5.2.4.3. Configuration upload

This section covers uploading the current kubeadm and kubelet configuration to the cluster as a ConfigMap. This configuration is required for the correct execution of the kubeadm join command, as it is used during initialization of new control plane nodes. Uploading the configuration centralizes cluster parameter management and ensures consistency across all nodes, including both master and worker nodes.

Init

Uploading configuration to the cluster

● Required

Note

This section describes the instructions for uploading the current Kubeadm and Kubelet configuration to the Kubernetes control plane as a ConfigMap resource. This approach simplifies managing configuration changes for Kubernetes nodes, covering both worker and master nodes.

HardWay

Environment variables for configuration file template

export CLUSTER_NAME='my-first-cluster'
export BASE_DOMAIN='example.com'
export FULL_HOST_NAME=${HOST_NAME}.${CLUSTER_NAME}.${BASE_DOMAIN}
export INTERNAL_API=api.${CLUSTER_NAME}.${BASE_DOMAIN}
export MACHINE_LOCAL_ADDRESS=$(ip -4 addr show scope global | awk '/inet/ {print $2; exit}' | cut -d/ -f1)
export ETCD_INITIAL_CLUSTER="${FULL_HOST_NAME}=https://${MACHINE_LOCAL_ADDRESS}:2380"
export AUTH_EXTRA_GROUPS="system:bootstrappers:kubeadm:default-node-token"

kubeadm-config

This block is required to allow nodes to read the kubeadm-config ConfigMap in the kube-system namespace:

kubectl \
  --kubeconfig=/etc/kubernetes/super-admin.conf \
  apply -f - <<EOF
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kubeadm:nodes-kubeadm-config
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resourceNames:
  - kubeadm-config
  resources:
  - configmaps
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubeadm:nodes-kubeadm-config
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeadm:nodes-kubeadm-config
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: ${AUTH_EXTRA_GROUPS}
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:nodes
EOF

This block is required so that when executing kubeadm join, the node receives the current ClusterConfiguration from the control cluster and correctly joins the control-plane.

kubectl \
  --kubeconfig=/etc/kubernetes/super-admin.conf \
  apply -f - <<EOF
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kubeadm-config
  namespace: kube-system
data:
  ClusterConfiguration: |
    apiVersion: kubeadm.k8s.io/v1beta3
    kind: ClusterConfiguration
    clusterName: "${CLUSTER_NAME}"
    certificatesDir: /etc/kubernetes/pki
    controlPlaneEndpoint: ${INTERNAL_API}:6443
    imageRepository: "registry.k8s.io"
    networking:
      serviceSubnet: 29.64.0.0/16
      dnsDomain: cluster.local
    kubernetesVersion: v1.30.4
    dns: {}
    etcd:
      local:
        imageRepository: "registry.k8s.io"
        dataDir: "/var/lib/etcd"
        extraArgs:
          auto-compaction-retention: "8"
          cert-file: "/etc/kubernetes/pki/etcd/server.crt"
          client-cert-auth: "true"
          data-dir: "/var/lib/etcd"
          election-timeout: "1500"
          heartbeat-interval: "250"
          key-file: "/etc/kubernetes/pki/etcd/server.key"
          listen-client-urls: "https://0.0.0.0:2379"
          listen-metrics-urls: "http://0.0.0.0:2381"
          listen-peer-urls: "https://0.0.0.0:2380"
          logger: "zap"
          max-snapshots: "10"
          max-wals: "10"
          metrics: "extensive"
          peer-cert-file: "/etc/kubernetes/pki/etcd/peer.crt"
          peer-client-cert-auth: "true"
          peer-key-file: "/etc/kubernetes/pki/etcd/peer.key"
          peer-trusted-ca-file: "/etc/kubernetes/pki/etcd/ca.crt"
          snapshot-count: "10000"
          quota-backend-bytes: "10737418240" # TODO
          experimental-initial-corrupt-check: "true"
          experimental-watch-progress-notify-interval: "5s"
          trusted-ca-file: "/etc/kubernetes/pki/etcd/ca.crt"
        peerCertSANs:
          - 127.0.0.1
        serverCertSANs:
          - 127.0.0.1
    apiServer:
      extraArgs:
        aggregator-reject-forwarding-redirect: "true"
        allow-privileged: "true"
        anonymous-auth: "true"
        api-audiences: "konnectivity-server"
        apiserver-count: "1"
        audit-log-batch-buffer-size: "10000"
        audit-log-batch-max-size: "1"
        audit-log-batch-max-wait: "0s"
        audit-log-batch-throttle-burst: "0"
        audit-log-batch-throttle-enable: "false"
        audit-log-batch-throttle-qps: "0"
        audit-log-compress: "false"
        audit-log-format: "json"
        audit-log-maxage: "30"
        audit-log-maxbackup: "10"
        audit-log-maxsize: "1000"
        audit-log-mode: "batch"
        audit-log-truncate-enabled: "false"
        audit-log-truncate-max-batch-size: "10485760"
        audit-log-truncate-max-event-size: "102400"
        audit-log-version: "audit.k8s.io/v1"
        audit-webhook-batch-buffer-size: "10000"
        audit-webhook-batch-initial-backoff: "10s"
        audit-webhook-batch-max-size: "400"
        audit-webhook-batch-max-wait: "30s"
        audit-webhook-batch-throttle-burst: "15"
        audit-webhook-batch-throttle-enable: "true"
        audit-webhook-batch-throttle-qps: "10"
        audit-webhook-initial-backoff: "10s"
        audit-webhook-mode: "batch"
        audit-webhook-truncate-enabled: "false"
        audit-webhook-truncate-max-batch-size: "10485760"
        audit-webhook-truncate-max-event-size: "102400"
        audit-webhook-version: "audit.k8s.io/v1"
        audit-policy-file: /etc/kubernetes/audit-policy.yaml
        audit-log-path: /var/log/kubernetes/audit/audit.log
        authentication-token-webhook-cache-ttl: "2m0s"
        authentication-token-webhook-version: "v1beta1"
        authorization-mode: "Node,RBAC"
        authorization-webhook-cache-authorized-ttl: "5m0s"
        authorization-webhook-cache-unauthorized-ttl: "30s"
        authorization-webhook-version: "v1beta1"
        bind-address: "0.0.0.0"
        cert-dir: "/var/run/kubernetes"
        client-ca-file: "/etc/kubernetes/pki/ca.crt"
        cloud-provider-gce-l7lb-src-cidrs: "130.211.0.0/22,35.191.0.0/16"
        cloud-provider-gce-lb-src-cidrs: "130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16"
        contention-profiling: "false"
        default-not-ready-toleration-seconds: "300"
        default-unreachable-toleration-seconds: "300"
        default-watch-cache-size: "100"
        delete-collection-workers: "1"
        enable-admission-plugins: "NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,PodSecurity"
        enable-aggregator-routing: "true"
        enable-bootstrap-token-auth: "true"
        enable-garbage-collector: "true"
        enable-logs-handler: "true"
        enable-priority-and-fairness: "true"
        encryption-provider-config-automatic-reload: "false"
        endpoint-reconciler-type: "lease"
        etcd-cafile: "/etc/kubernetes/pki/etcd/ca.crt"
        etcd-certfile: "/etc/kubernetes/pki/apiserver-etcd-client.crt"
        etcd-compaction-interval: "5m0s"
        etcd-count-metric-poll-period: "1m0s"
        etcd-db-metric-poll-interval: "30s"
        etcd-healthcheck-timeout: "2s"
        etcd-keyfile: "/etc/kubernetes/pki/apiserver-etcd-client.key"
        etcd-prefix: "/registry"
        etcd-readycheck-timeout: "2s"
        etcd-servers: "https://127.0.0.1:2379"
        event-ttl: "1h0m0s"
        feature-gates: "RotateKubeletServerCertificate=true"
        goaway-chance: "0"
        help: "false"
        http2-max-streams-per-connection: "0"
        kubelet-client-certificate: "/etc/kubernetes/pki/apiserver-kubelet-client.crt"
        kubelet-client-key: "/etc/kubernetes/pki/apiserver-kubelet-client.key"
        kubelet-port: "10250"
        kubelet-preferred-address-types: "InternalIP,ExternalIP,Hostname"
        kubelet-read-only-port: "10255"
        kubelet-timeout: "5s"
        kubernetes-service-node-port: "0"
        lease-reuse-duration-seconds: "60"
        livez-grace-period: "0s"
        log-flush-frequency: "5s"
        logging-format: "text"
        log-json-info-buffer-size: "0"
        log-json-split-stream: "false"
        log-text-info-buffer-size: "0"
        log-text-split-stream: "false"
        max-connection-bytes-per-sec: "0"
        max-mutating-requests-inflight: "200"
        max-requests-inflight: "400"
        min-request-timeout: "1800"
        permit-address-sharing: "false"
        permit-port-sharing: "false"
        profiling: "false"
        proxy-client-cert-file: "/etc/kubernetes/pki/front-proxy-client.crt"
        proxy-client-key-file: "/etc/kubernetes/pki/front-proxy-client.key"
        requestheader-allowed-names: "front-proxy-client"
        requestheader-client-ca-file: "/etc/kubernetes/pki/front-proxy-ca.crt"
        requestheader-extra-headers-prefix: "X-Remote-Extra-"
        requestheader-group-headers: "X-Remote-Group"
        requestheader-username-headers: "X-Remote-User"
        request-timeout: "1m0s"
        runtime-config: "api/all=true"
        secure-port: "6443"
        service-account-extend-token-expiration: "true"
        service-account-issuer: "https://kubernetes.default.svc.cluster.local"
        service-account-key-file: "/etc/kubernetes/pki/sa.pub"
        service-account-lookup: "true"
        service-account-max-token-expiration: "0s"
        service-account-signing-key-file: "/etc/kubernetes/pki/sa.key"
        service-cluster-ip-range: "29.64.0.0/16"
        service-node-port-range: "30000-32767"
        shutdown-delay-duration: "0s"
        shutdown-send-retry-after: "false"
        shutdown-watch-termination-grace-period: "0s"
        storage-backend: "etcd3"
        storage-media-type: "application/vnd.kubernetes.protobuf"
        tls-cert-file: "/etc/kubernetes/pki/apiserver.crt"
        tls-private-key-file: "/etc/kubernetes/pki/apiserver.key"
        v: "2"
        version: "false"
        watch-cache: "true"
        # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ CLOUD-CONTROLLER-MANAGER
        # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
        # ->
        # cloud-provider: "external"
        # Не указывать если значение "" или undefined
        # cloud-config: ""
        # strict-transport-security-directives: ""
        # disable-admission-plugins: ""
        # disabled-metrics: ""
        # egress-selector-config-file: ""
        # encryption-provider-config: ""
        # etcd-servers-overrides: ""
        # external-hostname: ""
        # kubelet-certificate-authority: ""
        # oidc-ca-file: ""
        # oidc-client-id: ""
        # oidc-groups-claim: ""
        # oidc-groups-prefix: ""
        # oidc-issuer-url: ""
        # oidc-required-claim: ""
        # oidc-signing-algs: "RS256"
        # oidc-username-claim: "sub"
        # oidc-username-prefix: ""
        # peer-advertise-ip: ""
        # peer-advertise-port: ""
        # peer-ca-file: ""
        # service-account-jwks-uri: ""
        # show-hidden-metrics-for-version: ""
        # tls-cipher-suites: ""
        # tls-min-version: ""
        # tls-sni-cert-key: ""
        # token-auth-file: ""
        # tracing-config-file: ""
        # vmodule: ""
        # watch-cache-sizes: ""
        # authorization-webhook-config-file: ""
        # cors-allowed-origins: ""
        # debug-socket-path: ""
        # authorization-policy-file: ""
        # authorization-config: ""
        # authentication-token-webhook-config-file: ""
        # authentication-config: ""
        # audit-webhook-config-file: ""
        # audit-policy-file: "/etc/kubernetes/audit-policy.yaml"
        # audit-log-path: "/var/log/kubernetes/audit/audit.log"
        # allow-metric-labels: ""
        # allow-metric-labels-manifest: ""
        # admission-control: ""
        # admission-control-config-file: ""
        # advertise-address: ""
      extraVolumes:
      - name: "k8s-audit"
        hostPath: "/var/log/kubernetes/audit/"
        mountPath: "/var/log/kubernetes/audit/"
        readOnly: false
        pathType: DirectoryOrCreate
      - name: "k8s-audit-policy"
        hostPath: "/etc/kubernetes/audit-policy.yaml"
        mountPath: "/etc/kubernetes/audit-policy.yaml"
        pathType: File
      certSANs:
        - "127.0.0.1"
        # TODO для доабвления внешнего FQDN в сертификаты кластера
        # - ${INTERNAL_API}
      timeoutForControlPlane: 4m0s
    controllerManager:
      extraArgs:
        cluster-name: "${CLUSTER_NAME}"
        allocate-node-cidrs: "false"
        allow-untagged-cloud: "false"
        attach-detach-reconcile-sync-period: "1m0s"
        authentication-kubeconfig: "/etc/kubernetes/controller-manager.conf"
        authentication-skip-lookup: "false"
        authentication-token-webhook-cache-ttl: "10s"
        authentication-tolerate-lookup-failure: "false"
        authorization-always-allow-paths: "/healthz,/readyz,/livez,/metrics"
        authorization-kubeconfig: "/etc/kubernetes/controller-manager.conf"
        authorization-webhook-cache-authorized-ttl: "10s"
        authorization-webhook-cache-unauthorized-ttl: "10s"
        bind-address: "0.0.0.0"
        cidr-allocator-type: "RangeAllocator"
        client-ca-file: "/etc/kubernetes/pki/ca.crt"
        # -> Включить, если управляете состоянием через Cloud Controller Manager
        # cloud-provider: "external"
        cloud-provider-gce-lb-src-cidrs: "130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16"
        cluster-signing-cert-file: "/etc/kubernetes/pki/ca.crt"
        cluster-signing-duration: "720h0m0s"
        cluster-signing-key-file: "/etc/kubernetes/pki/ca.key"
        concurrent-cron-job-syncs: "5"
        concurrent-deployment-syncs: "5"
        concurrent-endpoint-syncs: "5"
        concurrent-ephemeralvolume-syncs: "5"
        concurrent-gc-syncs: "20"
        concurrent-horizontal-pod-autoscaler-syncs: "5"
        concurrent-job-syncs: "5"
        concurrent-namespace-syncs: "10"
        concurrent-rc-syncs: "5"
        concurrent-replicaset-syncs: "20"
        concurrent-resource-quota-syncs: "5"
        concurrent-service-endpoint-syncs: "5"
        concurrent-service-syncs: "1"
        concurrent-serviceaccount-token-syncs: "5"
        concurrent-statefulset-syncs: "5"
        concurrent-ttl-after-finished-syncs: "5"
        concurrent-validating-admission-policy-status-syncs: "5"
        configure-cloud-routes: "true"
        contention-profiling: "false"
        controller-start-interval: "0s"
        controllers: "*,bootstrapsigner,tokencleaner"
        disable-attach-detach-reconcile-sync: "false"
        disable-force-detach-on-timeout: "false"
        enable-dynamic-provisioning: "true"
        enable-garbage-collector: "true"
        enable-hostpath-provisioner: "false"
        enable-leader-migration: "false"
        endpoint-updates-batch-period: "0s"
        endpointslice-updates-batch-period: "0s"
        feature-gates: "RotateKubeletServerCertificate=true"
        flex-volume-plugin-dir: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"
        help: "false"
        horizontal-pod-autoscaler-cpu-initialization-period: "5m0s"
        horizontal-pod-autoscaler-downscale-delay: "5m0s"
        horizontal-pod-autoscaler-downscale-stabilization: "5m0s"
        horizontal-pod-autoscaler-initial-readiness-delay: "30s"
        horizontal-pod-autoscaler-sync-period: "30s"
        horizontal-pod-autoscaler-tolerance: "0.1"
        horizontal-pod-autoscaler-upscale-delay: "3m0s"
        http2-max-streams-per-connection: "0"
        kube-api-burst: "120"
        kube-api-content-type: "application/vnd.kubernetes.protobuf"
        kube-api-qps: "100"
        kubeconfig: "/etc/kubernetes/controller-manager.conf"
        large-cluster-size-threshold: "50"
        leader-elect: "true"
        leader-elect-lease-duration: "15s"
        leader-elect-renew-deadline: "10s"
        leader-elect-resource-lock: "leases"
        leader-elect-resource-name: "kube-controller-manager"
        leader-elect-resource-namespace: "kube-system"
        leader-elect-retry-period: "2s"
        legacy-service-account-token-clean-up-period: "8760h0m0s"
        log-flush-frequency: "5s"
        log-json-info-buffer-size: "0"
        log-json-split-stream: "false"
        log-text-info-buffer-size: "0"
        log-text-split-stream: "false"
        logging-format: "text"
        max-endpoints-per-slice: "100"
        min-resync-period: "12h0m0s"
        mirroring-concurrent-service-endpoint-syncs: "5"
        mirroring-endpointslice-updates-batch-period: "0s"
        mirroring-max-endpoints-per-subset: "1000"
        namespace-sync-period: "2m0s"
        node-cidr-mask-size: "0"
        node-cidr-mask-size-ipv4: "0"
        node-cidr-mask-size-ipv6: "0"
        node-eviction-rate: "0.1"
        node-monitor-grace-period: "40s"
        node-monitor-period: "5s"
        node-startup-grace-period: "10s"
        node-sync-period: "0s"
        permit-address-sharing: "false"
        permit-port-sharing: "false"
        profiling: "false"
        pv-recycler-increment-timeout-nfs: "30"
        pv-recycler-minimum-timeout-hostpath: "60"
        pv-recycler-minimum-timeout-nfs: "300"
        pv-recycler-timeout-increment-hostpath: "30"
        pvclaimbinder-sync-period: "15s"
        requestheader-client-ca-file: "/etc/kubernetes/pki/front-proxy-ca.crt"
        requestheader-extra-headers-prefix: "x-remote-extra-"
        requestheader-group-headers: "x-remote-group"
        requestheader-username-headers: "x-remote-user"
        resource-quota-sync-period: "5m0s"
        root-ca-file: "/etc/kubernetes/pki/ca.crt"
        route-reconciliation-period: "10s"
        secondary-node-eviction-rate: "0.01"
        secure-port: "10257"
        service-account-private-key-file: "/etc/kubernetes/pki/sa.key"
        terminated-pod-gc-threshold: "0"
        unhealthy-zone-threshold: "0.55"
        use-service-account-credentials: "true"
        v: "2"
        version: "false"
        volume-host-allow-local-loopback: "true"
        # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-CONTROLLER-MANAGER
        # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
        # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
        # ->
        # tls-cert-file=/etc/kubernetes/pki/controller-manager-server.crt
        # tls-private-key-file=/etc/kubernetes/pki/controller-manager-server.key
        # Не указывать если значение "" или undefined
        # cluster-signing-kube-apiserver-client-cert-file: ""
        # cluster-signing-kube-apiserver-client-key-file: ""
        # cluster-signing-kubelet-client-cert-file: ""
        # cluster-signing-kubelet-client-key-file: ""
        # cluster-signing-kubelet-serving-cert-file: ""
        # cluster-signing-kubelet-serving-key-file: ""
        # cluster-signing-legacy-unknown-cert-file: ""
        # cluster-signing-legacy-unknown-key-file: ""
        # cluster-cidr: ""
        # cloud-config: ""
        # cert-dir: ""
        # allow-metric-labels-manifest: ""
        # allow-metric-labels: ""
        # disabled-metrics: ""
        # leader-migration-config: ""
        # master: ""
        # pv-recycler-pod-template-filepath-hostpath: ""
        # pv-recycler-pod-template-filepath-nfs: ""
        # service-cluster-ip-range: ""
        # show-hidden-metrics-for-version: ""
        # tls-cipher-suites: ""
        # tls-min-version: ""
        # tls-sni-cert-key: ""
        # vmodule: ""
        # volume-host-cidr-denylist: ""
        # external-cloud-volume-plugin: ""
        # requestheader-allowed-names: ""
      # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-CONTROLLER-MANAGER
      # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
      # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
      # ->
      # extraVolumes:
      # - name: "controller-manager-crt"
      #   hostPath: "/etc/kubernetes/pki/controller-manager-server.crt"
      #   mountPath: "/etc/kubernetes/pki/controller-manager-server.crt"
      #   pathType: File
      # - name: "controller-manager-key"
      #   hostPath: "/etc/kubernetes/pki/controller-manager-server.key"
      #   mountPath: "/etc/kubernetes/pki/controller-manager-server.key"
      #   pathType: File
    scheduler:
      extraArgs:
        authentication-kubeconfig: "/etc/kubernetes/scheduler.conf"
        authentication-skip-lookup: "false"
        authentication-token-webhook-cache-ttl: "10s"
        authentication-tolerate-lookup-failure: "true"
        authorization-always-allow-paths: "/healthz,/readyz,/livez,/metrics"
        authorization-kubeconfig: "/etc/kubernetes/scheduler.conf"
        authorization-webhook-cache-authorized-ttl: "10s"
        authorization-webhook-cache-unauthorized-ttl: "10s"
        bind-address: "0.0.0.0"
        client-ca-file: ""
        contention-profiling: "true"
        help: "false"
        http2-max-streams-per-connection: "0"
        kube-api-burst: "100"
        kube-api-content-type: "application/vnd.kubernetes.protobuf"
        kube-api-qps: "50"
        kubeconfig: "/etc/kubernetes/scheduler.conf"
        leader-elect: "true"
        leader-elect-lease-duration: "15s"
        leader-elect-renew-deadline: "10s"
        leader-elect-resource-lock: "leases"
        leader-elect-resource-name: "kube-scheduler"
        leader-elect-resource-namespace: "kube-system"
        leader-elect-retry-period: "2s"
        log-flush-frequency: "5s"
        log-json-info-buffer-size: "0"
        log-json-split-stream: "false"
        log-text-info-buffer-size: "0"
        log-text-split-stream: "false"
        logging-format: "text"
        permit-address-sharing: "false"
        permit-port-sharing: "false"
        pod-max-in-unschedulable-pods-duration: "5m0s"
        profiling: "true"
        requestheader-extra-headers-prefix: "[x-remote-extra-]"
        requestheader-group-headers: "[x-remote-group]"
        requestheader-username-headers: "[x-remote-user]"
        secure-port: "10259"
        v: "2"
        version: "false"
        # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-SCHEDULER
        # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
        # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
        # ->
        # tls-cert-file=/etc/kubernetes/pki/scheduler-server.crt
        # tls-private-key-file=/etc/kubernetes/pki/scheduler-server.key
        # <-
        # allow-metric-labels: "[]"
        # allow-metric-labels-manifest: ""
        # cert-dir: ""
        # config: ""
        # disabled-metrics: "[]"
        # feature-gates: ""
        # master: ""
        # requestheader-allowed-names: "[]"
        # requestheader-client-ca-file: ""
        # show-hidden-metrics-for-version: ""
        # tls-cipher-suites: "[]"
        # tls-min-version: ""
        # tls-sni-cert-key: "[]"
        # vmodule: ""
        # write-config-to: ""
      # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-SCHEDULER
      # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
      # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
      # ->
      # extraVolumes:
      # - name: "scheduler-crt"
      #   hostPath: "/etc/kubernetes/pki/scheduler-server.crt"
      #   mountPath: "/etc/kubernetes/pki/scheduler-server.crt"
      #   pathType: File
      # - name: "scheduler-key"
      #   hostPath: "/etc/kubernetes/pki/scheduler-server.key"
      #   mountPath: "/etc/kubernetes/pki/scheduler-server.key"
      #   pathType: File
EOF

kubelet-config

This block is required to allow nodes to read the kubelet-config ConfigMap in the kube-system namespace:

kubectl \
  --kubeconfig=/etc/kubernetes/super-admin.conf \
  apply -f - <<EOF
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kubeadm:kubelet-config
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resourceNames:
  - kubelet-config
  resources:
  - configmaps
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubeadm:kubelet-config
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeadm:kubelet-config
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:nodes
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: ${AUTH_EXTRA_GROUPS}
EOF

This block is required so that when executing kubeadm join, the node receives the current kubelet-config from the control cluster and correctly joins the control-plane.

kubectl \
  --kubeconfig=/etc/kubernetes/super-admin.conf \
  apply -f - <<EOF
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kubelet-config
  namespace: kube-system
data:
  kubelet: |
    apiVersion: kubelet.config.k8s.io/v1beta1
    authentication:
      anonymous:
          enabled: false
      webhook:
          cacheTTL: 0s
          enabled: true
      x509:
        clientCAFile: "/etc/kubernetes/pki/ca.crt"
    authorization:
      mode: Webhook
      webhook:
        cacheAuthorizedTTL: 0s
        cacheUnauthorizedTTL: 0s
    cgroupDriver: systemd
    containerLogMaxSize: "50Mi"
    containerRuntimeEndpoint: "/var/run/containerd/containerd.sock"
    cpuManagerReconcilePeriod: 0s
    evictionPressureTransitionPeriod: 5s
    fileCheckFrequency: 0s
    healthzBindAddress: 127.0.0.1
    healthzPort: 10248
    httpCheckFrequency: 0s
    imageGCHighThresholdPercent: 55
    imageGCLowThresholdPercent: 50
    imageMaximumGCAge: 0s
    imageMinimumGCAge: 0s
    kind: KubeletConfiguration
    logging:
      flushFrequency: 0
      options:
        json:
          infoBufferSize: "0"
        text:
          infoBufferSize: "0"
      verbosity: 0
    kubeAPIQPS: 50
    kubeAPIBurst: 100
    maxPods: 250
    memorySwap: {}
    nodeStatusReportFrequency: 1s
    nodeStatusUpdateFrequency: 1s
    podPidsLimit: 4096
    registerNode: true
    resolvConf: /run/systemd/resolve/resolv.conf
    rotateCertificates: true
    runtimeRequestTimeout: 0s
    serializeImagePulls: false
    serverTLSBootstrap: true
    shutdownGracePeriod: 15s
    shutdownGracePeriodCriticalPods: 5s
    staticPodPath: /etc/kubernetes/manifests
    streamingConnectionIdleTimeout: 0s
    syncFrequency: 0s
    tlsMinVersion: "VersionTLS12"
    volumeStatsAggPeriod: 0s
    featureGates:
      RotateKubeletServerCertificate: true
      APIPriorityAndFairness:         true
    tlsCipherSuites:
      - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
      - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
      - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
EOF

Kubeadm

Configuration update

kubeadm init phase upload-config all \
  --config=/var/run/kubeadm/kubeadm.yaml \
  --kubeconfig=/etc/kubernetes/super-admin.conf

note

[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster

Join

Uploading configuration to the cluster

● Required

When adding a new control plane node (join), configuration upload is performed automatically as part of the kubeadm join phase. The kubeadm and kubelet configuration is read from the existing ConfigMap in the kube-system namespace, which was uploaded during the initialization of the first node.

A separate manual upload-config call is not required during join — kubeadm join independently retrieves the necessary parameters from the cluster.