From 806518df130f7fa1daa0a82dd51499daa94e9591 Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Tue, 18 Jan 2022 18:08:20 +0200 Subject: [PATCH] kubeadm: update references of "master" label/taint for 1.24 In 1.24 kubeadm will: - stop using the "master" label on CP nodes. - start tainting CP nodes with both "master" and "control-plane" taints. In 1.25 the "master" taint will be removed. Adjust references of the "master" label/taint to the above. --- .../en/docs/reference/kubectl/cheatsheet.md | 16 +++++++------- .../kubeadm/implementation-details.md | 5 +++-- .../setup-tools/kubeadm/kubeadm-init-phase.md | 2 +- .../tools/kubeadm/create-cluster-kubeadm.md | 22 +++++++++++-------- .../tools/kubeadm/troubleshooting-kubeadm.md | 2 +- .../en/examples/admin/cloud/ccm-example.yaml | 8 +++++-- .../en/examples/controllers/daemonset.yaml | 7 ++++-- .../controllers/fluentd-daemonset-update.yaml | 8 +++++-- .../controllers/fluentd-daemonset.yaml | 8 +++++-- 9 files changed, 49 insertions(+), 29 deletions(-) diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index 87451a03ac..8a0eb04eb5 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -49,7 +49,7 @@ detailed config file information. kubectl config view # Show Merged kubeconfig settings. # use multiple kubeconfig files at the same time and view merged config -KUBECONFIG=~/.kube/config:~/.kube/kubconfig2 +KUBECONFIG=~/.kube/config:~/.kube/kubconfig2 kubectl config view @@ -58,7 +58,7 @@ kubectl config view -o jsonpath='{.users[?(@.name == "e2e")].user.password}' kubectl config view -o jsonpath='{.users[].name}' # display the first user kubectl config view -o jsonpath='{.users[*].name}' # get a list of users -kubectl config get-contexts # display list of contexts +kubectl config get-contexts # display list of contexts kubectl config current-context # display the current-context kubectl config use-context my-cluster-name # set the default context to my-cluster-name @@ -92,10 +92,10 @@ kubectl apply -f https://git.io/vPieo # create resource(s) from url kubectl create deployment nginx --image=nginx # start a single instance of nginx # create a Job which prints "Hello World" -kubectl create job hello --image=busybox -- echo "Hello World" +kubectl create job hello --image=busybox -- echo "Hello World" # create a CronJob that prints "Hello World" every minute -kubectl create cronjob hello --image=busybox --schedule="*/1 * * * *" -- echo "Hello World" +kubectl create cronjob hello --image=busybox --schedule="*/1 * * * *" -- echo "Hello World" kubectl explain pods # get the documentation for pod manifests @@ -173,8 +173,8 @@ kubectl get configmap myconfig \ -o jsonpath='{.data.ca\.crt}' # Get all worker nodes (use a selector to exclude results that have a label -# named 'node-role.kubernetes.io/master') -kubectl get node --selector='!node-role.kubernetes.io/master' +# named 'node-role.kubernetes.io/control-plane') +kubectl get node --selector='!node-role.kubernetes.io/control-plane' # Get all running pods in the namespace kubectl get pods --field-selector=status.phase=Running @@ -226,7 +226,7 @@ for pod in $(kubectl get po --output=jsonpath={.items..metadata.name}); do echo ```bash kubectl set image deployment/frontend www=image:v2 # Rolling update "www" containers of "frontend" deployment, updating the image -kubectl rollout history deployment/frontend # Check the history of deployments including the revision +kubectl rollout history deployment/frontend # Check the history of deployments including the revision kubectl rollout undo deployment/frontend # Rollback to the previous deployment kubectl rollout undo deployment/frontend --to-revision=2 # Rollback to a specific revision kubectl rollout status -w deployment/frontend # Watch rolling update status of "frontend" deployment until completion @@ -318,7 +318,7 @@ kubectl run nginx --image=nginx # Run pod nginx and write it kubectl attach my-pod -i # Attach to Running Container kubectl port-forward my-pod 5000:6000 # Listen on port 5000 on the local machine and forward to port 6000 on my-pod kubectl exec my-pod -- ls / # Run command in existing pod (1 container case) -kubectl exec --stdin --tty my-pod -- /bin/sh # Interactive shell access to a running pod (1 container case) +kubectl exec --stdin --tty my-pod -- /bin/sh # Interactive shell access to a running pod (1 container case) kubectl exec my-pod -c my-container -- ls / # Run command in existing pod (multi-container case) kubectl top pod POD_NAME --containers # Show metrics for a given pod and its containers kubectl top pod POD_NAME --sort-by=cpu # Show metrics for a given pod and sort it by 'cpu' or 'memory' diff --git a/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md b/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md index 127ddeec19..74428b9148 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md +++ b/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md @@ -318,11 +318,12 @@ Please note that: As soon as the control plane is available, kubeadm executes following actions: -- Labels the node as control-plane with `node-role.kubernetes.io/master=""` -- Taints the node with `node-role.kubernetes.io/master:NoSchedule` +- Labels the node as control-plane with `node-role.kubernetes.io/control-plane=""` +- Taints the node with `node-role.kubernetes.io/master:NoSchedule` and `node-role.kubernetes.io/control-plane:NoSchedule` Please note that: +1. The `node-role.kubernetes.io/master` taint is deprecated and will be removed in kubeadm version 1.25 1. Mark control-plane phase phase can be invoked individually with the [`kubeadm init phase mark-control-plane`](/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-mark-control-plane) command ### Configure TLS-Bootstrapping for node joining diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md index 3f9812b260..2bab24f74d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md @@ -105,7 +105,7 @@ By default the certs and encryption key expire after two hours. ## kubeadm init phase mark-control-plane {#cmd-phase-mark-control-plane} -Use the following phase to label and taint the node with the `node-role.kubernetes.io/master=""` key-value pair. +Use the following phase to label and taint the node as a control plane node. {{< tabs name="tab-mark-control-plane" >}} {{< tab name="mark-control-plane" include="generated/kubeadm_init_phase_mark-control-plane.md" />}} diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index ccf634a147..eb2d370bc6 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -285,26 +285,30 @@ for `kubeadm`. ### Control plane node isolation -By default, your cluster will not schedule Pods on the control-plane node for security -reasons. If you want to be able to schedule Pods on the control-plane node, for example for a -single-machine Kubernetes cluster for development, run: +By default, your cluster will not schedule Pods on the control plane nodes for security +reasons. If you want to be able to schedule Pods on the control plane nodes, +for example for a single machine Kubernetes cluster, run: ```bash -kubectl taint nodes --all node-role.kubernetes.io/master- +kubectl taint nodes --all node-role.kubernetes.io/control-plane- node-role.kubernetes.io/control-master- ``` -With output looking something like: +The output will look something like: ``` node "test-01" untainted -taint "node-role.kubernetes.io/master:" not found -taint "node-role.kubernetes.io/master:" not found +... ``` -This will remove the `node-role.kubernetes.io/master` taint from any nodes that -have it, including the control-plane node, meaning that the scheduler will then be able +This will remove the `node-role.kubernetes.io/control-plane` and +`node-role.kubernetes.io/master` taints from any nodes that have them, +including the control plane nodes, meaning that the scheduler will then be able to schedule Pods everywhere. +{{< note >}} +The `node-role.kubernetes.io/master` taint is deprecated and kubeadm will stop using it in version 1.25. +{{< /note >}} + ### Joining your nodes {#join-nodes} The nodes are where your workloads (containers and Pods, etc) run. To add new nodes to your cluster do the following for each machine: diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md index 2cf84fc2f9..cbb659dec4 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md @@ -351,7 +351,7 @@ A known solution is to patch the kube-proxy DaemonSet to allow scheduling it on nodes regardless of their conditions, keeping it off of other nodes until their initial guarding conditions abate: ``` -kubectl -n kube-system patch ds kube-proxy -p='{ "spec": { "template": { "spec": { "tolerations": [ { "key": "CriticalAddonsOnly", "operator": "Exists" }, { "effect": "NoSchedule", "key": "node-role.kubernetes.io/master" } ] } } } }' +kubectl -n kube-system patch ds kube-proxy -p='{ "spec": { "template": { "spec": { "tolerations": [ { "key": "CriticalAddonsOnly", "operator": "Exists" }, { "effect": "NoSchedule", "key": "node-role.kubernetes.io/master" }, { "effect": "NoSchedule", "key": "node-role.kubernetes.io/control-plane" } ] } } } }' ``` The tracking issue for this problem is [here](https://github.com/kubernetes/kubeadm/issues/1027). diff --git a/content/en/examples/admin/cloud/ccm-example.yaml b/content/en/examples/admin/cloud/ccm-example.yaml index 3bce7b58fa..49a57ecca9 100644 --- a/content/en/examples/admin/cloud/ccm-example.yaml +++ b/content/en/examples/admin/cloud/ccm-example.yaml @@ -59,9 +59,13 @@ spec: - key: node.cloudprovider.kubernetes.io/uninitialized value: "true" effect: NoSchedule - # this is to have the daemonset runnable on master nodes - # the taint may vary depending on your cluster setup + # these tolerations are to have the daemonset runnable on control plane nodes + # remove them if your control plane nodes should not run pods + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule - key: node-role.kubernetes.io/master + operator: Exists effect: NoSchedule # this is to restrict CCM to only run on master nodes # the node selector may vary depending on your cluster setup diff --git a/content/en/examples/controllers/daemonset.yaml b/content/en/examples/controllers/daemonset.yaml index 685a137244..5b47b61ac1 100644 --- a/content/en/examples/controllers/daemonset.yaml +++ b/content/en/examples/controllers/daemonset.yaml @@ -15,8 +15,11 @@ spec: name: fluentd-elasticsearch spec: tolerations: - # this toleration is to have the daemonset runnable on master nodes - # remove it if your masters can't run pods + # these tolerations are to have the daemonset runnable on control plane nodes + # remove them if your control plane nodes should not run pods + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule - key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule diff --git a/content/en/examples/controllers/fluentd-daemonset-update.yaml b/content/en/examples/controllers/fluentd-daemonset-update.yaml index dcf08d4fc9..9521e73b00 100644 --- a/content/en/examples/controllers/fluentd-daemonset-update.yaml +++ b/content/en/examples/controllers/fluentd-daemonset-update.yaml @@ -19,9 +19,13 @@ spec: name: fluentd-elasticsearch spec: tolerations: - # this toleration is to have the daemonset runnable on master nodes - # remove it if your masters can't run pods + # these tolerations are to have the daemonset runnable on control plane nodes + # remove them if your control plane nodes should not run pods + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule - key: node-role.kubernetes.io/master + operator: Exists effect: NoSchedule containers: - name: fluentd-elasticsearch diff --git a/content/en/examples/controllers/fluentd-daemonset.yaml b/content/en/examples/controllers/fluentd-daemonset.yaml index 0e1e7d3345..653636fc57 100644 --- a/content/en/examples/controllers/fluentd-daemonset.yaml +++ b/content/en/examples/controllers/fluentd-daemonset.yaml @@ -19,9 +19,13 @@ spec: name: fluentd-elasticsearch spec: tolerations: - # this toleration is to have the daemonset runnable on master nodes - # remove it if your masters can't run pods + # these tolerations are to have the daemonset runnable on control plane nodes + # remove them if your control plane nodes should not run pods + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule - key: node-role.kubernetes.io/master + operator: Exists effect: NoSchedule containers: - name: fluentd-elasticsearch