Skip to content

Commit c3ddc0b

Browse files
committed
kubeadm: revisit the "Network setup" section post-feedback
- In a early note explain that there could be multiple default gateways on a host. - Do not have 1 note, 1 warning, then other note. - Leave the warning that the "custom IP" setup is not recommended at the end of the section.
1 parent 1483479 commit c3ddc0b

File tree

1 file changed

+15
-13
lines changed

1 file changed

+15
-13
lines changed

content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ After you initialize your control-plane, the kubelet runs normally.
8989
#### Network setup
9090

9191
kubeadm similarly to other Kubernetes components tries to find a usable IP on
92-
the network interface associated with the default gateway on a host. Such
92+
the network interfaces associated with a default gateway on a host. Such
9393
an IP is then used for the advertising and/or listening performed by a component.
9494

9595
To find out what this IP is on a Linux host you can use:
@@ -98,10 +98,22 @@ To find out what this IP is on a Linux host you can use:
9898
ip route show # Look for a line starting with "default via"
9999
```
100100

101+
{{< note >}}
102+
If two or more default gateways are present on the host, a Kubernetes component will
103+
try to use the first one it encounters that has a suitable global unicast IP address.
104+
While making this choice, the exact ordering of gateways might vary between different
105+
operating systems and kernel versions.
106+
{{< /note >}}
107+
101108
Kubernetes components do not accept custom network interface as an option,
102109
therefore a custom IP address must be passed as a flag to all components instances
103110
that need such a custom configuration.
104111

112+
{{< note >}}
113+
If the host does not have a default gateway and if a custom IP address is not passed
114+
to a Kubernetes component, the component may exit with an error.
115+
{{< /note >}}
116+
105117
To configure the API server advertise address for control plane nodes created with both
106118
`init` and `join`, the flag `--apiserver-advertise-address` can be used.
107119
Preferably, this option can be set in the [kubeadm API](/docs/reference/config-api/kubeadm-config.v1beta3)
@@ -114,13 +126,12 @@ For kubelets on all nodes, the `--node-ip` option can be passed in
114126
For dual-stack see
115127
[Dual-stack support with kubeadm](/docs/setup/production-environment/tools/kubeadm/dual-stack-support).
116128

117-
{{< note >}}
118-
IP addresses become part of certificates SAN fields. Changing these IP addresses would require
129+
The IP addresses that you assign to control plane components become part of their X.509 certificates'
130+
subject alternative name fields. Changing these IP addresses would require
119131
signing new certificates and restarting the affected components, so that the change in
120132
certificate files is reflected. See
121133
[Manual certificate renewal](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal)
122134
for more details on this topic.
123-
{{</ note >}}
124135

125136
{{< warning >}}
126137
The Kubernetes project recommends against this approach (configuring all component instances
@@ -132,15 +143,6 @@ is a public IP address, you should configure packet filtering or other security
132143
protect the nodes and your cluster.
133144
{{< /warning >}}
134145

135-
{{< note >}}
136-
If the host does not have a default gateway, it is recommended to setup one. Otherwise,
137-
without passing a custom IP address to a Kubernetes component, the component
138-
will exit with an error. If two or more default gateways are present on the host,
139-
a Kubernetes component will try to use the first one it encounters that has a suitable
140-
global unicast IP address. While making this choice, the exact ordering of gateways
141-
might vary between different operating systems and kernel versions.
142-
{{< /note >}}
143-
144146
### Preparing the required container images
145147

146148
This step is optional and only applies in case you wish `kubeadm init` and `kubeadm join`

0 commit comments

Comments
 (0)