@@ -89,7 +89,7 @@ After you initialize your control-plane, the kubelet runs normally.
89
89
#### Network setup
90
90
91
91
kubeadm similarly to other Kubernetes components tries to find a usable IP on
92
- the network interface associated with the default gateway on a host. Such
92
+ the network interfaces associated with a default gateway on a host. Such
93
93
an IP is then used for the advertising and/or listening performed by a component.
94
94
95
95
To find out what this IP is on a Linux host you can use:
@@ -98,10 +98,22 @@ To find out what this IP is on a Linux host you can use:
98
98
ip route show # Look for a line starting with "default via"
99
99
```
100
100
101
+ {{< note >}}
102
+ If two or more default gateways are present on the host, a Kubernetes component will
103
+ try to use the first one it encounters that has a suitable global unicast IP address.
104
+ While making this choice, the exact ordering of gateways might vary between different
105
+ operating systems and kernel versions.
106
+ {{< /note >}}
107
+
101
108
Kubernetes components do not accept custom network interface as an option,
102
109
therefore a custom IP address must be passed as a flag to all components instances
103
110
that need such a custom configuration.
104
111
112
+ {{< note >}}
113
+ If the host does not have a default gateway and if a custom IP address is not passed
114
+ to a Kubernetes component, the component may exit with an error.
115
+ {{< /note >}}
116
+
105
117
To configure the API server advertise address for control plane nodes created with both
106
118
` init ` and ` join ` , the flag ` --apiserver-advertise-address ` can be used.
107
119
Preferably, this option can be set in the [ kubeadm API] ( /docs/reference/config-api/kubeadm-config.v1beta3 )
@@ -114,13 +126,12 @@ For kubelets on all nodes, the `--node-ip` option can be passed in
114
126
For dual-stack see
115
127
[ Dual-stack support with kubeadm] ( /docs/setup/production-environment/tools/kubeadm/dual-stack-support ) .
116
128
117
- {{< note >}}
118
- IP addresses become part of certificates SAN fields. Changing these IP addresses would require
129
+ The IP addresses that you assign to control plane components become part of their X.509 certificates'
130
+ subject alternative name fields. Changing these IP addresses would require
119
131
signing new certificates and restarting the affected components, so that the change in
120
132
certificate files is reflected. See
121
133
[ Manual certificate renewal] ( /docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal )
122
134
for more details on this topic.
123
- {{</ note >}}
124
135
125
136
{{< warning >}}
126
137
The Kubernetes project recommends against this approach (configuring all component instances
@@ -132,15 +143,6 @@ is a public IP address, you should configure packet filtering or other security
132
143
protect the nodes and your cluster.
133
144
{{< /warning >}}
134
145
135
- {{< note >}}
136
- If the host does not have a default gateway, it is recommended to setup one. Otherwise,
137
- without passing a custom IP address to a Kubernetes component, the component
138
- will exit with an error. If two or more default gateways are present on the host,
139
- a Kubernetes component will try to use the first one it encounters that has a suitable
140
- global unicast IP address. While making this choice, the exact ordering of gateways
141
- might vary between different operating systems and kernel versions.
142
- {{< /note >}}
143
-
144
146
### Preparing the required container images
145
147
146
148
This step is optional and only applies in case you wish ` kubeadm init ` and ` kubeadm join `
0 commit comments