[Do Not Merge] Release 1.12 (#10292)
* Update docs for fields allowed at root of CRD schema (#9973) * add plugin docs and examples (#10053) * docs update to promote TaintNodesByCondition to beta (#9626) * HPA Specificity Improvements (#8757) Updated the HPA docs to reference the `autoscaling/v2beta2` API version, and added documentation about the new fields. * adjust docs for pod ready++ (#10049) * Remove --cadvisor-port - has been deprecated since v1.10 (#10023) Change-Id: Id2a685473a243aef492a98ff450759f39e362557 * Add Documentation for Snapshot Feature (#9948) * Add documentation for snapshot feature * Update volume-snapshots.md * Add dry-run to api-concepts (#10033) * kubeadm-init: Update the offline support section (#10062) The update includes the following things (in mind with Kubernetes 1.12): - Remove the 1.8 image versions - Add the 1.10 image versions that were missing until now - Include a comment for the missing arch suffixes in 1.12 Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com> * Say bye to `DynamicProvisioningScheduling` (#10157) The mentioned feature gate is now collapsed into `VolumeScheduling`. xref: kubernetes/kubernetes#67432 * Update ResourceQuota per PriorityClass state for 1.12 (#10229) * TokenRequest and TokenRequestProjection now beta (#10161) xref: kubernetes/kubernetes#67349 * Change feature state for kms provider to beta. (#10230) KMS Provider will be graduating to beta in v1.12, reflecting this change on the website. * coredns default (#10200) * Promote ShareProcessNamespace to beta in docs (#9996) * Add CoreDNS details to DNS Debug docs (#10201) * add coredns details * address nits, add query logging section * Update docs with topology aware dynamic provisioning (#9939) * Document topology aware volume binding feature * update for readability * Update storage-classes.md * comma splice * don't abbreviate * HPA Algorithm Information Improvements (#9780) * Update HPA docs with more algorithm details The HPA docs pointed to an out-of-date document for information on the algorithm details, which users were finding confusing. This sticks a section on the algorithm in the HPA docs instead, documenting both general behavior and corner cases. * Add glossary info, HPA docs on quantities People often ask about the quantity notation when working with the metrics APIs, so this adds a glossary entry on quantities (since they're used elsewhere in the system), and a short explantation in the HPA walkthough. * Information about HPA readiness and stabilization This adds information about the new changes to HPA readiness and stabilization from kubernetes/features#591, and other minor changes that landed in Kubernetes 1.12. * Update horizontal-pod-autoscale.md * Audit 1.12 doc (#9953) * audit 1.12 document * remove legacy audit feature https://github.com/kubernetes/kubernetes/pull/65862 * update feature gate doc * MountPropagation is now GA (#10090) * RuntimeClass documentation (#10102) * RuntimeClass documentation * Update runtime-class.md * Add documentation for Scheduler performance tuning (#10048) * Add documentation for Scheduler performance tuning * Update scheduler-perf-tuning.md * TTL controller for cleaning up finished resources (#10064) * TTL controller for cleaning up finished resources * Address comments * Update ttlafterfinished.md * Bump quota configuration api version (#10217) * Incremental update from master (#10278) * fix invalid href of cloud controller manager (#10240) * fix invalid yaml format (#10238) * update storage-limits doc with Azure disk part (#10224) update storage-limits doc with Azure disk part fix comments * Update kubelet-config-file.md (#10222) Update link to KubeletConfiguration struct. * fix a trivial misspelling (#10244) * Fix cassandra-statefulset.yaml indent level (#10243) * Mention minimum etcd versions (#10208) Source: https://groups.google.com/d/msg/kubernetes-dev/jMPA4JzKiY4/HIx2ugvLBAAJ * fix 404 error (#10250) * Small verb tweak (#10190) Present participle, ftw. * Add AnchorJS logic for header links (#10155) * Add AnchorJS JavaScript * Remove existing inpage_heading logic * Remove underline from anchor tags * Use single icon and add touch visibility * Use paragraph link icon for AnchorJS * Update Sass to use code formatting in docsContent headers * Update header size coverage to H3-H6 * fix broken link in kubefed.md (#10254) * Update the version numbers for the X-Remote-Extra- and Impersonate-Extra- key fixes (#9827) The fix was cherry picked into 1.11.3, 1.10.7, and 1.9.11: https://github.com/kubernetes/kubernetes/pull/67162 https://github.com/kubernetes/kubernetes/pull/67163 https://github.com/kubernetes/kubernetes/pull/67164 * fix typo (#10168) * fix typo * addressing comments. * Update setup-ha-etcd-with-kubeadm.md * fix typos (#10252) * fix description of contribute guide (#10253) * describe truncate feature about advanced audit (#10236) * describe truncate feature about advanced audit * Update audit.md * docs update to promote ScheduleDaemonSetPods to beta (#9923) * Dynamic volume limit updates for 1.12 (#10211) * add a placeholder commit * Update docs for csi volume limits * Update storage-limits.md * Add "MayRunAs" value among other GroupStrategies (#9888) * Add CoreDNS details to the customize DNS doc (#10228) * Add CoreDNS details to the customize DNS doc Rewrite the document to include more details about CoreDNS, since it's now the default from v1.12 * Address comments * Improve doc wording * Fix link * Update dns-custom-nameservers.md * Update dns-custom-nameservers.md * Fix secrets docs in 1.12 branch (#10056) * Fix secrets docs * Update secret.md * Revert CoreDNS Docs (#10319) * Revert "Add CoreDNS details to DNS Debug docs (#10201)" This reverts commit462817a674. * Revert "Add CoreDNS details to the customize DNS doc (#10228)" This reverts commite7319eeb8c. * Revert "coredns default (#10200)" This reverts commit698e93b441. * Add CRI installation instructions page Added cri-installation page with CRI installation instructions Referenced it from kubeadm-init and install-kubeadm pages. * kubeadm: update API types documentation for 1.12 (#10283) v1alpha2 -> v1alpha3 MasterConfiguration -> [new-api-types] * TokenRequest feature documentation (#10295) * AdvancedAuditing is now GA (#10156) xref: kubernetes/kubernetes#65862 `AdvancedAuditing` feature is GA in 1.12. This PR adjusts the related docs. * update runtime-class.md (#10332) * update runtime-class.md * Update runtime-class.md * Document cross-authorizer permissions for creating RBAC roles (#10015) * Document cross-authorizer permissions for creating RBAC roles * Update rbac.md * kubeadm: update authored content for 1.12 (reference docs and cluster creation) (#10348) * kubeadm: update authored content in reference docs for 1.12 * kubeadm: add time frame in create-cluster-kubeadm for 1.12 * add AllowedProcMountTypes and ProcMountType to docs (#9911) Signed-off-by: Jess Frazelle <acidburn@microsoft.com> * kubeadm: add new command line reference (#10306) Add: - placeholder files - include place holder files - include "renew" sub command - add missing tabs for "alpha phase kubelet" * Documenting SCTP support in Kubernetes (#10279) * Documenting SCTP support in Kubernetes Service, Endpoint, NetworkPolicy and Pod * Updates based on comments on the PR * kubectl expose update with SCTP support * Updated according to comments in the PR * Revert "kubectl expose update with SCTP support" This reverts commit 0d5a1e6720a012390cf100c83e16b4a8c0782356. * TLS Bootstrap and Server Cert Rotation feature documentation (#10232) * TokenRequest feature documentation * line wrapping to make review not insane * update content for GA without major refactor * Update kubelet-tls-bootstrapping.md * Add clarifications for volume snapshots (#10296) * Update kubadm ha installation for 1.12 (#10264) * Update kubadm ha installation for 1.12 Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * update stable version Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * Update stacked control plane for v1.12 (#2) * use v1alpha3 Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * more v1alpha3 (#4) * updates Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * Document how to run in-tree cloud providers with kubeadm (#10357) Change-Id: Iab6b996a830503d74a6eb0c507c5f8ca7a39235b * kubeadm reference doc for release 1.12 (#10359) * Revert "Revert "Add CoreDNS details to DNS Debug docs (#10201)"" This reverts commit bb30f4d1fcd6fba2fe6190778ead99f8010033b7. * Revert "Revert "Add CoreDNS details to the customize DNS doc (#10228)"" This reverts commit bc23d45c09d7b83cac130fe22a0bd91e72435862. * Revert "Revert "coredns default (#10200)"" This reverts commit 7f4350d6ab7fc554ee53126d3875e845d2e43d1f. * add missing instruction for ha guide (#10374) Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * kubeadm - Ha upgrade updates (#10340) * Update HA upgrade docs * Adds external etcd HA upgrade guide Signed-off-by: Chuck Ha <ha.chuck@gmail.com> * copyedit * more edits * add runasgroup in psp (#10076) * update KubeletPluginsWatcher feature gate (#10205) * generated 1.12 docs * Building Multi-arch images with Manifests (#10379) In 1.12, a variety of images used in a typical kubernetes installation have started to using manifests to better support environments with arm or ppc64le architectures. For example all images used with kubeadm by default have manifests, another would be all the tests in the conformance test suite. Here we capture the best practices for everyone to start using manifests in their own workflows. Change-Id: I5ba4c5fe55ffc9486a8251760f3352be4f2e1494 * Upgrade docs for v1.12 (#10344) * generated assets and docs * remove 1.7 * update 1.12 * update plugin documentation under docs>tasks>extend-kubectl (#10259) * update plugin documentation under docs>tasks>extend-kubectl * Update kubectl-plugins.md
This commit is contained in:
Jim Angel
@@ -0,0 +1,226 @@
|
||||
---
|
||||
reviewers:
|
||||
- vincepri
|
||||
- bart0sh
|
||||
title: CRI installation
|
||||
content_template: templates/concept
|
||||
weight: 100
|
||||
---
|
||||
{{% capture overview %}}
|
||||
Since v1.6.0, Kubernetes has enabled the use of CRI, Container Runtime Interface, by default.
|
||||
This page contains installation instruction for various runtimes.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture body %}}
|
||||
|
||||
Please proceed with executing the following commands based on your OS as root.
|
||||
You may become the root user by executing `sudo -i` after SSH-ing to each host.
|
||||
|
||||
## Docker
|
||||
|
||||
On each of your machines, install Docker.
|
||||
Version 18.06 is recommended, but 1.11, 1.12, 1.13 and 17.03 are known to work as well.
|
||||
Keep track of the latest verified Docker version in the Kubernetes release notes.
|
||||
|
||||
Use the following commands to install Docker on your system:
|
||||
|
||||
{{< tabs name="tab-cri-docker-installation" >}}
|
||||
{{< tab name="Ubuntu 16.04" codelang="bash" >}}
|
||||
# Install Docker from Ubuntu's repositories:
|
||||
apt-get update
|
||||
apt-get install -y docker.io
|
||||
|
||||
# or install Docker CE 18.06 from Docker's repositories for Ubuntu or Debian:
|
||||
|
||||
## Install prerequisites.
|
||||
apt-get update && apt-get install apt-transport-https ca-certificates curl software-properties-common
|
||||
|
||||
## Download GPG key.
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
|
||||
|
||||
## Add docker apt repository.
|
||||
add-apt-repository \
|
||||
"deb [arch=amd64] https://download.docker.com/linux/ubuntu \
|
||||
$(lsb_release -cs) \
|
||||
stable"
|
||||
|
||||
## Install docker.
|
||||
apt-get update && apt-get install docker-ce=18.06.0~ce~3-0~ubuntu
|
||||
|
||||
# Setup daemon.
|
||||
cat > /etc/docker/daemon.json <<EOF
|
||||
{
|
||||
"exec-opts": ["native.cgroupdriver=systemd"],
|
||||
"log-driver": "json-file",
|
||||
"log-opts": {
|
||||
"max-size": "100m"
|
||||
},
|
||||
"storage-driver": "overlay2"
|
||||
}
|
||||
EOF
|
||||
|
||||
mkdir -p /etc/systemd/system/docker.service.d
|
||||
|
||||
# Restart docker.
|
||||
systemctl daemon-reload
|
||||
systemctl restart docker
|
||||
{{< /tab >}}
|
||||
{{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
|
||||
|
||||
# Install Docker from CentOS/RHEL repository:
|
||||
yum install -y docker
|
||||
|
||||
# or install Docker CE 18.06 from Docker's CentOS repositories:
|
||||
|
||||
## Install prerequisites.
|
||||
yum install yum-utils device-mapper-persistent-data lvm2
|
||||
|
||||
## Add docker repository.
|
||||
yum-config-manager \
|
||||
--add-repo \
|
||||
https://download.docker.com/linux/centos/docker-ce.repo
|
||||
|
||||
## Install docker.
|
||||
yum update && yum install docker-ce-18.06.1.ce
|
||||
|
||||
# Setup daemon.
|
||||
cat > /etc/docker/daemon.json <<EOF
|
||||
{
|
||||
"exec-opts": ["native.cgroupdriver=systemd"],
|
||||
"log-driver": "json-file",
|
||||
"log-opts": {
|
||||
"max-size": "100m"
|
||||
},
|
||||
"storage-driver": "overlay2",
|
||||
"storage-opts": [
|
||||
"overlay2.override_kernel_check=true"
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
mkdir -p /etc/systemd/system/docker.service.d
|
||||
|
||||
# Restart docker.
|
||||
systemctl daemon-reload
|
||||
systemctl restart docker
|
||||
{{< /tab >}}
|
||||
{{< /tabs >}}
|
||||
|
||||
Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/)
|
||||
for more information.
|
||||
|
||||
## CRI-O
|
||||
|
||||
This section contains the necessary steps to install `CRI-O` as CRI runtime.
|
||||
|
||||
Use the following commands to install CRI-O on your system:
|
||||
|
||||
### Prerequisites
|
||||
|
||||
```shell
|
||||
modprobe overlay
|
||||
modprobe br_netfilter
|
||||
|
||||
# Setup required sysctl params, these persist across reboots.
|
||||
cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF
|
||||
net.bridge.bridge-nf-call-iptables = 1
|
||||
net.ipv4.ip_forward = 1
|
||||
net.bridge.bridge-nf-call-ip6tables = 1
|
||||
EOF
|
||||
|
||||
sysctl --system
|
||||
```
|
||||
|
||||
{{< tabs name="tab-cri-cri-o-installation" >}}
|
||||
{{< tab name="Ubuntu 16.04" codelang="bash" >}}
|
||||
|
||||
# Install prerequisites
|
||||
apt-get update
|
||||
apt-get install software-properties-common
|
||||
|
||||
add-apt-repository ppa:projectatomic/ppa
|
||||
apt-get update
|
||||
|
||||
# Install CRI-O
|
||||
apt-get install cri-o-1.11
|
||||
|
||||
{{< /tab >}}
|
||||
{{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
|
||||
|
||||
# Install prerequisites
|
||||
yum-config-manager --add-repo=https://cbs.centos.org/repos/paas7-crio-311-candidate/x86_64/os/
|
||||
|
||||
# Install CRI-O
|
||||
yum install --nogpgcheck cri-o
|
||||
|
||||
{{< /tab >}}
|
||||
{{< /tabs >}}
|
||||
|
||||
### Start CRI-O
|
||||
|
||||
```
|
||||
systemctl start crio
|
||||
```
|
||||
|
||||
Refer to the [CRI-O installation guide](https://github.com/kubernetes-sigs/cri-o#getting-started)
|
||||
for more information.
|
||||
|
||||
## Containerd
|
||||
|
||||
This section contains the necessary steps to use `containerd` as CRI runtime.
|
||||
|
||||
Use the following commands to install Containerd on your system:
|
||||
|
||||
### Prerequisites
|
||||
|
||||
```shell
|
||||
modprobe overlay
|
||||
modprobe br_netfilter
|
||||
|
||||
# Setup required sysctl params, these persist across reboots.
|
||||
cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF
|
||||
net.bridge.bridge-nf-call-iptables = 1
|
||||
net.ipv4.ip_forward = 1
|
||||
net.bridge.bridge-nf-call-ip6tables = 1
|
||||
EOF
|
||||
|
||||
sysctl --system
|
||||
```
|
||||
|
||||
{{< tabs name="tab-cri-containerd-installation" >}}
|
||||
{{< tab name="Ubuntu 16.04+" codelang="bash" >}}
|
||||
apt-get install -y libseccomp2
|
||||
{{< /tab >}}
|
||||
{{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
|
||||
yum install -y libseccomp
|
||||
{{< /tab >}}
|
||||
{{< /tabs >}}
|
||||
|
||||
### Install containerd
|
||||
|
||||
[Containerd releases](https://github.com/containerd/containerd/releases) are published regularly, the values below are hardcoded to the latest version available at the time of writing. Please check for newer versions and hashes [here](https://storage.googleapis.com/cri-containerd-release).
|
||||
|
||||
```shell
|
||||
# Export required environment variables.
|
||||
export CONTAINERD_VERSION="1.1.2"
|
||||
export CONTAINERD_SHA256="d4ed54891e90a5d1a45e3e96464e2e8a4770cd380c21285ef5c9895c40549218"
|
||||
|
||||
# Download containerd tar.
|
||||
wget https://storage.googleapis.com/cri-containerd-release/cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz
|
||||
|
||||
# Check hash.
|
||||
echo "${CONTAINERD_SHA256} cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz" | sha256sum --check -
|
||||
|
||||
# Unpack.
|
||||
tar --no-overwrite-dir -C / -xzf cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz
|
||||
|
||||
# Start containerd.
|
||||
systemctl start containerd
|
||||
```
|
||||
|
||||
## Other CRI runtimes: rktlet and frakti
|
||||
|
||||
Refer to the [Frakti QuickStart guide](https://github.com/kubernetes/frakti#quickstart) and [Rktlet Getting Started guide](https://github.com/kubernetes-incubator/rktlet/blob/master/docs/getting-started-guide.md) for more information.
|
||||
|
||||
{{% /capture %}}
|
||||
@@ -83,7 +83,6 @@ coreos:
|
||||
--api-servers=<master-private-ip>:8080 \
|
||||
--allow-privileged=true \
|
||||
--logtostderr=true \
|
||||
--cadvisor-port=4194 \
|
||||
--healthz-bind-address=0.0.0.0 \
|
||||
--healthz-port=10248
|
||||
Restart=always
|
||||
|
||||
@@ -20,7 +20,7 @@ These fields consist of `key: value` pairs. To override a flag for a control pla
|
||||
2. Add the flags to override to the field.
|
||||
|
||||
For more details on each field in the configuration you can navigate to our
|
||||
[API reference pages](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#MasterConfiguration).
|
||||
[API reference pages](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#ClusterConfiguration).
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
@@ -32,11 +32,11 @@ For details, see the [reference documentation for kube-apiserver](https://kubern
|
||||
|
||||
Example usage:
|
||||
```yaml
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.0
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: v1.12.0
|
||||
metadata:
|
||||
name: 1.11-sample
|
||||
name: 1.12-sample
|
||||
apiServerExtraArgs:
|
||||
advertise-address: 192.168.0.103
|
||||
anonymous-auth: false
|
||||
@@ -50,11 +50,11 @@ For details, see the [reference documentation for kube-controller-manager](https
|
||||
|
||||
Example usage:
|
||||
```yaml
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.0
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: v1.12.0
|
||||
metadata:
|
||||
name: 1.11-sample
|
||||
name: 1.12-sample
|
||||
controllerManagerExtraArgs:
|
||||
cluster-signing-key-file: /home/johndoe/keys/ca.key
|
||||
bind-address: 0.0.0.0
|
||||
@@ -67,11 +67,11 @@ For details, see the [reference documentation for kube-scheduler](https://kubern
|
||||
|
||||
Example usage:
|
||||
```yaml
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.0
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: v1.12.0
|
||||
metadata:
|
||||
name: 1.11-sample
|
||||
name: 1.12-sample
|
||||
schedulerExtraArgs:
|
||||
address: 0.0.0.0
|
||||
config: /home/johndoe/schedconfig.yaml
|
||||
|
||||
@@ -69,6 +69,7 @@ timeframe; which also applies to `kubeadm`.
|
||||
| v1.9.x | December 2017 | September 2018 |
|
||||
| v1.10.x | March 2018 | December 2018 |
|
||||
| v1.11.x | June 2018 | March 2019 |
|
||||
| v1.12.x | September 2018 | June 2019 |
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ and control plane nodes are co-located.
|
||||
- With an external etcd cluster. This approach requires more infrastructure. The
|
||||
control plane nodes and etcd members are separated.
|
||||
|
||||
Your clusters must run Kubernetes version 1.11 or later. You should also be aware that
|
||||
Your clusters must run Kubernetes version 1.12 or later. You should also be aware that
|
||||
setting up HA clusters with kubeadm is still experimental. You might encounter issues
|
||||
with upgrading your clusters, for example. We encourage you to try either approach,
|
||||
and provide feedback.
|
||||
@@ -139,15 +139,18 @@ different configuration.
|
||||
|
||||
### Bootstrap the first stacked control plane node
|
||||
|
||||
{{< note >}}
|
||||
**Note**: Optionally replace `stable` with a different version of Kubernetes, for example `v1.12.0`.
|
||||
{{< /note >}}
|
||||
|
||||
1. Create a `kubeadm-config.yaml` template file:
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.x
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
api:
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
@@ -166,9 +169,6 @@ different configuration.
|
||||
# This CIDR is a Calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace `x` in `kubernetesVersion: v1.11.x` with the latest available version.
|
||||
For example: `kubernetesVersion: v1.11.1`
|
||||
|
||||
1. Replace the following variables in the template with the appropriate
|
||||
values for your cluster:
|
||||
|
||||
@@ -224,13 +224,12 @@ done
|
||||
|
||||
1. Create a second, different `kubeadm-config.yaml` template file:
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.x
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
api:
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
@@ -250,9 +249,6 @@ done
|
||||
# This CIDR is a calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace `x` in `kubernetesVersion: v1.11.x` with the latest available version.
|
||||
For example: `kubernetesVersion: v1.11.1`
|
||||
|
||||
1. Replace the following variables in the template with the appropriate values for your cluster:
|
||||
|
||||
- `LOAD_BALANCER_DNS`
|
||||
@@ -296,7 +292,7 @@ done
|
||||
export CP1_IP=10.0.0.8
|
||||
export CP1_HOSTNAME=cp1
|
||||
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
kubectl exec -n kube-system etcd-${CP0_HOSTNAME} -- etcdctl --ca-file /etc/kubernetes/pki/etcd/ca.crt --cert-file /etc/kubernetes/pki/etcd/peer.crt --key-file /etc/kubernetes/pki/etcd/peer.key --endpoints=https://${CP0_IP}:2379 member add ${CP1_HOSTNAME} https://${CP1_IP}:2380
|
||||
kubeadm alpha phase etcd local --config kubeadm-config.yaml
|
||||
```
|
||||
@@ -317,13 +313,12 @@ done
|
||||
|
||||
1. Create a third, different `kubeadm-config.yaml` template file:
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.x
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
api:
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
@@ -343,9 +338,6 @@ done
|
||||
# This CIDR is a calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace `x` in `kubernetesVersion: v1.11.x` with the latest available version.
|
||||
For example: `kubernetesVersion: v1.11.1`
|
||||
|
||||
1. Replace the following variables in the template with the appropriate values for your cluster:
|
||||
|
||||
- `LOAD_BALANCER_DNS`
|
||||
@@ -391,7 +383,7 @@ done
|
||||
export CP2_IP=10.0.0.9
|
||||
export CP2_HOSTNAME=cp2
|
||||
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
kubectl exec -n kube-system etcd-${CP0_HOSTNAME} -- etcdctl --ca-file /etc/kubernetes/pki/etcd/ca.crt --cert-file /etc/kubernetes/pki/etcd/peer.crt --key-file /etc/kubernetes/pki/etcd/peer.key --endpoints=https://${CP0_IP}:2379 member add ${CP2_HOSTNAME} https://${CP2_IP}:2380
|
||||
kubeadm alpha phase etcd local --config kubeadm-config.yaml
|
||||
```
|
||||
@@ -411,39 +403,49 @@ done
|
||||
- Follow [these instructions](/docs/setup/independent/setup-ha-etcd-with-kubeadm/)
|
||||
to set up the etcd cluster.
|
||||
|
||||
### Copy required files to other control plane nodes
|
||||
|
||||
The following certificates were created when you created the cluster. Copy them
|
||||
to your other control plane nodes:
|
||||
|
||||
- `/etc/kubernetes/pki/etcd/ca.crt`
|
||||
- `/etc/kubernetes/pki/apiserver-etcd-client.crt`
|
||||
- `/etc/kubernetes/pki/apiserver-etcd-client.key`
|
||||
#### Copy required files from an etcd node to all control plane nodes
|
||||
|
||||
In the following example, replace `USER` and `CONTROL_PLANE_HOSTS` values with values
|
||||
for your environment.
|
||||
|
||||
```sh
|
||||
# Make a list of required etcd certificate files
|
||||
cat << EOF > etcd-pki-files.txt
|
||||
/etc/kubernetes/pki/etcd/ca.crt
|
||||
/etc/kubernetes/pki/apiserver-etcd-client.crt
|
||||
/etc/kubernetes/pki/apiserver-etcd-client.key
|
||||
EOF
|
||||
|
||||
# create the archive
|
||||
tar -czf etcd-pki.tar.gz -T etcd-pki-files.txt
|
||||
|
||||
# copy the archive to the control plane nodes
|
||||
USER=ubuntu
|
||||
CONTROL_PLANE_HOSTS="10.0.0.7 10.0.0.8 10.0.0.9"
|
||||
for host in $CONTROL_PLANE_HOSTS; do
|
||||
scp /etc/kubernetes/pki/etcd/ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/apiserver-etcd-client.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/apiserver-etcd-client.key "${USER}"@$host:
|
||||
scp etcd-pki.tar.gz "${USER}"@$host:
|
||||
done
|
||||
```
|
||||
|
||||
### Set up the first control plane node
|
||||
|
||||
1. Create a `kubeadm-config.yaml` template file:
|
||||
1. Extract the etcd certificates
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
kubernetesVersion: v1.11.x
|
||||
mkdir -p /etc/kubernetes/pki
|
||||
tar -xzf etcd-pki.tar.gz -C /etc/kubernetes/pki --strip-components=3
|
||||
|
||||
1. Create a `kubeadm-config.yaml`:
|
||||
|
||||
{{< note >}}
|
||||
**Note**: Optionally replace `stable` with a different version of Kubernetes, for example `v1.11.3`.
|
||||
{{< /note >}}
|
||||
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: stable
|
||||
apiServerCertSANs:
|
||||
- "LOAD_BALANCER_DNS"
|
||||
api:
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
controlPlaneEndpoint: "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"
|
||||
etcd:
|
||||
external:
|
||||
endpoints:
|
||||
@@ -457,9 +459,6 @@ done
|
||||
# This CIDR is a calico default. Substitute or remove for your CNI provider.
|
||||
podSubnet: "192.168.0.0/16"
|
||||
|
||||
1. Replace `x` in `kubernetesVersion: v1.11.x` with the latest available version.
|
||||
For example: `kubernetesVersion: v1.11.1`
|
||||
|
||||
1. Replace the following variables in the template with the appropriate values for your cluster:
|
||||
|
||||
- `LOAD_BALANCER_DNS`
|
||||
@@ -469,11 +468,12 @@ done
|
||||
- `ETCD_2_IP`
|
||||
|
||||
1. Run `kubeadm init --config kubeadm-config.yaml`
|
||||
1. Copy the output join commamnd.
|
||||
|
||||
### Copy required files to the correct locations
|
||||
|
||||
The following certificates and other required files were created when you ran `kubeadm init`.
|
||||
Copy these files to your other control plane nodes:
|
||||
The following pki files were created during the `kubeadm init` step and must be shared with
|
||||
all other control plane nodes.
|
||||
|
||||
- `/etc/kubernetes/pki/ca.crt`
|
||||
- `/etc/kubernetes/pki/ca.key`
|
||||
@@ -486,24 +486,34 @@ In the following example, replace the list of
|
||||
`CONTROL_PLANE_IPS` values with the IP addresses of the other control plane nodes.
|
||||
|
||||
```sh
|
||||
# make a list of required kubernetes certificate files
|
||||
cat << EOF > certificate_files.txt
|
||||
/etc/kubernetes/pki/ca.crt
|
||||
/etc/kubernetes/pki/ca.key
|
||||
/etc/kubernetes/pki/sa.key
|
||||
/etc/kubernetes/pki/sa.pub
|
||||
/etc/kubernetes/pki/front-proxy-ca.crt
|
||||
/etc/kubernetes/pki/front-proxy-ca.key
|
||||
EOF
|
||||
|
||||
# create the archive
|
||||
tar -czf control-plane-certificates.tar.gz -T certificate_files.txt
|
||||
|
||||
USER=ubuntu # customizable
|
||||
CONTROL_PLANE_IPS="10.0.0.7 10.0.0.8"
|
||||
for host in ${CONTROL_PLANE_IPS}; do
|
||||
scp /etc/kubernetes/pki/ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/ca.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/sa.key "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/sa.pub "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/front-proxy-ca.crt "${USER}"@$host:
|
||||
scp /etc/kubernetes/pki/front-proxy-ca.key "${USER}"@$host:
|
||||
scp control-plane-certificates.tar.gz "${USER}"@$host:
|
||||
done
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
**Note**: Remember that your config may differ from this example.
|
||||
{{< /note >}}
|
||||
|
||||
### Set up the other control plane nodes
|
||||
|
||||
1. Extract the required certificates
|
||||
|
||||
mkdir -p /etc/kubernetes/pki
|
||||
tar -xzf etcd-pki.tar.gz -C /etc/kubernetes/pki --strip-components 3
|
||||
tar -xzf control-plane-certificates.tar.gz -C /etc/kubernetes/pki --strip-components 3
|
||||
|
||||
1. Verify the location of the copied files.
|
||||
Your `/etc/kubernetes` directory should look like this:
|
||||
|
||||
@@ -517,8 +527,10 @@ done
|
||||
- `/etc/kubernetes/pki/sa.pub`
|
||||
- `/etc/kubernetes/pki/etcd/ca.crt`
|
||||
|
||||
1. Run `kubeadm init --config kubeadm-config.yaml` on each control plane node, where
|
||||
`kubeadm-config.yaml` is the file you already created.
|
||||
1. Run the copied `kubeadm join` command from above. Add the flag "--experimental-control-plane".
|
||||
The final command will look something like this:
|
||||
|
||||
kubeadm join ha.k8s.example.com:6443 --token 5ynki1.3erp9i3yo7gqg1nv --discovery-token-ca-cert-hash sha256:a00055bd8c710a9906a3d91b87ea02976334e1247936ac061d867a0f014ecd81 --experimental-control-plane
|
||||
|
||||
## Common tasks after bootstrapping control plane
|
||||
|
||||
|
||||
@@ -79,57 +79,20 @@ The pod network plugin you use (see below) may also require certain ports to be
|
||||
open. Since this differs with each pod network plugin, please see the
|
||||
documentation for the plugins about what port(s) those need.
|
||||
|
||||
## Installing Docker
|
||||
## Installing runtime
|
||||
|
||||
On each of your machines, install Docker.
|
||||
Version 17.03 is recommended, but 1.11, 1.12 and 1.13 are known to work as well.
|
||||
Versions 17.06+ _might work_, but have not yet been tested and verified by the Kubernetes node team.
|
||||
Keep track of the latest verified Docker version in the Kubernetes release notes.
|
||||
Since v1.6.0, Kubernetes has enabled the use of CRI, Container Runtime Interface, by default.
|
||||
The container runtime used by default is Docker, which is enabled through the built-in
|
||||
`dockershim` CRI implementation inside of the `kubelet`.
|
||||
|
||||
Please proceed with executing the following commands based on your OS as root. You may become the root user by executing `sudo -i` after SSH-ing to each host.
|
||||
Other CRI-based runtimes include:
|
||||
|
||||
If you already have the required versions of the Docker installed, you can move on to next section.
|
||||
If not, you can use the following commands to install Docker on your system:
|
||||
- [cri-containerd](https://github.com/containerd/cri-containerd)
|
||||
- [cri-o](https://github.com/kubernetes-incubator/cri-o)
|
||||
- [frakti](https://github.com/kubernetes/frakti)
|
||||
- [rkt](https://github.com/kubernetes-incubator/rktlet)
|
||||
|
||||
{{< tabs name="docker_install" >}}
|
||||
{{% tab name="Ubuntu, Debian or HypriotOS" %}}
|
||||
Install Docker from Ubuntu's repositories:
|
||||
|
||||
```bash
|
||||
apt-get update
|
||||
apt-get install -y docker.io
|
||||
```
|
||||
|
||||
or install Docker CE 17.03 from Docker's repositories for Ubuntu or Debian:
|
||||
|
||||
```bash
|
||||
apt-get update
|
||||
apt-get install -y apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
|
||||
add-apt-repository "deb https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") $(lsb_release -cs) stable"
|
||||
apt-get update && apt-get install -y docker-ce=$(apt-cache madison docker-ce | grep 17.03 | head -1 | awk '{print $3}')
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="CentOS, RHEL or Fedora" %}}
|
||||
Install Docker using your operating system's bundled package:
|
||||
|
||||
```bash
|
||||
yum install -y docker
|
||||
systemctl enable docker && systemctl start docker
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="Container Linux" %}}
|
||||
Enable and start Docker:
|
||||
|
||||
```bash
|
||||
systemctl enable docker && systemctl start docker
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
|
||||
Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/)
|
||||
for more information.
|
||||
Refer to the [CRI installation instructions](/docs/setup/cri.md) for more information.
|
||||
|
||||
## Installing kubeadm, kubelet and kubectl
|
||||
|
||||
|
||||
@@ -23,7 +23,7 @@ manager instead, but you need to configure it manually.
|
||||
Some kubelet configuration details need to be the same across all kubelets involved in the cluster, while
|
||||
other configuration aspects need to be set on a per-kubelet basis, to accommodate the different
|
||||
characteristics of a given machine, such as OS, storage, and networking. You can manage the configuration
|
||||
of your kubelets manually, but [kubeadm now provides a `MasterConfig` API type for managing your
|
||||
of your kubelets manually, but [kubeadm now provides a `KubeletConfiguration` API type for managing your
|
||||
kubelet configurations centrally](#configure-kubelets-using-kubeadm).
|
||||
|
||||
{{% /capture %}}
|
||||
@@ -63,10 +63,7 @@ clusterDNS:
|
||||
- 10.96.0.10
|
||||
```
|
||||
|
||||
See the
|
||||
[API reference for the
|
||||
kubelet ComponentConfig](https://godoc.org/k8s.io/kubernetes/pkg/kubelet/apis/config#KubeletConfiguration)
|
||||
for more information.
|
||||
For more details on the ComponentConfig have a look at [this section](#configure-kubelets-using-kubeadm).
|
||||
|
||||
### Providing instance-specific configuration details
|
||||
|
||||
@@ -96,14 +93,19 @@ such as systemd.
|
||||
|
||||
## Configure kubelets using kubeadm
|
||||
|
||||
The kubeadm config API type `MasterConfiguration` embeds the kubelet's ComponentConfig under
|
||||
the `.kubeletConfiguration.baseConfig` key. Any user writing a `MasterConfiguration`
|
||||
file can use this configuration key to also set the base-level configuration for all kubelets
|
||||
in the cluster.
|
||||
It is possible to configure the kubelet that kubeadm will start if a custom `KubeletConfiguration`
|
||||
API object is passed with a configuration file like so `kubeadm ... --config some-config-file.yaml`.
|
||||
|
||||
By calling `kubeadm config print-default --api-objects KubeletConfiguration` you can
|
||||
see all the default values for this structure.
|
||||
|
||||
Also have a look at the [API reference for the
|
||||
kubelet ComponentConfig](https://godoc.org/k8s.io/kubernetes/pkg/kubelet/apis/config#KubeletConfiguration)
|
||||
for more information on the individual fields.
|
||||
|
||||
### Workflow when using `kubeadm init`
|
||||
|
||||
When you call `kubeadm init`, the `.kubeletConfiguration.baseConfig` structure is marshalled to disk
|
||||
When you call `kubeadm init`, the kubelet configuration is marshalled to disk
|
||||
at `/var/lib/kubelet/config.yaml`, and also uploaded to a ConfigMap in the cluster. The ConfigMap
|
||||
is named `kubelet-config-1.X`, where `.X` is the minor version of the Kubernetes version you are
|
||||
initializing. A kubelet configuration file is also written to `/etc/kubernetes/kubelet.conf` with the
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
reviewers:
|
||||
- sig-cluster-lifecycle
|
||||
title: Set up a high availability etcd cluster with kubeadm
|
||||
title: Set up a High Availability etcd cluster with kubeadm
|
||||
content_template: templates/task
|
||||
weight: 60
|
||||
---
|
||||
@@ -9,7 +9,7 @@ weight: 60
|
||||
{{% capture overview %}}
|
||||
|
||||
Kubeadm defaults to running a single member etcd cluster in a static pod managed
|
||||
by the kubelet on the control plane node. This is not a high availability setup
|
||||
by the kubelet on the control plane node. This is not a high availability setup
|
||||
as the etcd cluster contains only one member and cannot sustain any members
|
||||
becoming unavailable. This task walks through the process of creating a high
|
||||
availability etcd cluster of three members that can be used as an external etcd
|
||||
@@ -83,8 +83,8 @@ this example.
|
||||
HOST=${ETCDHOSTS[$i]}
|
||||
NAME=${NAMES[$i]}
|
||||
cat << EOF > /tmp/${HOST}/kubeadmcfg.yaml
|
||||
apiVersion: "kubeadm.k8s.io/v1alpha2"
|
||||
kind: MasterConfiguration
|
||||
apiVersion: "kubeadm.k8s.io/v1alpha3"
|
||||
kind: ClusterConfiguration
|
||||
etcd:
|
||||
local:
|
||||
serverCertSANs:
|
||||
@@ -107,7 +107,7 @@ this example.
|
||||
|
||||
If you already have a CA then the only action that is copying the CA's `crt` and
|
||||
`key` file to `/etc/kubernetes/pki/etcd/ca.crt` and
|
||||
`/etc/kubernetes/pki/etcd/ca.key`. After those files have been copied,
|
||||
`/etc/kubernetes/pki/etcd/ca.key`. After those files have been copied,
|
||||
proceed to the next step, "Create certificates for each member".
|
||||
|
||||
If you do not already have a CA then run this command on `$HOST0` (where you
|
||||
|
||||
@@ -190,7 +190,7 @@ Error from server: Get https://10.19.0.41:10250/containerLogs/default/mysql-ddc6
|
||||
curl http://169.254.169.254/metadata/v1/interfaces/public/0/anchor_ipv4/address
|
||||
```
|
||||
|
||||
The workaround is to tell `kubelet` which IP to use using `--node-ip`. When using Digital Ocean, it can be the public one (assigned to `eth0`) or the private one (assigned to `eth1`) should you want to use the optional private network. The [KubeletExtraArgs section of the MasterConfiguration file](https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/app/apis/kubeadm/v1alpha2/types.go#L147) can be used for this.
|
||||
The workaround is to tell `kubelet` which IP to use using `--node-ip`. When using Digital Ocean, it can be the public one (assigned to `eth0`) or the private one (assigned to `eth1`) should you want to use the optional private network. The [`KubeletExtraArgs` section of the kubeadm `NodeRegistrationOptions` structure](https://github.com/kubernetes/kubernetes/blob/release-1.12/cmd/kubeadm/app/apis/kubeadm/v1alpha3/types.go#L163-L166) can be used for this.
|
||||
|
||||
Then restart `kubelet`:
|
||||
|
||||
|
||||
@@ -73,18 +73,20 @@ available and can tolerate the loss of a zone, the control plane is
|
||||
located in a single zone. Users that want a highly available control
|
||||
plane should follow the [high availability](/docs/admin/high-availability) instructions.
|
||||
|
||||
### Volume limitations
|
||||
The following limitations are addressed with [topology-aware volume binding](/docs/concepts/storage/storage-classes/#volume-binding-mode).
|
||||
|
||||
* StatefulSet volume zone spreading when using dynamic provisioning is currently not compatible with
|
||||
pod affinity or anti-affinity policies.
|
||||
pod affinity or anti-affinity policies.
|
||||
|
||||
* If the name of the StatefulSet contains dashes ("-"), volume zone spreading
|
||||
may not provide a uniform distribution of storage across zones.
|
||||
may not provide a uniform distribution of storage across zones.
|
||||
|
||||
* When specifying multiple PVCs in a Deployment or Pod spec, the StorageClass
|
||||
needs to be configured for a specific, single zone, or the PVs need to be
|
||||
statically provisioned in a specific zone. Another workaround is to use a
|
||||
StatefulSet, which will ensure that all the volumes for a replica are
|
||||
provisioned in the same zone.
|
||||
|
||||
needs to be configured for a specific single zone, or the PVs need to be
|
||||
statically provisioned in a specific zone. Another workaround is to use a
|
||||
StatefulSet, which will ensure that all the volumes for a replica are
|
||||
provisioned in the same zone.
|
||||
|
||||
## Walkthrough
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user