks: [#34341](https://github.com/kubernetes/kubernetes/pull/34341) and [#35843](https://github.com/kubernetes/kubernetes/pull/35843)
|
||||
- Using kubernetes v1.4.4 by default: [#34419](https://github.com/kubernetes/kubernetes/pull/34419) and [#35270](https://github.com/kubernetes/kubernetes/pull/35270)
|
||||
- Make api and discovery ports configurable and default to 6443: [#34719](https://github.com/kubernetes/kubernetes/pull/34719)
|
||||
- Implement kubeadm reset: [#34807](https://github.com/kubernetes/kubernetes/pull/34807)
|
||||
- Make kubeadm poll/wait for endpoints instead of directly fail when the master isn't available [#34703](https://github.com/kubernetes/kubernetes/pull/34703) and [#34718](https://github.com/kubernetes/kubernetes/pull/34718)
|
||||
- Allow empty directories in the directory preflight check: [#35632](https://github.com/kubernetes/kubernetes/pull/35632)
|
||||
- Started adding unit tests: [#35231](https://github.com/kubernetes/kubernetes/pull/35231), [#35326](https://github.com/kubernetes/kubernetes/pull/35326) and [#35332](https://github.com/kubernetes/kubernetes/pull/35332)
|
||||
- Various enhancements: [#35075](https://github.com/kubernetes/kubernetes/pull/35075), [#35111](https://github.com/kubernetes/kubernetes/pull/35111), [#35119](https://github.com/kubernetes/kubernetes/pull/35119), [#35124](https://github.com/kubernetes/kubernetes/pull/35124), [#35265](https://github.com/kubernetes/kubernetes/pull/35265) and [#35777](https://github.com/kubernetes/kubernetes/pull/35777)
|
||||
- Bug fixes: [#34352](https://github.com/kubernetes/kubernetes/pull/34352), [#34558](https://github.com/kubernetes/kubernetes/pull/34558), [#34573](https://github.com/kubernetes/kubernetes/pull/34573), [#34834](https://github.com/kubernetes/kubernetes/pull/34834), [#34607](https://github.com/kubernetes/kubernetes/pull/34607), [#34907](https://github.com/kubernetes/kubernetes/pull/34907) and [#35796](https://github.com/kubernetes/kubernetes/pull/35796)
|
||||
- Initial v1.4 release: `v1.5.0-alpha.0.1534+cf7301f16c0363`
|
||||
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
* Some users on RHEL/CentOS 7 have reported issues with traffic being routed incorrectly due to iptables being bypassed. You should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your sysctl config, eg.
|
||||
|
||||
@@ -44,7 +44,8 @@ kubelet
|
||||
--cloud-provider string The provider for cloud services. By default, kubelet will attempt to auto-detect the cloud provider. Specify empty string for running with no cloud provider. [default=auto-detect] (default "auto-detect")
|
||||
--cluster-dns string IP address for a cluster DNS server. This value is used for containers' DNS server in case of Pods with "dnsPolicy=ClusterFirst"
|
||||
--cluster-domain string Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains
|
||||
--configure-cbr0 If true, kubelet will configure cbr0 based on Node.Spec.PodCIDR.
|
||||
--cni-bin-dir string <Warning: Alpha feature> The full path of the directory in which to search for CNI plugin binaries. Default: /opt/cni/bin
|
||||
--cni-conf-dir string <Warning: Alpha feature> The full path of the directory in which to search for CNI config files. Default: /etc/cni/net.d
|
||||
--container-runtime string The container runtime to use. Possible values: 'docker', 'rkt'. Default: 'docker'. (default "docker")
|
||||
--container-runtime-endpoint string The unix socket endpoint of remote runtime service. If not empty, this option will override --container-runtime. This is an experimental feature. Intended for testing only.
|
||||
--containerized Experimental support for running kubelet in a container. Intended for testing. [default=false]
|
||||
@@ -66,7 +67,6 @@ kubelet
|
||||
--exit-on-lock-contention Whether kubelet should exit upon lock-file contention.
|
||||
--experimental-allowed-unsafe-sysctls value Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk. (default [])
|
||||
--experimental-bootstrap-kubeconfig string <Warning: Experimental feature> Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by --kubeconfig does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate is written to the path specified by --kubeconfig. The certificate and key file will be stored in the directory pointed by --cert-dir.
|
||||
--experimental-flannel-overlay Experimental support for starting the kubelet with the default overlay network (flannel). Assumes flanneld is already running in client mode. [default=false]
|
||||
--experimental-nvidia-gpus value Number of NVIDIA GPU devices on this node. Only 0 (default) and 1 are currently supported.
|
||||
--feature-gates value A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
|
||||
AllAlpha=true|false (ALPHA - default=false)
|
||||
@@ -105,7 +105,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--max-pods value Number of Pods that can run on this Kubelet. (default 110)
|
||||
--minimum-image-ttl-duration duration Minimum age for an unused image before it is garbage collected. Examples: '300ms', '10s' or '2h45m'. Default: '2m' (default 2m0s)
|
||||
--network-plugin string <Warning: Alpha feature> The name of the network plugin to be invoked for various events in kubelet/pod lifecycle
|
||||
--network-plugin-dir string <Warning: Alpha feature> The full path of the directory in which to search for network plugins (default "/usr/libexec/kubernetes/kubelet-plugins/net/exec/")
|
||||
--network-plugin-dir string <Warning: Alpha feature> The full path of the directory in which to search for network plugins or CNI config
|
||||
--network-plugin-mtu value <Warning: Alpha feature> The MTU to be passed to the network plugin, to override the default. Set to 0 to use the default 1460 MTU.
|
||||
--node-ip string IP address of the node. If set, kubelet will use this IP address for the node
|
||||
--node-labels value <Warning: Alpha feature> Labels to add when registering the node in the cluster. Labels must be key=value pairs separated by ','.
|
||||
@@ -146,7 +146,7 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
|
||||
--volume-stats-agg-period duration Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes. To disable volume calculations, set to 0. Default: '1m' (default 1m0s)
|
||||
```
|
||||
|
||||
###### Auto generated by spf13/cobra on 2-Sep-2016
|
||||
###### Auto generated by spf13/cobra on 24-Oct-2016
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -36,7 +36,11 @@ Place plugins in `network-plugin-dir/plugin-name/plugin-name`, i.e if you have a
|
||||
|
||||
### CNI
|
||||
|
||||
The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option. Kubelet reads the first CNI configuration file from `--network-plugin-dir` and uses the CNI configuration from that file to set up each pod's network. The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md), and any required CNI plugins referenced by the configuration must be present in `/opt/cni/bin`.
|
||||
The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option. Kubelet reads a file from `--cni-conf-dir` (default `/etc/cni/net.d`) and uses the CNI configuration from that file to set up each pod's network. The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md), and any required CNI plugins referenced by the configuration must be present in `--cni-bin-dir` (default `/opt/cni/bin`).
|
||||
|
||||
If there are multiple CNI configuration files in the directory, the first one in lexicographic order of file name is used.
|
||||
|
||||
In addition to the CNI plugin specified by the configuration file, Kubernetes requires the standard CNI `lo` plugin, at minimum version 0.2.0
|
||||
|
||||
### kubenet
|
||||
|
||||
@@ -44,7 +48,7 @@ The Linux-only kubenet plugin provides functionality similar to the `--configure
|
||||
|
||||
The plugin requires a few things:
|
||||
|
||||
* The standard CNI `bridge` and `host-local` plugins are required. Kubenet will first search for them in `/opt/cni/bin`. Specify `network-plugin-dir` to supply additional search path. The first found match will take effect.
|
||||
* The standard CNI `bridge`, `lo` and `host-local` plugins are required, at minimum version 0.2.0. Kubenet will first search for them in `/opt/cni/bin`. Specify `network-plugin-dir` to supply additional search path. The first found match will take effect.
|
||||
* Kubelet must be run with the `--network-plugin=kubenet` argument to enable the plugin
|
||||
* Kubelet must also be run with the `--reconcile-cidr` argument to ensure the IP subnet assigned to the node by configuration or the controller-manager is propagated to the plugin
|
||||
* The node must be assigned an IP subnet through either the `--pod-cidr` kubelet command-line option or the `--allocate-node-cidrs=true --cluster-cidr=<cidr>` controller-manager command-line options.
|
||||
@@ -66,6 +70,6 @@ This option is provided to the network-plugin; currently **only kubenet supports
|
||||
## Usage Summary
|
||||
|
||||
* `--network-plugin=exec` specifies that we use the `exec` plugin, with executables located in `--network-plugin-dir`.
|
||||
* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `/opt/cni/bin` and CNI plugin configuration located in `network-plugin-dir`, config location defaults to `/etc/cni/net.d`.
|
||||
* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `--cni-bin-dir` (default `/opt/cni/bin`) and CNI plugin configuration located in `--cni-conf-dir` (default `/etc/cni/net.d`).
|
||||
* `--network-plugin=kubenet` specifies that we use the `kubenet` network plugin with CNI `bridge` and `host-local` plugins placed in `/opt/cni/bin` or `network-plugin-dir`.
|
||||
* `--network-plugin-mtu=9001` specifies the MTU to use, currently only used by the `kubenet` network plugin.
|
||||
+22
-24
@@ -1,4 +1,4 @@
|
||||
---
|
||||
---
|
||||
assignees:
|
||||
- lavalamp
|
||||
- thockin
|
||||
@@ -83,7 +83,7 @@ talk to other VMs in your project. This is the same basic model.
|
||||
Until now this document has talked about containers. In reality, Kubernetes
|
||||
applies IP addresses at the `Pod` scope - containers within a `Pod` share their
|
||||
network namespaces - including their IP address. This means that containers
|
||||
within a `Pod` can all reach each other’s ports on `localhost`. This does imply
|
||||
within a `Pod` can all reach each other's ports on `localhost`. This does imply
|
||||
that containers within a `Pod` must coordinate port usage, but this is no
|
||||
different than processes in a VM. We call this the "IP-per-pod" model. This
|
||||
is implemented in Docker as a "pod container" which holds the network namespace
|
||||
@@ -100,8 +100,19 @@ existence or non-existence of host ports.
|
||||
There are a number of ways that this network model can be implemented. This
|
||||
document is not an exhaustive study of the various methods, but hopefully serves
|
||||
as an introduction to various technologies and serves as a jumping-off point.
|
||||
If some techniques become vastly preferable to others, we might detail them more
|
||||
here.
|
||||
|
||||
The following networking options are sorted alphabetically - the order does not
|
||||
imply any preferential status.
|
||||
|
||||
### Contiv
|
||||
|
||||
[Contiv](https://github.com/contiv/netplugin) provides configurable networking (native l3 using BGP, overlay using vxlan, classic l2, or Cisco-SDN/ACI) for various use cases. [Contiv](http://contiv.io) is all open sourced.
|
||||
|
||||
### Flannel
|
||||
|
||||
[Flannel](https://github.com/coreos/flannel#flannel) is a very simple overlay
|
||||
network that satisfies the Kubernetes requirements. Many
|
||||
people have reported success with Flannel and Kubernetes.
|
||||
|
||||
### Google Compute Engine (GCE)
|
||||
|
||||
@@ -158,29 +169,12 @@ Follow the "With Linux Bridge devices" section of [this very nice
|
||||
tutorial](http://blog.oddbit.com/2014/08/11/four-ways-to-connect-a-docker/) from
|
||||
Lars Kellogg-Stedman.
|
||||
|
||||
### Weave Net from Weaveworks
|
||||
|
||||
[Weave Net](https://www.weave.works/products/weave-net/) is a
|
||||
resilient and simple to use network for Kubernetes and its hosted applications.
|
||||
Weave Net runs as a [CNI plug-in](https://www.weave.works/docs/net/latest/cni-plugin/)
|
||||
or stand-alone. In either version, it doesn’t require any configuration or extra code
|
||||
to run, and in both cases, the network provides one IP address per pod - as is standard for Kubernetes.
|
||||
|
||||
|
||||
### Flannel
|
||||
|
||||
[Flannel](https://github.com/coreos/flannel#flannel) is a very simple overlay
|
||||
network that satisfies the Kubernetes requirements. It installs in minutes and
|
||||
should get you up and running if the above techniques are not working. Many
|
||||
people have reported success with Flannel and Kubernetes.
|
||||
|
||||
### OpenVSwitch
|
||||
|
||||
[OpenVSwitch](/docs/admin/ovs-networking) is a somewhat more mature but also
|
||||
complicated way to build an overlay network. This is endorsed by several of the
|
||||
"Big Shops" for networking.
|
||||
|
||||
|
||||
### Project Calico
|
||||
|
||||
[Project Calico](https://github.com/projectcalico/calico-containers/blob/master/docs/cni/kubernetes/README.md) is an open source container networking provider and network policy engine.
|
||||
@@ -191,11 +185,15 @@ Calico can also be run in policy enforcement mode in conjunction with other netw
|
||||
|
||||
### Romana
|
||||
|
||||
[Romana](http://romana.io) is an open source software defined networking (SDN) solution that lets you deploy Kubernetes without an overlay network.
|
||||
[Romana](http://romana.io) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/user-guide/networkpolicies/) to provide isolation across network namespaces.
|
||||
|
||||
### Contiv
|
||||
### Weave Net from Weaveworks
|
||||
|
||||
[Contiv](https://github.com/contiv/netplugin) provides configurable networking (native l3 using BGP, overlay using vxlan, classic l2, or Cisco-SDN/ACI) for various use cases. [Contiv](http://contiv.io) is all open sourced.
|
||||
[Weave Net](https://www.weave.works/products/weave-net/) is a
|
||||
resilient and simple to use network for Kubernetes and its hosted applications.
|
||||
Weave Net runs as a [CNI plug-in](https://www.weave.works/docs/net/latest/cni-plugin/)
|
||||
or stand-alone. In either version, it doesn't require any configuration or extra code
|
||||
to run, and in both cases, the network provides one IP address per pod - as is standard for Kubernetes.
|
||||
|
||||
## Other reading
|
||||
|
||||
|
||||
Reference in New Issue
Block a user