import "k8s.io/kubernetes/cmd/kubeadm/app/constants"
constants.go constants_unix.go
const ( // KubernetesDir is the directory Kubernetes owns for storing various configuration files KubernetesDir = "/etc/kubernetes" // ManifestsSubDirName defines directory name to store manifests ManifestsSubDirName = "manifests" // TempDirForKubeadm defines temporary directory for kubeadm // should be joined with KubernetesDir. TempDirForKubeadm = "tmp" // CertificateValidity defines the validity for all the signed certificates generated by kubeadm CertificateValidity = time.Hour * 24 * 365 // CACertAndKeyBaseName defines certificate authority base name CACertAndKeyBaseName = "ca" // CACertName defines certificate name CACertName = "ca.crt" // CAKeyName defines certificate name CAKeyName = "ca.key" // APIServerCertAndKeyBaseName defines API's server certificate and key base name APIServerCertAndKeyBaseName = "apiserver" // APIServerCertName defines API's server certificate name APIServerCertName = "apiserver.crt" // APIServerKeyName defines API's server key name APIServerKeyName = "apiserver.key" // APIServerCertCommonName defines API's server certificate common name (CN) APIServerCertCommonName = "kube-apiserver" // APIServerKubeletClientCertAndKeyBaseName defines kubelet client certificate and key base name APIServerKubeletClientCertAndKeyBaseName = "apiserver-kubelet-client" // APIServerKubeletClientCertName defines kubelet client certificate name APIServerKubeletClientCertName = "apiserver-kubelet-client.crt" // APIServerKubeletClientKeyName defines kubelet client key name APIServerKubeletClientKeyName = "apiserver-kubelet-client.key" // APIServerKubeletClientCertCommonName defines kubelet client certificate common name (CN) APIServerKubeletClientCertCommonName = "kube-apiserver-kubelet-client" // EtcdCACertAndKeyBaseName defines etcd's CA certificate and key base name EtcdCACertAndKeyBaseName = "etcd/ca" // EtcdCACertName defines etcd's CA certificate name EtcdCACertName = "etcd/ca.crt" // EtcdCAKeyName defines etcd's CA key name EtcdCAKeyName = "etcd/ca.key" // EtcdServerCertAndKeyBaseName defines etcd's server certificate and key base name EtcdServerCertAndKeyBaseName = "etcd/server" // EtcdServerCertName defines etcd's server certificate name EtcdServerCertName = "etcd/server.crt" // EtcdServerKeyName defines etcd's server key name EtcdServerKeyName = "etcd/server.key" // EtcdListenClientPort defines the port etcd listen on for client traffic EtcdListenClientPort = 2379 // EtcdMetricsPort is the port at which to obtain etcd metrics and health status EtcdMetricsPort = 2381 // EtcdPeerCertAndKeyBaseName defines etcd's peer certificate and key base name EtcdPeerCertAndKeyBaseName = "etcd/peer" // EtcdPeerCertName defines etcd's peer certificate name EtcdPeerCertName = "etcd/peer.crt" // EtcdPeerKeyName defines etcd's peer key name EtcdPeerKeyName = "etcd/peer.key" // EtcdListenPeerPort defines the port etcd listen on for peer traffic EtcdListenPeerPort = 2380 // EtcdHealthcheckClientCertAndKeyBaseName defines etcd's healthcheck client certificate and key base name EtcdHealthcheckClientCertAndKeyBaseName = "etcd/healthcheck-client" // EtcdHealthcheckClientCertName defines etcd's healthcheck client certificate name EtcdHealthcheckClientCertName = "etcd/healthcheck-client.crt" // EtcdHealthcheckClientKeyName defines etcd's healthcheck client key name EtcdHealthcheckClientKeyName = "etcd/healthcheck-client.key" // EtcdHealthcheckClientCertCommonName defines etcd's healthcheck client certificate common name (CN) EtcdHealthcheckClientCertCommonName = "kube-etcd-healthcheck-client" // APIServerEtcdClientCertAndKeyBaseName defines apiserver's etcd client certificate and key base name APIServerEtcdClientCertAndKeyBaseName = "apiserver-etcd-client" // APIServerEtcdClientCertName defines apiserver's etcd client certificate name APIServerEtcdClientCertName = "apiserver-etcd-client.crt" // APIServerEtcdClientKeyName defines apiserver's etcd client key name APIServerEtcdClientKeyName = "apiserver-etcd-client.key" // APIServerEtcdClientCertCommonName defines apiserver's etcd client certificate common name (CN) APIServerEtcdClientCertCommonName = "kube-apiserver-etcd-client" // ServiceAccountKeyBaseName defines SA key base name ServiceAccountKeyBaseName = "sa" // ServiceAccountPublicKeyName defines SA public key base name ServiceAccountPublicKeyName = "sa.pub" // ServiceAccountPrivateKeyName defines SA private key base name ServiceAccountPrivateKeyName = "sa.key" // FrontProxyCACertAndKeyBaseName defines front proxy CA certificate and key base name FrontProxyCACertAndKeyBaseName = "front-proxy-ca" // FrontProxyCACertName defines front proxy CA certificate name FrontProxyCACertName = "front-proxy-ca.crt" // FrontProxyCAKeyName defines front proxy CA key name FrontProxyCAKeyName = "front-proxy-ca.key" // FrontProxyClientCertAndKeyBaseName defines front proxy certificate and key base name FrontProxyClientCertAndKeyBaseName = "front-proxy-client" // FrontProxyClientCertName defines front proxy certificate name FrontProxyClientCertName = "front-proxy-client.crt" // FrontProxyClientKeyName defines front proxy key name FrontProxyClientKeyName = "front-proxy-client.key" // FrontProxyClientCertCommonName defines front proxy certificate common name FrontProxyClientCertCommonName = "front-proxy-client" //used as subject.commonname attribute (CN) // AdminKubeConfigFileName defines name for the kubeconfig aimed to be used by the superuser/admin of the cluster AdminKubeConfigFileName = "admin.conf" // KubeletBootstrapKubeConfigFileName defines the file name for the kubeconfig that the kubelet will use to do // the TLS bootstrap to get itself an unique credential KubeletBootstrapKubeConfigFileName = "bootstrap-kubelet.conf" // KubeletKubeConfigFileName defines the file name for the kubeconfig that the control-plane kubelet will use for talking // to the API server KubeletKubeConfigFileName = "kubelet.conf" // ControllerManagerKubeConfigFileName defines the file name for the controller manager's kubeconfig file ControllerManagerKubeConfigFileName = "controller-manager.conf" // SchedulerKubeConfigFileName defines the file name for the scheduler's kubeconfig file SchedulerKubeConfigFileName = "scheduler.conf" // ControllerManagerUser defines the well-known user the controller-manager should be authenticated as ControllerManagerUser = "system:kube-controller-manager" // SchedulerUser defines the well-known user the scheduler should be authenticated as SchedulerUser = "system:kube-scheduler" // SystemPrivilegedGroup defines the well-known group for the apiservers. This group is also superuser by default // (i.e. bound to the cluster-admin ClusterRole) SystemPrivilegedGroup = "system:masters" // NodesGroup defines the well-known group for all nodes. NodesGroup = "system:nodes" // NodesUserPrefix defines the user name prefix as requested by the Node authorizer. NodesUserPrefix = "system:node:" // NodesClusterRoleBinding defines the well-known ClusterRoleBinding which binds the too permissive system:node // ClusterRole to the system:nodes group. Since kubeadm is using the Node Authorizer, this ClusterRoleBinding's // system:nodes group subject is removed if present. NodesClusterRoleBinding = "system:node" // APICallRetryInterval defines how long kubeadm should wait before retrying a failed API operation APICallRetryInterval = 500 * time.Millisecond // DiscoveryRetryInterval specifies how long kubeadm should wait before retrying to connect to the control-plane when doing discovery DiscoveryRetryInterval = 5 * time.Second // PatchNodeTimeout specifies how long kubeadm should wait for applying the label and taint on the control-plane before timing out PatchNodeTimeout = 2 * time.Minute // TLSBootstrapTimeout specifies how long kubeadm should wait for the kubelet to perform the TLS Bootstrap TLSBootstrapTimeout = 5 * time.Minute // TLSBootstrapRetryInterval specifies how long kubeadm should wait before retrying the TLS Bootstrap check TLSBootstrapRetryInterval = 5 * time.Second // APICallWithWriteTimeout specifies how long kubeadm should wait for api calls with at least one write APICallWithWriteTimeout = 40 * time.Second // APICallWithReadTimeout specifies how long kubeadm should wait for api calls with only reads APICallWithReadTimeout = 15 * time.Second // PullImageRetry specifies how many times ContainerRuntime retries when pulling image failed PullImageRetry = 5 // DefaultControlPlaneTimeout specifies the default control plane (actually API Server) timeout for use by kubeadm DefaultControlPlaneTimeout = 4 * time.Minute // MinimumAddressesInServiceSubnet defines minimum amount of nodes the Service subnet should allow. // We need at least ten, because the DNS service is always at the tenth cluster clusterIP MinimumAddressesInServiceSubnet = 10 // MaximumBitsForServiceSubnet defines maximum possible size of the service subnet in terms of bits. // For example, if the value is 20, then the largest supported service subnet is /12 for IPv4 and /108 for IPv6. // Note however that anything in between /108 and /112 will be clamped to /112 due to the limitations of the underlying allocation logic. // TODO: https://github.com/kubernetes/enhancements/pull/1881 MaximumBitsForServiceSubnet = 20 // MinimumAddressesInPodSubnet defines minimum amount of pods in the cluster. // We need at least more than services, an IPv4 /28 or IPv6 /128 subnet means 14 util addresses MinimumAddressesInPodSubnet = 14 // PodSubnetNodeMaskMaxDiff is limited to 16 due to an issue with uncompressed IP bitmap in core: // xref: #44918 // The node subnet mask size must be no more than the pod subnet mask size + 16 PodSubnetNodeMaskMaxDiff = 16 // DefaultTokenDuration specifies the default amount of time that a bootstrap token will be valid // Default behaviour is 24 hours DefaultTokenDuration = 24 * time.Hour // DefaultCertTokenDuration specifies the default amount of time that the token used by upload certs will be valid // Default behaviour is 2 hours DefaultCertTokenDuration = 2 * time.Hour // CertificateKeySize specifies the size of the key used to encrypt certificates on uploadcerts phase CertificateKeySize = 32 // LabelNodeRoleOldControlPlane specifies that a node hosts control-plane components // DEPRECATED: https://github.com/kubernetes/kubeadm/issues/2200 LabelNodeRoleOldControlPlane = "node-role.kubernetes.io/master" // LabelNodeRoleControlPlane specifies that a node hosts control-plane components LabelNodeRoleControlPlane = "node-role.kubernetes.io/control-plane" // AnnotationKubeadmCRISocket specifies the annotation kubeadm uses to preserve the crisocket information given to kubeadm at // init/join time for use later. kubeadm annotates the node object with this information AnnotationKubeadmCRISocket = "kubeadm.alpha.kubernetes.io/cri-socket" // UnknownCRISocket defines the undetected or unknown CRI socket UnknownCRISocket = "/var/run/unknown.sock" // KubeadmConfigConfigMap specifies in what ConfigMap in the kube-system namespace the `kubeadm init` configuration should be stored KubeadmConfigConfigMap = "kubeadm-config" // ClusterConfigurationConfigMapKey specifies in what ConfigMap key the cluster configuration should be stored ClusterConfigurationConfigMapKey = "ClusterConfiguration" // ClusterStatusConfigMapKey specifies in what ConfigMap key the cluster status should be stored ClusterStatusConfigMapKey = "ClusterStatus" // KubeProxyConfigMap specifies in what ConfigMap in the kube-system namespace the kube-proxy configuration should be stored KubeProxyConfigMap = "kube-proxy" // KubeProxyConfigMapKey specifies in what ConfigMap key the component config of kube-proxy should be stored KubeProxyConfigMapKey = "config.conf" // KubeletBaseConfigurationConfigMapPrefix specifies in what ConfigMap in the kube-system namespace the initial remote configuration of kubelet should be stored KubeletBaseConfigurationConfigMapPrefix = "kubelet-config-" // KubeletBaseConfigurationConfigMapKey specifies in what ConfigMap key the initial remote configuration of kubelet should be stored KubeletBaseConfigurationConfigMapKey = "kubelet" // KubeletBaseConfigMapRolePrefix defines the base kubelet configuration ConfigMap. KubeletBaseConfigMapRolePrefix = "kubeadm:kubelet-config-" // KubeletRunDirectory specifies the directory where the kubelet runtime information is stored. KubeletRunDirectory = "/var/lib/kubelet" // KubeletConfigurationFileName specifies the file name on the node which stores initial remote configuration of kubelet // This file should exist under KubeletRunDirectory KubeletConfigurationFileName = "config.yaml" // KubeletEnvFileName is a file "kubeadm init" writes at runtime. Using that interface, kubeadm can customize certain // kubelet flags conditionally based on the environment at runtime. Also, parameters given to the configuration file // might be passed through this file. "kubeadm init" writes one variable, with the name ${KubeletEnvFileVariableName}. // This file should exist under KubeletRunDirectory KubeletEnvFileName = "kubeadm-flags.env" // KubeletEnvFileVariableName specifies the shell script variable name "kubeadm init" should write a value to in KubeletEnvFile KubeletEnvFileVariableName = "KUBELET_KUBEADM_ARGS" // KubeletHealthzPort is the port of the kubelet healthz endpoint KubeletHealthzPort = 10248 // MinExternalEtcdVersion indicates minimum external etcd version which kubeadm supports MinExternalEtcdVersion = "3.2.18" // DefaultEtcdVersion indicates the default etcd version that kubeadm uses DefaultEtcdVersion = "3.4.13-0" // Etcd defines variable used internally when referring to etcd component Etcd = "etcd" // KubeAPIServer defines variable used internally when referring to kube-apiserver component KubeAPIServer = "kube-apiserver" // KubeControllerManager defines variable used internally when referring to kube-controller-manager component KubeControllerManager = "kube-controller-manager" // KubeScheduler defines variable used internally when referring to kube-scheduler component KubeScheduler = "kube-scheduler" // KubeProxy defines variable used internally when referring to kube-proxy component KubeProxy = "kube-proxy" // HyperKube defines variable used internally when referring to the hyperkube image HyperKube = "hyperkube" // CoreDNS defines variable used internally when referring to the CoreDNS component CoreDNS = "CoreDNS" // KubeDNS defines variable used internally when referring to the KubeDNS component KubeDNS = "kube-dns" // Kubelet defines variable used internally when referring to the Kubelet Kubelet = "kubelet" // KubeCertificatesVolumeName specifies the name for the Volume that is used for injecting certificates to control plane components (can be both a hostPath volume or a projected, all-in-one volume) KubeCertificatesVolumeName = "k8s-certs" // KubeConfigVolumeName specifies the name for the Volume that is used for injecting the kubeconfig to talk securely to the api server for a control plane component if applicable KubeConfigVolumeName = "kubeconfig" // NodeBootstrapTokenAuthGroup specifies which group a Node Bootstrap Token should be authenticated in NodeBootstrapTokenAuthGroup = "system:bootstrappers:kubeadm:default-node-token" // DefaultCIImageRepository points to image registry where CI uploads images from ci-cross build job DefaultCIImageRepository = "gcr.io/k8s-staging-ci-images" // CoreDNSConfigMap specifies in what ConfigMap in the kube-system namespace the CoreDNS config should be stored CoreDNSConfigMap = "coredns" // CoreDNSDeploymentName specifies the name of the Deployment for CoreDNS add-on CoreDNSDeploymentName = "coredns" // CoreDNSImageName specifies the name of the image for CoreDNS add-on CoreDNSImageName = "coredns/coredns" // KubeDNSConfigMap specifies in what ConfigMap in the kube-system namespace the kube-dns config should be stored KubeDNSConfigMap = "kube-dns" // KubeDNSDeploymentName specifies the name of the Deployment for kube-dns add-on KubeDNSDeploymentName = "kube-dns" // KubeDNSKubeDNSImageName specifies the name of the image for the kubedns container in the kube-dns add-on KubeDNSKubeDNSImageName = "k8s-dns-kube-dns" // KubeDNSSidecarImageName specifies the name of the image for the sidecar container in the kube-dns add-on KubeDNSSidecarImageName = "k8s-dns-sidecar" // KubeDNSDnsMasqNannyImageName specifies the name of the image for the dnsmasq container in the kube-dns add-on KubeDNSDnsMasqNannyImageName = "k8s-dns-dnsmasq-nanny" // KubeDNSVersion is the version of kube-dns to be deployed if it is used KubeDNSVersion = "1.14.13" // CoreDNSVersion is the version of CoreDNS to be deployed if it is used CoreDNSVersion = "v1.8.0" // ClusterConfigurationKind is the string kind value for the ClusterConfiguration struct ClusterConfigurationKind = "ClusterConfiguration" // InitConfigurationKind is the string kind value for the InitConfiguration struct InitConfigurationKind = "InitConfiguration" // JoinConfigurationKind is the string kind value for the JoinConfiguration struct JoinConfigurationKind = "JoinConfiguration" // YAMLDocumentSeparator is the separator for YAML documents // TODO: Find a better place for this constant YAMLDocumentSeparator = "---\n" // DefaultAPIServerBindAddress is the default bind address for the API Server DefaultAPIServerBindAddress = "0.0.0.0" // ControlPlaneNumCPU is the number of CPUs required on control-plane ControlPlaneNumCPU = 2 // ControlPlaneMem is the number of megabytes of memory required on the control-plane // Below that amount of RAM running a stable control plane would be difficult. ControlPlaneMem = 1700 // KubeadmCertsSecret specifies in what Secret in the kube-system namespace the certificates should be stored KubeadmCertsSecret = "kubeadm-certs" // KubeletPort is the default port for the kubelet server on each host machine. // May be overridden by a flag at startup. KubeletPort = 10250 // KubeSchedulerPort is the default port for the scheduler status server. // May be overridden by a flag at startup. KubeSchedulerPort = 10259 // KubeControllerManagerPort is the default port for the controller manager status server. // May be overridden by a flag at startup. KubeControllerManagerPort = 10257 // EtcdAdvertiseClientUrlsAnnotationKey is the annotation key on every etcd pod, describing the // advertise client URLs EtcdAdvertiseClientUrlsAnnotationKey = "kubeadm.kubernetes.io/etcd.advertise-client-urls" // KubeAPIServerAdvertiseAddressEndpointAnnotationKey is the annotation key on every apiserver pod, // describing the API endpoint (advertise address and bind port of the api server) KubeAPIServerAdvertiseAddressEndpointAnnotationKey = "kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint" // ComponentConfigHashAnnotationKey holds the config map annotation key that kubeadm uses to store // a SHA256 sum to check for user changes ComponentConfigHashAnnotationKey = "kubeadm.kubernetes.io/component-config.hash" // ControlPlaneTier is the value used in the tier label to identify control plane components ControlPlaneTier = "control-plane" // ModeAlwaysAllow is the mode to set all requests as authorized ModeAlwaysAllow string = "AlwaysAllow" // ModeAlwaysDeny is the mode to set no requests as authorized ModeAlwaysDeny string = "AlwaysDeny" // ModeABAC is the mode to use Attribute Based Access Control to authorize ModeABAC string = "ABAC" // ModeWebhook is the mode to make an external webhook call to authorize ModeWebhook string = "Webhook" // ModeRBAC is the mode to use Role Based Access Control to authorize ModeRBAC string = "RBAC" // ModeNode is an authorization mode that authorizes API requests made by kubelets. ModeNode string = "Node" )
const ( // DefaultDockerCRISocket defines the default Docker CRI socket DefaultDockerCRISocket = "/var/run/dockershim.sock" // PauseVersion indicates the default pause image version for kubeadm PauseVersion = "3.2" )
var ( // OldControlPlaneTaint is the taint to apply on the PodSpec for being able to run that Pod on the control-plane // DEPRECATED: https://github.com/kubernetes/kubeadm/issues/2200 OldControlPlaneTaint = v1.Taint{ Key: LabelNodeRoleOldControlPlane, Effect: v1.TaintEffectNoSchedule, } // OldControlPlaneToleration is the toleration to apply on the PodSpec for being able to run that Pod on the control-plane // DEPRECATED: https://github.com/kubernetes/kubeadm/issues/2200 OldControlPlaneToleration = v1.Toleration{ Key: LabelNodeRoleOldControlPlane, Effect: v1.TaintEffectNoSchedule, } // ControlPlaneTaint is the taint to apply on the PodSpec for being able to run that Pod on the control-plane ControlPlaneTaint = v1.Taint{ Key: LabelNodeRoleControlPlane, Effect: v1.TaintEffectNoSchedule, } // ControlPlaneToleration is the toleration to apply on the PodSpec for being able to run that Pod on the control-plane ControlPlaneToleration = v1.Toleration{ Key: LabelNodeRoleControlPlane, Effect: v1.TaintEffectNoSchedule, } // DefaultTokenUsages specifies the default functions a token will get DefaultTokenUsages = bootstrapapi.KnownTokenUsages // DefaultTokenGroups specifies the default groups that this token will authenticate as when used for authentication DefaultTokenGroups = []string{NodeBootstrapTokenAuthGroup} // ControlPlaneComponents defines the control-plane component names ControlPlaneComponents = []string{KubeAPIServer, KubeControllerManager, KubeScheduler} // MinimumControlPlaneVersion specifies the minimum control plane version kubeadm can deploy MinimumControlPlaneVersion = version.MustParseSemantic("v1.20.0") // MinimumKubeletVersion specifies the minimum version of kubelet which kubeadm supports MinimumKubeletVersion = version.MustParseSemantic("v1.20.0") // CurrentKubernetesVersion specifies current Kubernetes version supported by kubeadm CurrentKubernetesVersion = version.MustParseSemantic("v1.21.0") // SupportedEtcdVersion lists officially supported etcd versions with corresponding Kubernetes releases SupportedEtcdVersion = map[uint8]string{ 13: "3.2.24", 14: "3.3.10", 15: "3.3.10", 16: "3.3.17-0", 17: "3.4.3-0", 18: "3.4.3-0", 19: "3.4.13-0", 20: "3.4.13-0", 21: "3.4.13-0", 22: "3.4.13-0", } // KubeadmCertsClusterRoleName sets the name for the ClusterRole that allows // the bootstrap tokens to access the kubeadm-certs Secret during the join of a new control-plane KubeadmCertsClusterRoleName = fmt.Sprintf("kubeadm:%s", KubeadmCertsSecret) // StaticPodMirroringDefaultRetry is used a backoff strategy for // waiting for static pods to be mirrored to the apiserver. StaticPodMirroringDefaultRetry = wait.Backoff{ Steps: 30, Duration: 1 * time.Second, Factor: 1.0, Jitter: 0.1, } )
CreateTempDirForKubeadm is a function that creates a temporary directory under /etc/kubernetes/tmp (not using /tmp as that would potentially be dangerous)
CreateTimestampDirForKubeadm is a function that creates a temporary directory under /etc/kubernetes/tmp formatted with the current date
func EtcdSupportedVersion(supportedEtcdVersion map[uint8]string, versionString string) (etcdVersion *version.Version, warning, err error)
EtcdSupportedVersion returns officially supported version of etcd for a specific Kubernetes release If passed version is not in the given list, the function returns the nearest version with a warning
GetAPIServerVirtualIP returns the IP of the internal Kubernetes API service
GetAdminKubeConfigPath returns the location on the disk where admin kubeconfig is located by default
GetBootstrapKubeletKubeConfigPath returns the location on the disk where bootstrap kubelet kubeconfig is located by default
GetDNSIP returns a dnsIP, which is 10th IP in svcSubnet CIDR range
func GetDNSVersion(dnsType kubeadmapi.DNSAddOnType) string
GetDNSVersion is a handy function that returns the DNS version by DNS type
GetKubeletConfigMapName returns the right ConfigMap name for the right branch of k8s
GetKubeletKubeConfigPath returns the location on the disk where kubelet kubeconfig is located by default
GetKubernetesServiceCIDR returns the default Service CIDR for the Kubernetes internal service
GetStaticPodDirectory returns the location on the disk where the Static Pod should be present
GetStaticPodFilepath returns the location on the disk where the Static Pod should be present
Package constants imports 15 packages (graph) and is imported by 268 packages. Updated 2021-01-17. Refresh now. Tools for package owners.