|
本文档采用自动化机器翻译技术翻译。 尽管我们力求提供准确的译文，但不对翻译内容的完整性、准确性或可靠性作出任何保证。 若出现任何内容不一致情况，请以原始 英文 版本为准，且原始英文版本为权威文本。 |
k3s server
在本节中，您将学习如何配置 K3s 服务器。
请注意，服务器还运行一个代理，因此在 k3s agent 文档 中列出的所有配置选项在服务器上也受支持。
选项在此页面上以 CLI 标志的形式记录，但也可以作为配置文件选项传递。有关使用 YAML 配置文件的更多信息，请参见 配置文件 文档。
关键配置值
以下选项必须在集群中的所有服务器上设置为相同的值。如果不这样做，将导致新服务器在使用嵌入式 etcd 时无法加入集群，或者在使用外部数据存储时集群操作不正确。
-
--agent-token -
--cluster-cidr -
--cluster-dns -
--cluster-domain -
--disable-cloud-controller -
--disable-helm-controller -
--disable-network-policy -
--disable=servicelb注意：其他打包组件可能在每个服务器基础上被禁用 -
--egress-selector-mode -
--embedded-registry -
--flannel-backend -
--flannel-external-ip -
--flannel-ipv6-masq -
--secrets-encryption -
--secrets-encryption-provider -
--service-cidr
常用选项
数据库
| 标志 | 环境变量 | 默认值 | 说明 |
|---|---|---|---|
|
|
指定 etcd、NATS、MySQL、Postgres 或 SQLite 数据源名称 |
|
|
|
用于保护数据存储后端通信的 TLS 证书颁发机构文件 |
|
|
|
用于保护数据存储后端通信的 TLS 证书文件 |
|
|
|
用于保护数据存储后端通信的 TLS 密钥文件 |
|
|
false |
将 etcd 指标暴露给客户端接口 |
|
|
false |
禁用自动 etcd 快照 |
|
|
"etcd-snapshot-<unix-timestamp>" |
设置 etcd 快照的基本名称。 |
|
|
"0 */12 * * *" |
快照间隔时间的 cron 规范。例如，每 5 小时 "0 */5 _ * _" |
|
|
5 |
要保留的快照数量 |
|
|
${data-dir}/db/snapshots |
保存数据库快照的目录 |
|
|
启用备份到 S3 |
||
|
"s3.amazonaws.com" |
S3 端点 URL |
|
|
连接到 S3 端点的 S3 自定义 CA 证书 |
||
|
禁用 S3 SSL 证书验证 |
||
|
|
S3 访问密钥 |
|
|
|
S3 秘密密钥 |
|
|
S3 存储桶名称 |
||
|
"us-east-1" |
S3 区域/存储桶位置（可选） |
|
|
S3 文件夹 |
||
|
连接到 S3 时使用的代理服务器，覆盖任何与代理相关的环境变量 |
||
|
在 kube-system 名称空间中用于配置 S3 的秘密名称，如果启用了 etcd-s3 且未设置其他 etcd-s3 选项 |
||
|
禁用 S3 的 HTTPS |
||
|
5m0s |
S3 超时（默认：5m0s) |
群集选项
| 标志 | 环境变量 | 说明 |
|---|---|---|
|
|
用于将服务器或代理加入集群的共享密钥 |
|
|
包含集群密钥/词元的文件 |
|
|
用于将代理加入集群的共享密钥，但不包括服务器 |
|
|
包含代理密钥的文件 |
|
|
要连接的服务器，用于加入集群 |
|
|
使用嵌入式 Etcd 初始化新集群 |
|
|
忘记所有对等体，成为新集群的唯一成员 |
管理员 Kubeconfig 选项
| 标志 | 环境变量 | 说明 |
|---|---|---|
|
|
将 kubeconfig 写入此文件以供管理员客户端使用 |
|
|
使用此 模式 写入 kubeconfig。kubeconfig 文件由 root 拥有，默认模式为 600。将模式更改为 644 将允许主机上的其他非特权用户读取该文件。 |
|
|
写入 kubeconfig 组。与 |
高级选项
日志记录
| 标志 | 默认值 | 说明 |
|---|---|---|
|
不适用 |
打开调试日志 |
|
0 |
日志级别详细程度的数字 |
|
不适用 |
以逗号分隔的 FILE_PATTERN=LOG_LEVEL 设置，用于文件过滤日志记录 |
|
不适用 |
记录到文件 |
|
不适用 |
同时记录到标准错误和文件（如果设置） |
侦听器
| 标志 | 默认值 | 说明 |
|---|---|---|
|
0.0.0.0 |
k3s 绑定地址 |
|
6443 |
HTTPS 侦听端口 |
|
node-external-ip/node-ip |
apiserver 为其服务端点广告的 IPv4/IPv6 地址 |
|
listen-port/0 |
apiserver 用于向集群成员广告的端口 |
|
不适用 |
在 TLS 证书上添加额外的主机名或 IPv4/IPv6 地址作为主题备用名称 |
|
true |
通过拒绝添加与 kubernetes apiserver 服务、服务器节点或 tls-san 选项的值无关的主题备用名称来保护服务器 TLS 证书 |
数据
| 标志 | 默认值 | 说明 |
|---|---|---|
|
|
用于保存状态的文件夹 |
网络
| 标志 | 默认值 | 说明 |
|---|---|---|
|
"10.42.0.0/16" |
用于 Pod IP 的 IPv4/IPv6 网络 CIDR |
|
"10.43.0.0/16" |
用于服务 IP 的 IPv4/IPv6 网络 CIDR |
|
"30000-32767" |
为具有 NodePort 可见性的服务保留的端口范围 |
|
"10.43.0.10" |
coredns 服务的 IPv4 集群 IP。应在您的 service-cidr 范围内 |
|
"cluster.local" |
集群域 |
|
"vxlan" |
可以是 'none'、'vxlan'、'ipsec'(已弃用) 、'host-gw'、'wireguard-native' 或 'wireguard'(已弃用) 之一 |
|
"N/A" |
为 pod 启用 IPv6 伪装 |
|
"N/A" |
使用节点外部 IP 地址进行 Flannel 流量 |
|
"kube-system" |
servicelb 组件的 pod 命名空间 |
|
"agent" |
必须是以下之一：
|
Kubernetes 组件
| 标志 | 说明 |
|---|---|
|
参见 "使用 |
|
禁用 Kubernetes 默认调度器 |
|
禁用 k3s 默认云控制器管理器 |
|
禁用运行 kube-proxy |
|
禁用 k3s 默认网络策略控制器 |
|
禁用 Helm 控制器 |
Kubernetes 进程的自定义标志
| 标志 | 说明 |
|---|---|
|
etcd 进程的自定义标志 |
|
kube-apiserver 进程的自定义标志 |
|
kube-scheduler 进程的自定义标志 |
|
kube-controller-manager 进程的自定义标志 |
|
kube-cloud-controller-manager 进程的自定义标志 |
|
kubelet 进程的自定义标志 |
|
kube-proxy 进程的自定义标志 |
K3s 服务器 CLI 帮助。
如果选项在下面的括号中出现，例如`[$K3S_TOKEN]`，则表示该选项可以作为该名称的环境变量传递。
NAME:
k3s server - Run management server
USAGE:
k3s server [OPTIONS]
OPTIONS:
--config FILE, -c FILE (config) Load configuration from FILE (default: "/etc/rancher/k3s/config.yaml") [$K3S_CONFIG_FILE]
--debug (logging) Turn on debug logs [$K3S_DEBUG]
-v value (logging) Number for the log level verbosity (default: 0)
--vmodule value (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging
--log value, -l value (logging) Log to file
--alsologtostderr (logging) Log to standard error as well as file (if set)
--bind-address value (listener) k3s bind address (default: 0.0.0.0)
--https-listen-port value (listener) HTTPS listen port (default: 6443)
--advertise-address value (listener) IPv4/IPv6 address that apiserver uses to advertise to members of the cluster (default: node-external-ip/node-ip)
--advertise-port value (listener) Port that apiserver uses to advertise to members of the cluster (default: listen-port) (default: 0)
--tls-san value (listener) Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert
--tls-san-security (listener) Protect the server TLS cert by refusing to add Subject Alternative Names not associated with the kubernetes apiserver service, server nodes, or values of the tls-san option (default: true)
--data-dir value, -d value (data) Folder to hold state default /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root [$K3S_DATA_DIR]
--cluster-cidr value (networking) IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16)
--service-cidr value (networking) IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16)
--service-node-port-range value (networking) Port range to reserve for services with NodePort visibility (default: "30000-32767")
--cluster-dns value (networking) IPv4 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10)
--cluster-domain value (networking) Cluster Domain (default: "cluster.local")
--flannel-backend value (networking) Backend (valid values: 'none', 'vxlan', 'host-gw', 'wireguard-native' (default: "vxlan") --flannel-ipv6-masq (networking) Enable IPv6 masquerading for pod
--flannel-external-ip (networking) Use node external IP addresses for Flannel traffic
--egress-selector-mode value (networking) One of 'agent', 'cluster', 'pod', 'disabled' (default: "agent")
--servicelb-namespace value (networking) Namespace of the pods for the servicelb component (default: "kube-system")
--write-kubeconfig value, -o value (client) Write kubeconfig for admin client to this file [$K3S_KUBECONFIG_OUTPUT]
--write-kubeconfig-mode value (client) Write kubeconfig with this mode [$K3S_KUBECONFIG_MODE]
--write-kubeconfig-group value (client) Write kubeconfig with this group [$K3S_KUBECONFIG_GROUP]
--helm-job-image value (helm) Default image to use for helm jobs
--token value, -t value (cluster) Shared secret used to join a server or agent to a cluster [$K3S_TOKEN]
--token-file value (cluster) File containing the token [$K3S_TOKEN_FILE]
--agent-token value (cluster) Shared secret used to join agents to the cluster, but not servers [$K3S_AGENT_TOKEN]
--agent-token-file value (cluster) File containing the agent secret [$K3S_AGENT_TOKEN_FILE]
--server value, -s value (cluster) Server to connect to, used to join a cluster [$K3S_URL]
--cluster-init (cluster) Initialize a new cluster using embedded Etcd [$K3S_CLUSTER_INIT]
--cluster-reset (cluster) Forget all peers and become sole member of a new cluster [$K3S_CLUSTER_RESET]
--cluster-reset-restore-path value (db) Path to snapshot file to be restored
--kube-apiserver-arg value (flags) Customized flag for kube-apiserver process
--etcd-arg value (flags) Customized flag for etcd process
--kube-controller-manager-arg value (flags) Customized flag for kube-controller-manager process
--kube-scheduler-arg value (flags) Customized flag for kube-scheduler process
--kube-cloud-controller-manager-arg value (flags) Customized flag for kube-cloud-controller-manager process
--datastore-endpoint value (db) Specify etcd, NATS, MySQL, Postgres, or SQLite (default) data source name [$K3S_DATASTORE_ENDPOINT]
--datastore-cafile value (db) TLS Certificate Authority file used to secure datastore backend communication [$K3S_DATASTORE_CAFILE]
--datastore-certfile value (db) TLS certification file used to secure datastore backend communication [$K3S_DATASTORE_CERTFILE]
--datastore-keyfile value (db) TLS key file used to secure datastore backend communication [$K3S_DATASTORE_KEYFILE]
--etcd-expose-metrics (db) Expose etcd metrics to client interface. (default: false)
--etcd-disable-snapshots (db) Disable automatic etcd snapshots
--etcd-snapshot-name value (db) Set the base name of etcd snapshots (default: etcd-snapshot-<unix-timestamp>) (default: "etcd-snapshot")
--etcd-snapshot-schedule-cron value (db) Snapshot interval time in cron spec. eg. every 5 hours '0 */5 * * *' (default: "0 */12 * * *")
--etcd-snapshot-retention value (db) Number of snapshots to retain (default: 5)
--etcd-snapshot-dir value (db) Directory to save db snapshots. (default: $\{data-dir}/db/snapshots)
--etcd-snapshot-compress (db) Compress etcd snapshot
--etcd-s3 (db) Enable backup to S3
--etcd-s3-endpoint value (db) S3 endpoint url (default: "s3.amazonaws.com")
--etcd-s3-endpoint-ca value (db) S3 custom CA cert to connect to S3 endpoint
--etcd-s3-skip-ssl-verify (db) Disables S3 SSL certificate validation
--etcd-s3-access-key value (db) S3 access key [$AWS_ACCESS_KEY_ID]
--etcd-s3-secret-key value (db) S3 secret key [$AWS_SECRET_ACCESS_KEY]
--etcd-s3-bucket value (db) S3 bucket name
--etcd-s3-region value (db) S3 region / bucket location (optional) (default: "us-east-1")
--etcd-s3-folder value (db) S3 folder
--etcd-s3-proxy value (db) Proxy server to use when connecting to S3, overriding any proxy-releated environment variables
--etcd-s3-config-secret value (db) Name of secret in the kube-system namespace used to configure S3, if etcd-s3 is enabled and no other etcd-s3 options are set
--etcd-s3-insecure (db) Disables S3 over HTTPS
--etcd-s3-timeout value (db) S3 timeout (default: 5m0s)
--default-local-storage-path value (storage) Default local storage path for local provisioner storage class
--disable value (components) Do not deploy packaged components and delete any deployed components (valid items: coredns, servicelb, traefik, local-storage, metrics-server, runtimes)
--disable-scheduler (components) Disable Kubernetes default scheduler
--disable-cloud-controller (components) Disable k3s default cloud controller manager
--disable-kube-proxy (components) Disable running kube-proxy
--disable-network-policy (components) Disable k3s default network policy controller
--disable-helm-controller (components) Disable Helm controller
--embedded-registry (experimental/components) Enable embedded distributed container registry; requires use of embedded containerd; when enabled agents will also listen on the supervisor port
--supervisor-metrics (experimental/components) Enable serving k3s internal metrics on the supervisor port; when enabled agents will also listen on the supervisor port
--node-name value (agent/node) Node name [$K3S_NODE_NAME]
--with-node-id (agent/node) Append id to node name
--node-label value (agent/node) Registering and starting kubelet with set of labels
--node-taint value (agent/node) Registering kubelet with set of taints
--image-credential-provider-bin-dir value (agent/node) The path to the directory where credential provider plugin binaries are located (default: "/var/lib/rancher/credentialprovider/bin")
--image-credential-provider-config value (agent/node) The path to the credential provider plugin config file (default: "/var/lib/rancher/credentialprovider/config.yaml")
--docker (agent/runtime) (experimental) Use cri-dockerd instead of containerd
--container-runtime-endpoint value (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path
--default-runtime value (agent/runtime) Set the default runtime in containerd
--image-service-endpoint value (agent/runtime) Disable embedded containerd image service and use remote image service socket at the given path. If not specified, defaults to --container-runtime-endpoint.
--disable-default-registry-endpoint (agent/containerd) Disables containerd fallback default registry endpoint when a mirror is configured for that registry
--nonroot-devices (agent/containerd) Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config
--pause-image value (agent/runtime) Customized pause image for containerd or docker sandbox (default: "rancher/mirrored-pause:3.6")
--snapshotter value (agent/runtime) Override default containerd snapshotter (default: "overlayfs")
--private-registry value (agent/runtime) Private registry configuration file (default: "/etc/rancher/k3s/registries.yaml")
--system-default-registry value (agent/runtime) Private registry to be used for all system images [$K3S_SYSTEM_DEFAULT_REGISTRY]
--node-ip value, -i value (agent/networking) IPv4/IPv6 addresses to advertise for node
--node-external-ip value (agent/networking) IPv4/IPv6 external IP addresses to advertise for node
--node-internal-dns value (agent/networking) internal DNS addresses to advertise for node
--node-external-dns value (agent/networking) external DNS addresses to advertise for node
--resolv-conf value (agent/networking) Kubelet resolv.conf file [$K3S_RESOLV_CONF]
--flannel-iface value (agent/networking) Override default flannel interface
--flannel-conf value (agent/networking) Override default flannel config file
--flannel-cni-conf value (agent/networking) Override default flannel cni config file
--vpn-auth value (agent/networking) (experimental) Credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] [$K3S_VPN_AUTH]
--vpn-auth-file value (agent/networking) (experimental) File containing credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] [$K3S_VPN_AUTH_FILE]
--kubelet-arg value (agent/flags) Customized flag for kubelet process
--kube-proxy-arg value (agent/flags) Customized flag for kube-proxy process
--protect-kernel-defaults (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.
--secrets-encryption Enable secret encryption at rest
--enable-pprof (experimental) Enable pprof endpoint on supervisor port
--rootless (experimental) Run rootless
--prefer-bundled-bin (experimental) Prefer bundled userspace binaries over host binaries
--selinux (agent/node) Enable SELinux in containerd [$K3S_SELINUX]
--lb-server-port value (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) [$K3S_LB_SERVER_PORT]