kubeadm init --token=xyz 还是 kubeadm init --token xyz？

Question

问题

kubeadm init --token 的哪种格式是正确的？

(2/4) Initializing your master 显示“--token xyz”。

kubeadm join --token <token> <master-ip>:<master-port> --discovery-token-ca-cert-hash sha256:<hash>

kubeadm init 显示“--token=xyz”。

kubeadm join --token=abcdef.1234567890abcdef --discovery-token-ca-cert-hash sha256:1234..cdef 192.168.1.1:6443

执行日志（使用 Ansible）显示了多条错误信息。请问是不是跟格式有关

changed: [192.168.99.12] => {...
  "[kubeadm] WARNING: kubeadm is in beta, please do not use it for production clusters.",
  "[preflight] Running pre-flight checks",
  "[preflight] Starting the kubelet service",
  "[discovery] Trying to connect to API Server \"192.168.99.10:6443\"",
  "[discovery] Created cluster-info discovery client, requesting info from \"https://192.168.99.10:6443\"",
  "[discovery] Failed to connect to API Server \"192.168.99.10:6443\": there is no JWS signed token in the cluster-info ConfigMap. This token id \"7ae0ed\" is invalid for this cluster, can't connect",
  "[discovery] Trying to connect to API Server \"192.168.99.10:6443\"",
  "[discovery] Created cluster-info discovery client, requesting info from \"https://192.168.99.10:6443\"",
  "[discovery] Failed to connect to API Server \"192.168.99.10:6443\": there is no JWS signed token in the cluster-info ConfigMap. This token id \"7ae0ed\" is invalid for this cluster, can't connect",
  "[discovery] Trying to connect to API Server \"192.168.99.10:6443\"",
  "[discovery] Created cluster-info discovery client, requesting info from \"https://192.168.99.10:6443\"",
  "[discovery] Requesting info from \"https://192.168.99.10:6443\" again to validate TLS against the pinned public key",
  "[discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server \"192.168.99.10:6443\"",
  "[discovery] Successfully established connection with API Server \"192.168.99.10:6443\"",
  "[bootstrap] Detected server version: v1.8.5",
  "[bootstrap] The server supports the Certificates API (certificates.k8s.io/v1beta1)",
  "",
  "Node join complete:",
  "* Certificate signing request sent to master and response",
  "  received.",
  "* Kubelet informed of new secure connection details.",
  "",
  "Run 'kubectl get nodes' on the master to see this machine join."

Answer 1

kubeadm 使用 spf13/pflag，其中两种表示法都是正确的。

来自docs：

--flag    // boolean flags, or flags with no option default values
--flag x  // only on flags without a default value
--flag=x

Answer 2

据我所知，格式并不重要。它在他们的输出中，推荐

You can now join any number of machines by running the following on each node as root:

kubeadm join --token <token> <master-ip>:<master-port> --discovery-token-ca-cert-hash sha256:<hash>

我认为令牌用于安全（ssl 或 tls）目的，因此主节点和工作节点可以使用加密进行通信。它是 TLS 握手的一部分。

因为工作节点中的 Kubelet 需要自己的令牌来与主节点上的 kube-api 服务器通信。

kubeadm init --token=xyz 还是 kubeadm init --token xyz？

kubeadm init --token=xyz or kubeadm init --token xyz?

kubernetes

kubeadm

问题