|
复制 cat > /etc/kubernetes/cfg/kube-apiserver.conf <<'EOF' KUBE_APISERVER_OPTS="--apiserver-count=3 \ --advertise-address=10.10.107.225 \ --allow-privileged=true \ --authorization-mode=RBAC,Node \ --bind-address=0.0.0.0 \ --enable-aggregator-routing=true \ --enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \ --enable-bootstrap-token-auth=true \ --token-auth-file=/etc/kubernetes/bootstrap-token.csv \ --secure-port=6443 \ --service-node-port-range=30000-32767 \ --service-cluster-ip-range=10.96.0.0/16 \ --client-ca-file=/etc/kubernetes/ssl/ca.pem \ --tls-cert-file=/etc/kubernetes/ssl/apiserver.pem \ --tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem \ --kubelet-client-certificate=/etc/kubernetes/ssl/apiserver.pem \ --kubelet-client-key=/etc/kubernetes/ssl/apiserver-key.pem \ --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname \ --etcd-cafile=/etc/kubernetes/ssl/ca.pem \ --etcd-certfile=/etc/kubernetes/ssl/etcd.pem \ --etcd-keyfile=/etc/kubernetes/ssl/etcd-key.pem \ --etcd-servers=https://10.10.107.225:2379,https://10.10.107.224:2379,https://10.10.107.223:2379 \ --service-account-issuer=https://kubernetes.default.svc.cluster.local \ --service-account-key-file=/etc/kubernetes/ssl/ca-key.pem \ --service-account-signing-key-file=/etc/kubernetes/ssl/ca-key.pem \ --proxy-client-cert-file=/etc/kubernetes/ssl/apiserver.pem \ --proxy-client-key-file=/etc/kubernetes/ssl/apiserver-key.pem \ --requestheader-allowed-names=kubernetes \ --requestheader-extra-headers-prefix=X-Remote-Extra- \ --requestheader-group-headers=X-Remote-Group \ --requestheader-username-headers=X-Remote-User \ --requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \ --v=2 \ --event-ttl=1h \ --feature-gates=TTLAfterFinished=true \ --logtostderr=false \ --log-dir=/var/log/kubernetes" EOF # 审计日志可选 # --audit-log-maxage=30 # --audit-log-maxbackup=3 # --audit-log-maxsize=100 # --audit-log-path=/var/log/kubernetes/kube-apiserver.log" # –logtostderr：启用日志 # —v：日志等级 # –log-dir：日志目录 # –etcd-servers：etcd集群地址 # –bind-address：监听地址 # –secure-port：https安全端口 # –advertise-address：集群通告地址 # –allow-privileged：启用授权 # –service-cluster-ip-range：Service虚拟IP地址段 # –enable-admission-plugins：准入控制模块 # –authorization-mode：认证授权，启用RBAC授权和节点自管理 # –enable-bootstrap-token-auth：启用TLS bootstrap机制 # –token-auth-file：bootstrap token文件 # –service-node-port-range：Service nodeport类型默认分配端口范围 # –kubelet-client-xxx：apiserver访问kubelet客户端证书 # –tls-xxx-file：apiserver https证书 # –etcd-xxxfile：连接Etcd集群证书 # –audit-log-xxx：审计日志 # 温馨提示: 在 1.23.* 版本之后请勿使用如下参数。 Flag --enable-swagger-ui has been deprecated, Flag --insecure-port has been deprecated, Flag --alsologtostderr has been deprecated, Flag --logtostderr has been deprecated, will be removed in a future release, Flag --log-dir has been deprecated, will be removed in a future release, Flag -- TTLAfterFinished=true. It will be removed in a future release. (还可使用) (责任编辑：) |