From e4615a2ffb95152e5c1893ad5fe6a242c4c1c1ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Martins?= Date: Wed, 26 May 2021 13:58:24 +0200 Subject: [PATCH 1/8] tasks/network: add Cilium in dual-stack supported plugins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update installation steps with the latest stable release. Signed-off-by: André Martins --- .../cilium-network-policy.md | 64 +++++++++++-------- .../docs/tasks/network/validate-dual-stack.md | 2 +- 2 files changed, 40 insertions(+), 26 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md b/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md index 948893d3ea..74b8d2182e 100644 --- a/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md +++ b/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md @@ -24,45 +24,59 @@ For background on Cilium, read the [Introduction to Cilium](https://docs.cilium. ## Deploying Cilium on Minikube for Basic Testing To get familiar with Cilium easily you can follow the -[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/minikube/) +[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) to perform a basic DaemonSet installation of Cilium in minikube. -To start minikube, minimal version required is >= v1.3.1, run the with the +To start minikube, minimal version required is >= v1.5.2, run the with the following arguments: ```shell minikube version ``` ``` -minikube version: v1.3.1 +minikube version: v1.5.2 ``` ```shell -minikube start --network-plugin=cni --memory=4096 +minikube start --network-plugin=cni ``` -Mount the BPF filesystem: +For minikube you can install Cilium using its CLI tool. Cilium will +automatically detect the cluster configuration and will install the appropriate +components for a successful installation: ```shell -minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf -``` - -For minikube you can deploy this simple ''all-in-one'' YAML file that includes -DaemonSet configurations for Cilium as well as appropriate RBAC settings: - -```shell -kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml +curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz +sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin +rm cilium-linux-amd64.tar.gz +cilium install ``` ``` -configmap/cilium-config created -serviceaccount/cilium created -serviceaccount/cilium-operator created -clusterrole.rbac.authorization.k8s.io/cilium created -clusterrole.rbac.authorization.k8s.io/cilium-operator created -clusterrolebinding.rbac.authorization.k8s.io/cilium created -clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created -daemonset.apps/cilium create -deployment.apps/cilium-operator created +🔮 Auto-detected Kubernetes kind: minikube +✨ Running "minikube" validation checks +✅ Detected minikube version "1.20.0" +ℹ️ Cilium version not set, using default version "v1.10.0" +🔮 Auto-detected cluster name: minikube +🔮 Auto-detected IPAM mode: cluster-pool +🔮 Auto-detected datapath mode: tunnel +🔑 Generating CA... +2021/05/27 02:54:44 [INFO] generate received request +2021/05/27 02:54:44 [INFO] received CSR +2021/05/27 02:54:44 [INFO] generating key: ecdsa-256 +2021/05/27 02:54:44 [INFO] encoded CSR +2021/05/27 02:54:44 [INFO] signed certificate with serial number 48713764918856674401136471229482703021230538642 +🔑 Generating certificates for Hubble... +2021/05/27 02:54:44 [INFO] generate received request +2021/05/27 02:54:44 [INFO] received CSR +2021/05/27 02:54:44 [INFO] generating key: ecdsa-256 +2021/05/27 02:54:44 [INFO] encoded CSR +2021/05/27 02:54:44 [INFO] signed certificate with serial number 3514109734025784310086389188421560613333279574 +🚀 Creating Service accounts... +🚀 Creating Cluster roles... +🚀 Creating ConfigMap... +🚀 Creating Agent DaemonSet... +🚀 Creating Operator Deployment... +⌛ Waiting for Cilium to be installed... ``` The remainder of the Getting Started Guide explains how to enforce both L3/L4 @@ -85,14 +99,14 @@ Deploying a cluster with Cilium adds Pods to the `kube-system` namespace. To see this list of Pods run: ```shell -kubectl get pods --namespace=kube-system +kubectl get pods --namespace=kube-system -l k8s-app=cilium ``` You'll see a list of Pods similar to this: ```console -NAME READY STATUS RESTARTS AGE -cilium-6rxbd 1/1 Running 0 1m +NAME READY STATUS RESTARTS AGE +cilium-kkdhz 1/1 Running 0 3m23s ... ``` diff --git a/content/en/docs/tasks/network/validate-dual-stack.md b/content/en/docs/tasks/network/validate-dual-stack.md index bc90dea4ea..717bac27ad 100644 --- a/content/en/docs/tasks/network/validate-dual-stack.md +++ b/content/en/docs/tasks/network/validate-dual-stack.md @@ -16,7 +16,7 @@ This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clu * Provider support for dual-stack networking (Cloud provider or otherwise must be able to provide Kubernetes nodes with routable IPv4/IPv6 network interfaces) -* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack (such as Kubenet or Calico) +* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack (such as Calico, Cilium or Kubenet) * [Dual-stack enabled](/docs/concepts/services-networking/dual-stack/) cluster {{< version-check >}} From 85cc70b33368247336f34c6cb49c6613385ccadd Mon Sep 17 00:00:00 2001 From: aliakbar Date: Tue, 13 Jul 2021 22:56:09 +0430 Subject: [PATCH 2/8] Add explanations for control-plane pods restart after certificate renewal --- .../administer-cluster/kubeadm/kubeadm-certs.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index be98558659..63b95d0eb5 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -126,7 +126,18 @@ command. In that case, you should explicitly set `--certificate-renewal=true`. You can renew your certificates manually at any time with the `kubeadm certs renew` command. -This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. +This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. + +After running the command you should restart the control plane Pods. This is required since +dynamic certificate reload is currently not supported for all components and certificates. +[Static Pods](/docs/tasks/configure-pod-containerstatic-pod/) are managed by the local kubelet +and not by the API Server, thus kubectl cannot be used to delete and restart them. +To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` +and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/ +reference/config-api/kubelet-config.v1beta1/). +The kubelet will terminate the Pod if it's no longer in the manifest directory. +You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate +the Pod and the certificate renewal for the component can complete. {{< warning >}} If you are running an HA cluster, this command needs to be executed on all the control-plane nodes. From 8f67e373eb5cc42c1a543955525607c8bbaf62cd Mon Sep 17 00:00:00 2001 From: Mengjiao Liu Date: Thu, 29 Jul 2021 10:24:59 +0800 Subject: [PATCH 3/8] Add mengjiao-liu to sig-docs-zh-reviews --- OWNERS_ALIASES | 1 + 1 file changed, 1 insertion(+) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index d78cc20a05..ea9761f277 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -161,6 +161,7 @@ aliases: - chenxuc - howieyuen - idealhack + - mengjiao-liu - pigletfly - SataQiu - tanjunchen From 97d371bcf778a07ef029834eec7ef4ae443d96af Mon Sep 17 00:00:00 2001 From: Juhee Kang Date: Fri, 30 Jul 2021 22:16:44 +0900 Subject: [PATCH 4/8] Fix kubectl-convert plugin typo on "Install kubectl on macOS" Compared with the other distro guide about installation kubectl, the macOS installation guide has a typo about validation of kubectl-convert. This commits fixes the typo on "Install kubectl on macOS" documentation. --- content/en/docs/tasks/tools/install-kubectl-macos.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/tools/install-kubectl-macos.md b/content/en/docs/tasks/tools/install-kubectl-macos.md index 1cd6cb043e..b46ab03640 100644 --- a/content/en/docs/tasks/tools/install-kubectl-macos.md +++ b/content/en/docs/tasks/tools/install-kubectl-macos.md @@ -185,7 +185,7 @@ Below are the procedures to set up autocompletion for Bash and Zsh. 1. Validate the binary (optional) - Download the kubectl checksum file: + Download the kubectl-convert checksum file: {{< tabs name="download_convert_checksum_macos" >}} {{< tab name="Intel" codelang="bash" >}} From 73a030236d00b83544aadb3648d0a71ac09dd275 Mon Sep 17 00:00:00 2001 From: zhangguanzhang Date: Sun, 25 Jul 2021 15:32:49 +0800 Subject: [PATCH 5/8] [zh] docs: update old command and sync Signed-off-by: zhangguanzhang --- .../kubeadm/kubeadm-certs.md | 36 +++++++++++-------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index ab0372b1a9..8bf1ddc28e 100644 --- a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -99,7 +99,7 @@ You can use the `check-expiration` subcommand to check when certificates expire: 你可以使用 `check-expiration` 子命令来检查证书何时过期 ```shell -kubeadm alpha certs check-expiration +kubeadm certs check-expiration ``` {{< note >}} -上面的列表中没有包含 `kubelet.conf` 因为 kubeadm 将 kubelet 配置为自动更新证书。 +上面的列表中没有包含 `kubelet.conf`，因为 kubeadm 将 kubelet 配置为 +[自动更新证书](/docs/tasks/tls/certificate-rotation/)。 +轮换的证书位于目录 `/var/lib/kubelet/pki`。 +要修复过期的 kubelet 客户端证书，请参阅 +[kubelet 客户端证书轮换失败](/zh/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#kubelet-client-cert)。 {{< /note >}} ## 手动更新证书 -你能随时通过 `kubeadm alpha certs renew` 命令手动更新你的证书。 +你能随时通过 `kubeadm certs renew` 命令手动更新你的证书。 `kubeadm certs renew`提供以下选项： @@ -303,10 +311,10 @@ Kubernetes 证书颁发机构不是开箱即用。 要激活内置签名者，请传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。 如果你正在创建一个新的集群，你可以使用 kubeadm 的 -[配置文件](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2)。 +[配置文件](/docs/reference/config-api/kubeadm-config.v1beta2/)。 ```yaml apiVersion: kubeadm.k8s.io/v1beta2 @@ -331,7 +339,7 @@ See [Create CertificateSigningRequest](/docs/reference/access-authn-authz/certif ## 通过外部 CA 更新证书 @@ -349,7 +357,7 @@ CSR 表示向 CA 请求客户的签名证书。 ### 创建证书签名请求 (CSR) -你可以通过 `kubeadm alpha certs renew --csr-only` 命令创建证书签名请求。 +你可以通过 `kubeadm certs renew --csr-only` 命令创建证书签名请求。 CSR 和随附的私钥都在输出中给出。 你可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。 @@ -444,7 +452,7 @@ serverTLSBootstrap: true