Skip to main content

Kubeadm Configuration

Component configuration steps

  • Creating working directories.
  • Component configuration
Note

This section depends on the following documents:

Creating working directories

mkdir -p /var/run/kubeadm/

Component configuration

The kubeadm configuration describes InitConfiguration parameters (bootstrap tokens, nodeRegistration, skipPhases) and ClusterConfiguration (controlPlaneEndpoint, network subnets, control plane component arguments). The init tab is used when creating the first node, join — when adding subsequent ones.

Kubeadm Configuration
export HOST_NAME=master-1
Kubeadm configuration for cluster initialization

Environment variables for configuration file template

export CLUSTER_NAME='my-first-cluster'
export BASE_DOMAIN='example.com'
export FULL_HOST_NAME=${HOST_NAME}.${CLUSTER_NAME}.${BASE_DOMAIN}
export INTERNAL_API=api.${CLUSTER_NAME}.${BASE_DOMAIN}
export MACHINE_LOCAL_ADDRESS=$(ip -4 addr show scope global | awk '/inet/ {print $2; exit}' | cut -d/ -f1)
export ETCD_INITIAL_CLUSTER="${FULL_HOST_NAME}=https://${MACHINE_LOCAL_ADDRESS}:2380"
export CERTIFICATE_UPLOAD_KEY=0c00c2fd5c67c37656c00d78a9d7e1f2eb794ef8e4fc3e2a4b532eb14323cd59

Kubeadm configuration file for cluster initialization

warning

Note that in this configuration file the addons installation phase is skipped.

cat <<EOF > /var/run/kubeadm/kubeadm.yaml
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
skipPhases:
  - addon
bootstrapTokens:
  - token: "fjt9ex.lwzqgdlvoxtqk4yw"
    description: "kubeadm bootstrap token"
    ttl: "24h"
certificateKey: ${CERTIFICATE_UPLOAD_KEY}
nodeRegistration:
  imagePullPolicy: IfNotPresent
  taints: null
  kubeletExtraArgs:
    # -> Enable if managing state via Cloud Controller Manager
    # cloud-provider: external
    config: "/var/lib/kubelet/config-custom.yaml"
    cluster-domain: cluster.local
    cluster-dns: "29.64.0.10"
  # name: '${FULL_HOST_NAME}'
  ignorePreflightErrors:
    # > When building the cluster step by step rather than running a single command,
    # > you need to specify exceptions in the ignorePreflightErrors parameter
    # > so that the kubeadm init phase preflight command runs without obstacles.
    # > To do this, the following exceptions are added to nodeRegistration:
    - FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml
    - FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml
    - FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml
    - FileAvailable--etc-kubernetes-manifests-etcd.yaml
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
clusterName: "${CLUSTER_NAME}"
certificatesDir: /etc/kubernetes/pki
controlPlaneEndpoint: ${INTERNAL_API}:6443
imageRepository: "registry.k8s.io"
networking:
  serviceSubnet: 29.64.0.0/16
  dnsDomain: cluster.local
kubernetesVersion: v1.30.4
dns: {}
etcd:
  local:
    imageRepository: "registry.k8s.io"
    dataDir: "/var/lib/etcd"
    extraArgs:
      auto-compaction-retention: "8"
      cert-file: "/etc/kubernetes/pki/etcd/server.crt"
      client-cert-auth: "true"
      data-dir: "/var/lib/etcd"
      election-timeout: "1500"
      heartbeat-interval: "250"
      key-file: "/etc/kubernetes/pki/etcd/server.key"
      listen-client-urls: "https://0.0.0.0:2379"
      listen-metrics-urls: "http://0.0.0.0:2381"
      listen-peer-urls: "https://0.0.0.0:2380"
      logger: "zap"
      max-snapshots: "10"
      max-wals: "10"
      metrics: "extensive"
      peer-cert-file: "/etc/kubernetes/pki/etcd/peer.crt"
      peer-client-cert-auth: "true"
      peer-key-file: "/etc/kubernetes/pki/etcd/peer.key"
      peer-trusted-ca-file: "/etc/kubernetes/pki/etcd/ca.crt"
      snapshot-count: "10000"
      quota-backend-bytes: "10737418240" # TODO
      experimental-initial-corrupt-check: "true"
      experimental-watch-progress-notify-interval: "5s"
      trusted-ca-file: "/etc/kubernetes/pki/etcd/ca.crt"
    peerCertSANs:
      - 127.0.0.1
    serverCertSANs:
      - 127.0.0.1
apiServer:
  extraArgs:
    aggregator-reject-forwarding-redirect: "true"
    allow-privileged: "true"
    anonymous-auth: "true"
    api-audiences: "konnectivity-server"
    apiserver-count: "1"
    audit-log-batch-buffer-size: "10000"
    audit-log-batch-max-size: "1"
    audit-log-batch-max-wait: "0s"
    audit-log-batch-throttle-burst: "0"
    audit-log-batch-throttle-enable: "false"
    audit-log-batch-throttle-qps: "0"
    audit-log-compress: "false"
    audit-log-format: "json"
    audit-log-maxage: "30"
    audit-log-maxbackup: "10"
    audit-log-maxsize: "1000"
    audit-log-mode: "batch"
    audit-log-truncate-enabled: "false"
    audit-log-truncate-max-batch-size: "10485760"
    audit-log-truncate-max-event-size: "102400"
    audit-log-version: "audit.k8s.io/v1"
    audit-webhook-batch-buffer-size: "10000"
    audit-webhook-batch-initial-backoff: "10s"
    audit-webhook-batch-max-size: "400"
    audit-webhook-batch-max-wait: "30s"
    audit-webhook-batch-throttle-burst: "15"
    audit-webhook-batch-throttle-enable: "true"
    audit-webhook-batch-throttle-qps: "10"
    audit-webhook-initial-backoff: "10s"
    audit-webhook-mode: "batch"
    audit-webhook-truncate-enabled: "false"
    audit-webhook-truncate-max-batch-size: "10485760"
    audit-webhook-truncate-max-event-size: "102400"
    audit-webhook-version: "audit.k8s.io/v1"
    audit-policy-file: /etc/kubernetes/audit-policy.yaml
    audit-log-path: /var/log/kubernetes/audit/audit.log
    authentication-token-webhook-cache-ttl: "2m0s"
    authentication-token-webhook-version: "v1beta1"
    authorization-mode: "Node,RBAC"
    authorization-webhook-cache-authorized-ttl: "5m0s"
    authorization-webhook-cache-unauthorized-ttl: "30s"
    authorization-webhook-version: "v1beta1"
    bind-address: "0.0.0.0"
    cert-dir: "/var/run/kubernetes"
    client-ca-file: "/etc/kubernetes/pki/ca.crt"
    cloud-provider-gce-l7lb-src-cidrs: "130.211.0.0/22,35.191.0.0/16"
    cloud-provider-gce-lb-src-cidrs: "130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16"
    contention-profiling: "false"
    default-not-ready-toleration-seconds: "300"
    default-unreachable-toleration-seconds: "300"
    default-watch-cache-size: "100"
    delete-collection-workers: "1"
    enable-admission-plugins: "NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,PodSecurity"
    enable-aggregator-routing: "true"
    enable-bootstrap-token-auth: "true"
    enable-garbage-collector: "true"
    enable-logs-handler: "true"
    enable-priority-and-fairness: "true"
    encryption-provider-config-automatic-reload: "false"
    endpoint-reconciler-type: "lease"
    etcd-cafile: "/etc/kubernetes/pki/etcd/ca.crt"
    etcd-certfile: "/etc/kubernetes/pki/apiserver-etcd-client.crt"
    etcd-compaction-interval: "5m0s"
    etcd-count-metric-poll-period: "1m0s"
    etcd-db-metric-poll-interval: "30s"
    etcd-healthcheck-timeout: "2s"
    etcd-keyfile: "/etc/kubernetes/pki/apiserver-etcd-client.key"
    etcd-prefix: "/registry"
    etcd-readycheck-timeout: "2s"
    etcd-servers: "https://127.0.0.1:2379"
    event-ttl: "1h0m0s"
    feature-gates: "RotateKubeletServerCertificate=true"
    goaway-chance: "0"
    help: "false"
    http2-max-streams-per-connection: "0"
    kubelet-client-certificate: "/etc/kubernetes/pki/apiserver-kubelet-client.crt"
    kubelet-client-key: "/etc/kubernetes/pki/apiserver-kubelet-client.key"
    kubelet-port: "10250"
    kubelet-preferred-address-types: "InternalIP,ExternalIP,Hostname"
    kubelet-read-only-port: "10255"
    kubelet-timeout: "5s"
    kubernetes-service-node-port: "0"
    lease-reuse-duration-seconds: "60"
    livez-grace-period: "0s"
    log-flush-frequency: "5s"
    logging-format: "text"
    log-json-info-buffer-size: "0"
    log-json-split-stream: "false"
    log-text-info-buffer-size: "0"
    log-text-split-stream: "false"
    max-connection-bytes-per-sec: "0"
    max-mutating-requests-inflight: "200"
    max-requests-inflight: "400"
    min-request-timeout: "1800"
    permit-address-sharing: "false"
    permit-port-sharing: "false"
    profiling: "false"
    proxy-client-cert-file: "/etc/kubernetes/pki/front-proxy-client.crt"
    proxy-client-key-file: "/etc/kubernetes/pki/front-proxy-client.key"
    requestheader-allowed-names: "front-proxy-client"
    requestheader-client-ca-file: "/etc/kubernetes/pki/front-proxy-ca.crt"
    requestheader-extra-headers-prefix: "X-Remote-Extra-"
    requestheader-group-headers: "X-Remote-Group"
    requestheader-username-headers: "X-Remote-User"
    request-timeout: "1m0s"
    runtime-config: "api/all=true"
    secure-port: "6443"
    service-account-extend-token-expiration: "true"
    service-account-issuer: "https://kubernetes.default.svc.cluster.local"
    service-account-key-file: "/etc/kubernetes/pki/sa.pub"
    service-account-lookup: "true"
    service-account-max-token-expiration: "0s"
    service-account-signing-key-file: "/etc/kubernetes/pki/sa.key"
    service-cluster-ip-range: "29.64.0.0/16"
    service-node-port-range: "30000-32767"
    shutdown-delay-duration: "0s"
    shutdown-send-retry-after: "false"
    shutdown-watch-termination-grace-period: "0s"
    storage-backend: "etcd3"
    storage-media-type: "application/vnd.kubernetes.protobuf"
    tls-cert-file: "/etc/kubernetes/pki/apiserver.crt"
    tls-private-key-file: "/etc/kubernetes/pki/apiserver.key"
    v: "2"
    version: "false"
    watch-cache: "true"
    # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ CLOUD-CONTROLLER-MANAGER
    # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
    # ->
    # cloud-provider: "external"
    # Не указывать если значение "" или undefined
    # cloud-config: ""
    # strict-transport-security-directives: ""
    # disable-admission-plugins: ""
    # disabled-metrics: ""
    # egress-selector-config-file: ""
    # encryption-provider-config: ""
    # etcd-servers-overrides: ""
    # external-hostname: ""
    # kubelet-certificate-authority: ""
    # oidc-ca-file: ""
    # oidc-client-id: ""
    # oidc-groups-claim: ""
    # oidc-groups-prefix: ""
    # oidc-issuer-url: ""
    # oidc-required-claim: ""
    # oidc-signing-algs: "RS256"
    # oidc-username-claim: "sub"
    # oidc-username-prefix: ""
    # peer-advertise-ip: ""
    # peer-advertise-port: ""
    # peer-ca-file: ""
    # service-account-jwks-uri: ""
    # show-hidden-metrics-for-version: ""
    # tls-cipher-suites: ""
    # tls-min-version: ""
    # tls-sni-cert-key: ""
    # token-auth-file: ""
    # tracing-config-file: ""
    # vmodule: ""
    # watch-cache-sizes: ""
    # authorization-webhook-config-file: ""
    # cors-allowed-origins: ""
    # debug-socket-path: ""
    # authorization-policy-file: ""
    # authorization-config: ""
    # authentication-token-webhook-config-file: ""
    # authentication-config: ""
    # audit-webhook-config-file: ""
    # audit-policy-file: "/etc/kubernetes/audit-policy.yaml"
    # audit-log-path: "/var/log/kubernetes/audit/audit.log"
    # allow-metric-labels: ""
    # allow-metric-labels-manifest: ""
    # admission-control: ""
    # admission-control-config-file: ""
    # advertise-address: ""
  extraVolumes:
  - name: "k8s-audit"
    hostPath: "/var/log/kubernetes/audit/"
    mountPath: "/var/log/kubernetes/audit/"
    readOnly: false
    pathType: DirectoryOrCreate
  - name: "k8s-audit-policy"
    hostPath: "/etc/kubernetes/audit-policy.yaml"
    mountPath: "/etc/kubernetes/audit-policy.yaml"
    pathType: File
  certSANs:
    - "127.0.0.1"
    # TODO для доабвления внешнего FQDN в сертификаты кластера
    # - ${INTERNAL_API}
  timeoutForControlPlane: 4m0s
controllerManager:
  extraArgs:
    cluster-name: "${CLUSTER_NAME}"
    allocate-node-cidrs: "false"
    allow-untagged-cloud: "false"
    attach-detach-reconcile-sync-period: "1m0s"
    authentication-kubeconfig: "/etc/kubernetes/controller-manager.conf"
    authentication-skip-lookup: "false"
    authentication-token-webhook-cache-ttl: "10s"
    authentication-tolerate-lookup-failure: "false"
    authorization-always-allow-paths: "/healthz,/readyz,/livez,/metrics"
    authorization-kubeconfig: "/etc/kubernetes/controller-manager.conf"
    authorization-webhook-cache-authorized-ttl: "10s"
    authorization-webhook-cache-unauthorized-ttl: "10s"
    bind-address: "0.0.0.0"
    cidr-allocator-type: "RangeAllocator"
    client-ca-file: "/etc/kubernetes/pki/ca.crt"
    # -> Включить, если управляете состоянием через Cloud Controller Manager
    # cloud-provider: "external"
    cloud-provider-gce-lb-src-cidrs: "130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16"
    cluster-signing-cert-file: "/etc/kubernetes/pki/ca.crt"
    cluster-signing-duration: "720h0m0s"
    cluster-signing-key-file: "/etc/kubernetes/pki/ca.key"
    concurrent-cron-job-syncs: "5"
    concurrent-deployment-syncs: "5"
    concurrent-endpoint-syncs: "5"
    concurrent-ephemeralvolume-syncs: "5"
    concurrent-gc-syncs: "20"
    concurrent-horizontal-pod-autoscaler-syncs: "5"
    concurrent-job-syncs: "5"
    concurrent-namespace-syncs: "10"
    concurrent-rc-syncs: "5"
    concurrent-replicaset-syncs: "20"
    concurrent-resource-quota-syncs: "5"
    concurrent-service-endpoint-syncs: "5"
    concurrent-service-syncs: "1"
    concurrent-serviceaccount-token-syncs: "5"
    concurrent-statefulset-syncs: "5"
    concurrent-ttl-after-finished-syncs: "5"
    concurrent-validating-admission-policy-status-syncs: "5"
    configure-cloud-routes: "true"
    contention-profiling: "false"
    controller-start-interval: "0s"
    controllers: "*,bootstrapsigner,tokencleaner"
    disable-attach-detach-reconcile-sync: "false"
    disable-force-detach-on-timeout: "false"
    enable-dynamic-provisioning: "true"
    enable-garbage-collector: "true"
    enable-hostpath-provisioner: "false"
    enable-leader-migration: "false"
    endpoint-updates-batch-period: "0s"
    endpointslice-updates-batch-period: "0s"
    feature-gates: "RotateKubeletServerCertificate=true"
    flex-volume-plugin-dir: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"
    help: "false"
    horizontal-pod-autoscaler-cpu-initialization-period: "5m0s"
    horizontal-pod-autoscaler-downscale-delay: "5m0s"
    horizontal-pod-autoscaler-downscale-stabilization: "5m0s"
    horizontal-pod-autoscaler-initial-readiness-delay: "30s"
    horizontal-pod-autoscaler-sync-period: "30s"
    horizontal-pod-autoscaler-tolerance: "0.1"
    horizontal-pod-autoscaler-upscale-delay: "3m0s"
    http2-max-streams-per-connection: "0"
    kube-api-burst: "120"
    kube-api-content-type: "application/vnd.kubernetes.protobuf"
    kube-api-qps: "100"
    kubeconfig: "/etc/kubernetes/controller-manager.conf"
    large-cluster-size-threshold: "50"
    leader-elect: "true"
    leader-elect-lease-duration: "15s"
    leader-elect-renew-deadline: "10s"
    leader-elect-resource-lock: "leases"
    leader-elect-resource-name: "kube-controller-manager"
    leader-elect-resource-namespace: "kube-system"
    leader-elect-retry-period: "2s"
    legacy-service-account-token-clean-up-period: "8760h0m0s"
    log-flush-frequency: "5s"
    log-json-info-buffer-size: "0"
    log-json-split-stream: "false"
    log-text-info-buffer-size: "0"
    log-text-split-stream: "false"
    logging-format: "text"
    max-endpoints-per-slice: "100"
    min-resync-period: "12h0m0s"
    mirroring-concurrent-service-endpoint-syncs: "5"
    mirroring-endpointslice-updates-batch-period: "0s"
    mirroring-max-endpoints-per-subset: "1000"
    namespace-sync-period: "2m0s"
    node-cidr-mask-size: "0"
    node-cidr-mask-size-ipv4: "0"
    node-cidr-mask-size-ipv6: "0"
    node-eviction-rate: "0.1"
    node-monitor-grace-period: "40s"
    node-monitor-period: "5s"
    node-startup-grace-period: "10s"
    node-sync-period: "0s"
    permit-address-sharing: "false"
    permit-port-sharing: "false"
    profiling: "false"
    pv-recycler-increment-timeout-nfs: "30"
    pv-recycler-minimum-timeout-hostpath: "60"
    pv-recycler-minimum-timeout-nfs: "300"
    pv-recycler-timeout-increment-hostpath: "30"
    pvclaimbinder-sync-period: "15s"
    requestheader-client-ca-file: "/etc/kubernetes/pki/front-proxy-ca.crt"
    requestheader-extra-headers-prefix: "x-remote-extra-"
    requestheader-group-headers: "x-remote-group"
    requestheader-username-headers: "x-remote-user"
    resource-quota-sync-period: "5m0s"
    root-ca-file: "/etc/kubernetes/pki/ca.crt"
    route-reconciliation-period: "10s"
    secondary-node-eviction-rate: "0.01"
    secure-port: "10257"
    service-account-private-key-file: "/etc/kubernetes/pki/sa.key"
    terminated-pod-gc-threshold: "0"
    unhealthy-zone-threshold: "0.55"
    use-service-account-credentials: "true"
    v: "2"
    version: "false"
    volume-host-allow-local-loopback: "true"
    # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-CONTROLLER-MANAGER
    # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
    # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
    # ->
    # tls-cert-file=/etc/kubernetes/pki/controller-manager-server.crt
    # tls-private-key-file=/etc/kubernetes/pki/controller-manager-server.key
    # Не указывать если значение "" или undefined
    # cluster-signing-kube-apiserver-client-cert-file: ""
    # cluster-signing-kube-apiserver-client-key-file: ""
    # cluster-signing-kubelet-client-cert-file: ""
    # cluster-signing-kubelet-client-key-file: ""
    # cluster-signing-kubelet-serving-cert-file: ""
    # cluster-signing-kubelet-serving-key-file: ""
    # cluster-signing-legacy-unknown-cert-file: ""
    # cluster-signing-legacy-unknown-key-file: ""
    # cluster-cidr: ""
    # cloud-config: ""
    # cert-dir: ""
    # allow-metric-labels-manifest: ""
    # allow-metric-labels: ""
    # disabled-metrics: ""
    # leader-migration-config: ""
    # master: ""
    # pv-recycler-pod-template-filepath-hostpath: ""
    # pv-recycler-pod-template-filepath-nfs: ""
    # service-cluster-ip-range: ""
    # show-hidden-metrics-for-version: ""
    # tls-cipher-suites: ""
    # tls-min-version: ""
    # tls-sni-cert-key: ""
    # vmodule: ""
    # volume-host-cidr-denylist: ""
    # external-cloud-volume-plugin: ""
    # requestheader-allowed-names: ""
  # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-CONTROLLER-MANAGER
  # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
  # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
  # ->
  # extraVolumes:
  # - name: "controller-manager-crt"
  #   hostPath: "/etc/kubernetes/pki/controller-manager-server.crt"
  #   mountPath: "/etc/kubernetes/pki/controller-manager-server.crt"
  #   pathType: File
  # - name: "controller-manager-key"
  #   hostPath: "/etc/kubernetes/pki/controller-manager-server.key"
  #   mountPath: "/etc/kubernetes/pki/controller-manager-server.key"
  #   pathType: File
scheduler:
  extraArgs:
    authentication-kubeconfig: "/etc/kubernetes/scheduler.conf"
    authentication-skip-lookup: "false"
    authentication-token-webhook-cache-ttl: "10s"
    authentication-tolerate-lookup-failure: "true"
    authorization-always-allow-paths: "/healthz,/readyz,/livez,/metrics"
    authorization-kubeconfig: "/etc/kubernetes/scheduler.conf"
    authorization-webhook-cache-authorized-ttl: "10s"
    authorization-webhook-cache-unauthorized-ttl: "10s"
    bind-address: "0.0.0.0"
    client-ca-file: ""
    contention-profiling: "true"
    help: "false"
    http2-max-streams-per-connection: "0"
    kube-api-burst: "100"
    kube-api-content-type: "application/vnd.kubernetes.protobuf"
    kube-api-qps: "50"
    kubeconfig: "/etc/kubernetes/scheduler.conf"
    leader-elect: "true"
    leader-elect-lease-duration: "15s"
    leader-elect-renew-deadline: "10s"
    leader-elect-resource-lock: "leases"
    leader-elect-resource-name: "kube-scheduler"
    leader-elect-resource-namespace: "kube-system"
    leader-elect-retry-period: "2s"
    log-flush-frequency: "5s"
    log-json-info-buffer-size: "0"
    log-json-split-stream: "false"
    log-text-info-buffer-size: "0"
    log-text-split-stream: "false"
    logging-format: "text"
    permit-address-sharing: "false"
    permit-port-sharing: "false"
    pod-max-in-unschedulable-pods-duration: "5m0s"
    profiling: "true"
    requestheader-extra-headers-prefix: "[x-remote-extra-]"
    requestheader-group-headers: "[x-remote-group]"
    requestheader-username-headers: "[x-remote-user]"
    secure-port: "10259"
    v: "2"
    version: "false"
    # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-SCHEDULER
    # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
    # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
    # ->
    # tls-cert-file=/etc/kubernetes/pki/scheduler-server.crt
    # tls-private-key-file=/etc/kubernetes/pki/scheduler-server.key
    # <-
    # allow-metric-labels: "[]"
    # allow-metric-labels-manifest: ""
    # cert-dir: ""
    # config: ""
    # disabled-metrics: "[]"
    # feature-gates: ""
    # master: ""
    # requestheader-allowed-names: "[]"
    # requestheader-client-ca-file: ""
    # show-hidden-metrics-for-version: ""
    # tls-cipher-suites: "[]"
    # tls-min-version: ""
    # tls-sni-cert-key: "[]"
    # vmodule: ""
    # write-config-to: ""
  # ЕСЛИ НУЖНО ПОДКЛЮЧИТЬ СЕРВЕРНЫЕ СЕРТИФИКАТЫ ДЛЯ KUBE-SCHEDULER
  # ОБРАТИТЕ ВНИМАНИЕ, ЧТО KUBEADM НЕ СОЗДАЕТ ДАННЫЕ СЕРТИФИКАТЫ
  # ТРЕБУЕТСЯ РАСКОМЕНТИРОВАТЬ
  # ->
  # extraVolumes:
  # - name: "scheduler-crt"
  #   hostPath: "/etc/kubernetes/pki/scheduler-server.crt"
  #   mountPath: "/etc/kubernetes/pki/scheduler-server.crt"
  #   pathType: File
  # - name: "scheduler-key"
  #   hostPath: "/etc/kubernetes/pki/scheduler-server.key"
  #   mountPath: "/etc/kubernetes/pki/scheduler-server.key"
  #   pathType: File
EOF