概览
本文档介绍如何在 GKE on VMware 的每个节点上部署特权 DaemonSet,从而修改 kubelet 参数以停用只读端口。
前提条件
在运行以下补丁脚本之前,请确保您的 GKE on VMware 健康状况良好。此解决方案可用于修补管理员集群和用户集群。它应该适用于所有 GKE on VMware 版本。
将以下 Daemonset YAML 保存到您的本地文件(例如 patch.yaml)
apiVersion: apps/v1 kind: DaemonSet metadata: name: onprem-node-patcher namespace: kube-system spec: selector: matchLabels: name: onprem-node-patcher updateStrategy: type: RollingUpdate template: metadata: labels: name: onprem-node-patcher spec: tolerations: - operator: Exists volumes: - name: host hostPath: path: / hostPID: true initContainers: - name: read-only-patcher image: "ubuntu" env: - name: KUBELET_READONLY_PORT value: "0" # Number of 1G hugepages. Update the value as desired. command: - /bin/bash - -c - | set -xeuo pipefail configfile="/host/var/lib/kubelet/config.yaml" kubeletservice="/host/etc/systemd/system/kubelet.service" # $1: The read-only port for the kubelet to serve on with no # authentication/authorization (set to 0 to disable) function set-readonly-port-in-config() { [[ "$#" -eq 1 ]] || return local readonlyport; readonlyport="$1" local actual; actual="$(grep readOnlyPort "${configfile}")" if [[ "${actual}" == "" ]]; then echo "readOnlyPort: ${readonlyport}" >> "${configfile}" else sed -E -i 's/readOnlyPort: [0-9]+/readOnlyPort: 0/g' ${configfile} fi echo "Successfully append readOnlyPort: ${readonlyport} to ${configfile}" } sed -E -i 's/--read-only-port=[0-9]+/--read-only-port='"${KUBELET_READONLY_PORT}"'/g' ${kubeletservice} [[ -f ${configfile} ]] && set-readonly-port-in-config "${KUBELET_READONLY_PORT}" echo "Restarting kubelet..." chroot /host nsenter -a -t1 -- systemctl daemon-reload chroot /host nsenter -a -t1 -- systemctl restart kubelet.service echo "Success!" volumeMounts: - name: host mountPath: /host resources: requests: memory: 5Mi cpu: 5m securityContext: privileged: true containers: - image: gcr.io/google-containers/pause:3.2 name: pause # Ensures that the pods will only run on the nodes having the correct # label. nodeSelector: "kubernetes.io/os": "linux"
在管理员集群上修补
kubectl apply -f patch.yaml \ --kubeconfig ADMIN_CLUSTER_KUBECONFIG
在用户集群上修补
kubectl apply -f patch.yaml \ --kubeconfig USER_CLUSTER_KUBECONFIG
恢复
如需重新启用只读端口,请手动修改 Daemonset YAML 中的环境变量
KUBELET_READONLY_PORT
。保存更改后,系统将重新运行 daemonSet 以相应地修改 kubelet。
注意事项
此补丁的生命周期与已安装的第三方应用的生命周期相同。您可以随时将它作为投产后运维运行。但在重新创建集群后,它可能不会保留。如需保持此更改不变,请在 GKE on VMware 初始化后操作中部署此 DaemonSet。
运行一次后,kubelet 配置文件应修改并重新加载。您可以安全地运行
kubectl delete -f patch.yaml
以清理 daemonset 资源。在 Windows 上运行的 Anthos 目前不支持此补丁。
1.13 及更早版本的集群的以下指标丢失: