如何在 Rancher kubernetes 中启用资源 EphemeralContainers

Question

我想根据此 link https://www.shogan.co.uk/kubernetes/enabling-and-using-ephemeral-containers-on-kubernetes-1-16/

中给出的步骤，通过在以下文件中设置 --feature-gates=EphemeralContainers=true 来启用 EphemeralContainers

/etc/kubernetes/manifests/kube-apiserver.yaml
/etc/kubernetes/manifests/kube-scheduler.yaml

但是etc/kubernetes下没有这个文件，Kubernetes是通过Rancher设置的。我可以在 rancher k8

中设置值的任何想法

Answer 1

您需要通过编辑 cluster.yml 来通过 extra_args。

这是一个示例片段：

services:
    kube-api:
      service_node_port_range: 30000-32767
      pod_security_policy: false
      extra_args:
        feature-gates: "EphemeralContainers=true"
    kube-scheduler:
      extra_args:
        feature-gates: "EphemeralContainers=true"

参考：

https://rancher.com/docs/rke/latest/en/example-yamls/

Answer 2

Rancher 可能有类似的设置。尝试使用您自己的集群。对于裸机 kubernetes，将参数 EphemeralContainers=true 添加到标记 --feature-gates for kube-apiserver/kube-scheduler/kubelet

您可能需要更改以下配置文件

在每个节点上，cat /var/lib/kubelet/kubeadm-flags.env

KUBELET_KUBEADM_ARGS="--cgroup-driver=systemd --network-plugin=cni --pod-infra-container-image=k8s.gcr.io/pause:3.1 --feature-gates=EphemeralContainers=true"

在主节点上： cat /etc/kubernetes/manifests/kube-apiserver.yaml

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=10.252.90.44
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --feature-gates=TTLAfterFinished=true,EphemeralContainers=true #change me
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    - --cors-allowed-origins=http://localhost:3000,http://127.0.0.1:3000
    image: k8s.gcr.io/kube-apiserver:v1.16.0
    imagePullPolicy: IfNotPresent
    ...

和cat /etc/kubernetes/manifests/kube-scheduler.yaml

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-scheduler
    tier: control-plane
  name: kube-scheduler
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-scheduler
    - --authentication-kubeconfig=/etc/kubernetes/scheduler.conf
    - --authorization-kubeconfig=/etc/kubernetes/scheduler.conf
    - --bind-address=127.0.0.1
    - --feature-gates=TTLAfterFinished=true,EphemeralContainers=true #change me
    - --kubeconfig=/etc/kubernetes/scheduler.conf
    - --leader-elect=true
    image: k8s.gcr.io/kube-scheduler:v1.16.0
    imagePullPolicy: IfNotPresent
    ...

Answer 3

对于 rancher v2.5.9 中的我来说，我必须稍微调整设置才能使其正常工作。使用 scheduler 而不是 kube-scheduler，您还需要将 extra_args 添加到 kubelet 节。

      services:
        kubelet:
          extra_args:
            feature-gates: "EphemeralContainers=true"
        kube-api:
          extra_args:
            feature-gates: "EphemeralContainers=true"
        scheduler:
          extra_args:
            feature-gates: "EphemeralContainers=true"

如何在 Rancher kubernetes 中启用资源 EphemeralContainers

how to enable resource EphemeralContainers in Rancher kubernetes

kubernetes

containers

kubernetes-pod

rancher