feat: support Kubernetes 1.20.11
This commit is contained in:
parent
49c82e5a90
commit
29088aa4bb
|
|
@ -0,0 +1,54 @@
|
|||
# kubeadm
|
||||
|
||||
 
|
||||
|
||||
KubeZero Kubeadm golden config
|
||||
|
||||
**Homepage:** <https://kubezero.com>
|
||||
|
||||
## Maintainers
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| Quarky9 | | |
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>= 1.18.0`
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| api.allEtcdEndpoints | string | `""` | |
|
||||
| api.apiAudiences | string | `"istio-ca"` | |
|
||||
| api.endpoint | string | `"kube-api.changeme.org:6443"` | |
|
||||
| api.extraArgs | object | `{}` | |
|
||||
| api.listenPort | int | `6443` | |
|
||||
| api.serviceAccountIssuer | string | `""` | |
|
||||
| clusterName | string | `"pleasechangeme"` | |
|
||||
| domain | string | `"changeme.org"` | |
|
||||
| etcd.extraArgs | object | `{}` | |
|
||||
| etcd.nodeName | string | `"set_via_cmdline"` | |
|
||||
| highAvailable | bool | `false` | |
|
||||
| kubeAdminRole | string | `"arn:aws:iam::000000000000:role/KubernetesNode"` | |
|
||||
| listenAddress | string | `"0.0.0.0"` | |
|
||||
| platform | string | `"aws"` | |
|
||||
| protectKernelDefaults | bool | `true` | |
|
||||
| systemd | bool | `true` | |
|
||||
| workerNodeRole | string | `"arn:aws:iam::000000000000:role/KubernetesNode"` | |
|
||||
|
||||
## Resources
|
||||
|
||||
- https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/
|
||||
- https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2
|
||||
- https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3
|
||||
- https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/kubelet/config/v1beta1/types.go
|
||||
- https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/control-plane-flags/
|
||||
- https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration
|
||||
|
||||
- https://github.com/awslabs/amazon-eks-ami
|
||||
|
||||
### Etcd
|
||||
- https://itnext.io/breaking-down-and-fixing-etcd-cluster-d81e35b9260d
|
||||
|
||||
|
|
@ -15,14 +15,6 @@
|
|||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
## Changes for 1.19
|
||||
|
||||
### Logging to json of control plane components
|
||||
- https://github.com/kubernetes/website/blob/dev-1.19/content/en/docs/concepts/cluster-administration/system-logs.md
|
||||
|
||||
### PodTopologySpread
|
||||
- https://kubernetes.io/blog/2020/05/introducing-podtopologyspread/#podtopologyspread-defaults
|
||||
|
||||
## Resources
|
||||
|
||||
- https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/
|
||||
|
|
|
|||
|
|
@ -62,13 +62,13 @@ apiServer:
|
|||
bind-address: {{ .Values.listenAddress }}
|
||||
tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
|
||||
admission-control-config-file: /etc/kubernetes/apiserver/admission-configuration.yaml
|
||||
api-audiences: {{ .Values.api.apiAudiences }}
|
||||
{{- if .Values.api.serviceAccountIssuer }}
|
||||
service-account-issuer: "{{ .Values.api.serviceAccountIssuer }}"
|
||||
service-account-jwks-uri: "{{ .Values.api.serviceAccountIssuer }}/openid/v1/jwks"
|
||||
{{- end }}
|
||||
{{- if eq .Values.platform "aws" }}
|
||||
service-account-issuer: "{{ .Values.serviceAccountIssuer }}"
|
||||
service-account-jwks-uri: "{{ .Values.serviceAccountIssuer }}/openid/v1/jwks"
|
||||
api-audiences: "istio-ca,sts.amazonaws.com"
|
||||
authentication-token-webhook-config-file: /etc/kubernetes/apiserver/aws-iam-authenticator.yaml
|
||||
{{- else }}
|
||||
api-audiences: "istio-ca"
|
||||
{{- end }}
|
||||
feature-gates: {{ include "kubeadm.featuregates" ( dict "return" "csv" "platform" .Values.platform ) | trimSuffix "," | quote }}
|
||||
# for 1.21
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
# This is for controllers only, workers dont use kubeadm
|
||||
apiVersion: kubeadm.k8s.io/v1beta2
|
||||
kind: JoinConfiguration
|
||||
discovery:
|
||||
|
|
@ -5,7 +6,7 @@ discovery:
|
|||
kubeConfigPath: /root/.kube/config
|
||||
controlPlane:
|
||||
localAPIEndpoint:
|
||||
advertiseAddress: {{ .Values.serviceIp }}
|
||||
advertiseAddress: {{ .Values.listenAddress }}
|
||||
bindPort: {{ .Values.api.listenPort }}
|
||||
nodeRegistration:
|
||||
ignorePreflightErrors:
|
||||
|
|
|
|||
|
|
@ -2,5 +2,6 @@ apiVersion: kubeproxy.config.k8s.io/v1alpha1
|
|||
kind: KubeProxyConfiguration
|
||||
metadata:
|
||||
name: kubezero-kubeproxyconfiguration
|
||||
# kube-proxy doesnt really support setting dynamic bind-address via config, replaced by cilium long-term anyways
|
||||
metricsBindAddress: "0.0.0.0:10249"
|
||||
mode: ""
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if eq .Values.platform "aws" }}
|
||||
{{- if .Values.api.serviceAccountIssuer }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,20 +1,22 @@
|
|||
clusterName: pleasechangeme
|
||||
domain: changeme.org
|
||||
|
||||
serviceIp: set_via_cmdline
|
||||
# Needs to be set to primary node IP
|
||||
listenAddress: 0.0.0.0
|
||||
|
||||
api:
|
||||
endpoint: kube-api.changeme.org:6443
|
||||
listenPort: 6443
|
||||
allEtcdEndpoints: ""
|
||||
extraArgs: {}
|
||||
serviceAccountIssuer: ""
|
||||
apiAudiences: "istio-ca"
|
||||
|
||||
etcd:
|
||||
nodeName: set_via_cmdline
|
||||
extraArgs: {}
|
||||
|
||||
highAvailable: false
|
||||
listenAddress: 0.0.0.0
|
||||
|
||||
# supported values aws,bare-metal
|
||||
platform: "aws"
|
||||
|
|
|
|||
Loading…
Reference in New Issue