如何在 Rancher kubernetes 中启用资源 EphemeralContainers

Question

我想根据此链接https://www.shogan.co.uk/kubernetes/enabling-and-using-ephemeral-containers-on-kubernetes-1-16/ 中给出的步骤在以下文件中设置 --feature-gates=EphemeralContainers=true 来启用 EphemeralContainers

• /etc/kubernetes/manifests/kube-apiserver.yaml
• /etc/kubernetes/manifests/kube-scheduler.yaml

但是 etc/kubernetes 下没有这样的文件，Kubernetes 是通过 Rancher 设置的。 任何想法我可以在 Rancher k8 中设置值

Answer 1

您需要通过编辑cluster.yml 传递extra_args。

这是一个示例 sn-p：

services:
    kube-api:
      service_node_port_range: 30000-32767
      pod_security_policy: false
      extra_args:
        feature-gates: "EphemeralContainers=true"
    kube-scheduler:
      extra_args:
        feature-gates: "EphemeralContainers=true"

参考：

• https://rancher.com/docs/rke/latest/en/example-yamls/

Answer 2

Rancher 可能有类似的设置。尝试使用您自己的集群。 对于裸机 kubernetes，请将参数 EphemeralContainers=true 添加到标记 --feature-gates 以用于 kube-apiserver/kube-scheduler/kubelet

您可能需要更改以下配置文件

在每个节点上，cat /var/lib/kubelet/kubeadm-flags.env

KUBELET_KUBEADM_ARGS="--cgroup-driver=systemd --network-plugin=cni --pod-infra-container-image=k8s.gcr.io/pause:3.1 --feature-gates=EphemeralContainers=true"

在主节点上： cat /etc/kubernetes/manifests/kube-apiserver.yaml

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=10.252.90.44
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --feature-gates=TTLAfterFinished=true,EphemeralContainers=true #change me
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    - --cors-allowed-origins=http://localhost:3000,http://127.0.0.1:3000
    image: k8s.gcr.io/kube-apiserver:v1.16.0
    imagePullPolicy: IfNotPresent
    ...

和cat /etc/kubernetes/manifests/kube-scheduler.yaml

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-scheduler
    tier: control-plane
  name: kube-scheduler
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-scheduler
    - --authentication-kubeconfig=/etc/kubernetes/scheduler.conf
    - --authorization-kubeconfig=/etc/kubernetes/scheduler.conf
    - --bind-address=127.0.0.1
    - --feature-gates=TTLAfterFinished=true,EphemeralContainers=true #change me
    - --kubeconfig=/etc/kubernetes/scheduler.conf
    - --leader-elect=true
    image: k8s.gcr.io/kube-scheduler:v1.16.0
    imagePullPolicy: IfNotPresent
    ...