152 lines
5.2 KiB
Markdown
152 lines
5.2 KiB
Markdown
|
|
Run this on any machine you wish to join an existing cluster
|
|
|
|
### Synopsis
|
|
|
|
|
|
|
|
When joining a kubeadm initialized cluster, we need to establish
|
|
bidirectional trust. This is split into discovery (having the Node
|
|
trust the Kubernetes Master) and TLS bootstrap (having the Kubernetes
|
|
Master trust the Node).
|
|
|
|
There are 2 main schemes for discovery. The first is to use a shared
|
|
token along with the IP address of the API server. The second is to
|
|
provide a file - a subset of the standard kubeconfig file. This file
|
|
can be a local file or downloaded via an HTTPS URL. The forms are
|
|
kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443,
|
|
kubeadm join --discovery-file path/to/file.conf, or kubeadm join
|
|
--discovery-file https://url/file.conf. Only one form can be used. If
|
|
the discovery information is loaded from a URL, HTTPS must be used.
|
|
Also, in that case the host installed CA bundle is used to verify
|
|
the connection.
|
|
|
|
If you use a shared token for discovery, you should also pass the
|
|
--discovery-token-ca-cert-hash flag to validate the public key of the
|
|
root certificate authority (CA) presented by the Kubernetes Master. The
|
|
value of this flag is specified as "<hash-type>:<hex-encoded-value>",
|
|
where the supported hash type is "sha256". The hash is calculated over
|
|
the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469).
|
|
This value is available in the output of "kubeadm init" or can be
|
|
calcuated using standard tools. The --discovery-token-ca-cert-hash flag
|
|
may be repeated multiple times to allow more than one public key.
|
|
|
|
If you cannot know the CA public key hash ahead of time, you can pass
|
|
the --discovery-token-unsafe-skip-ca-verification flag to disable this
|
|
verification. This weakens the kubeadm security model since other nodes
|
|
can potentially impersonate the Kubernetes Master.
|
|
|
|
The TLS bootstrap mechanism is also driven via a shared token. This is
|
|
used to temporarily authenticate with the Kubernetes Master to submit a
|
|
certificate signing request (CSR) for a locally created key pair. By
|
|
default, kubeadm will set up the Kubernetes Master to automatically
|
|
approve these signing requests. This token is passed in with the
|
|
--tls-bootstrap-token abcdef.1234567890abcdef flag.
|
|
|
|
Often times the same token is used for both parts. In this case, the
|
|
--token flag can be used instead of specifying each token individually.
|
|
|
|
|
|
```
|
|
kubeadm join [flags]
|
|
```
|
|
|
|
### Options
|
|
|
|
<table style="width: 100%;">
|
|
<colgroup>
|
|
<col span="1" style="width: 10px;" />
|
|
<col span="1" />
|
|
</colgroup>
|
|
<tbody>
|
|
|
|
<tr>
|
|
<td colspan="2">--config string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">Path to kubeadm config file.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--cri-socket string Default: "/var/run/dockershim.sock"</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">Specify the CRI socket to connect to.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--discovery-file string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">A file or url from which to load cluster information.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--discovery-token string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">A token used to validate cluster information fetched from the master.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--discovery-token-ca-cert-hash stringSlice</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--discovery-token-unsafe-skip-ca-verification</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--feature-gates string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">A set of key=value pairs that describe feature gates for various features. Options are:<br/>Auditing=true|false (ALPHA - default=false)<br/>CoreDNS=true|false (BETA - default=false)<br/>DynamicKubeletConfig=true|false (ALPHA - default=false)<br/>SelfHosting=true|false (ALPHA - default=false)<br/>StoreCertsInSecrets=true|false (ALPHA - default=false)</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">-h, --help</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">help for join</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--ignore-preflight-errors stringSlice</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--node-name string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">Specify the node name.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--tls-bootstrap-token string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">A token used for TLS bootstrapping.</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td colspan="2">--token string</td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td style="line-height: 130%">Use this token for both discovery-token and tls-bootstrap-token.</td>
|
|
</tr>
|
|
|
|
</tbody>
|
|
</table>
|
|
|
|
|
|
|