How to join worker k8s w/o kubeadm join, or if anonimous is false

readme.md

on master

kubectl get configmap cluster-info -n kube-public -o jsonpath='{.data.kubeconfig}' > /tmp/discovery.conf

kubeadm token create --ttl 0
>>> 4grfmd.izfx5sdn52lt7fig

on worker

kubeadm reset --force
rm -rf /etc/kubernetes/pki
mkdir -p /etc/kubernetes/pki

cat <<EOF>/etc/kubernetes/pki/ca.crt
-----BEGIN CERTIFICATE-----
MIIBejCCASGgAwIBAgIIeOa9v94lCFwwCgYIKoZIzj0EAwIwFTETMBEGA1UEAxMK
a3ViZXJuZXRlczAgFw0yNjA3MTQxODM4MTZaGA8yMDc2MDcwMTE4NDMxNlowFTET
MBEGA1UEAxMKa3ViZXJuZXRlczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJMM
huJIrCC3Z7Oi6sq8YDGZuwRFin4FawxSt4K/+9WtnXLh5L35LYrpIA+izHsmqVi7
f0RLHBhygwQNebL2p0ujWTBXMA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTAD
AQH/MB0GA1UdDgQWBBRVc6svU4o4+Q/5BLvi15sjbXuwvTAVBgNVHREEDjAMggpr
dWJlcm5ldGVzMAoGCCqGSM49BAMCA0cAMEQCIBRML6xXuWS2TPq1Rnx9nYq60e+A
DY9zZX75LpW+giVnAiAStZP7fh9fg8pa0Bowfx/Ban6+BxdFOv0uwJpBsfHjug==
-----END CERTIFICATE-----
EOF

cat <<EOF>/etc/kubernetes/bootstrap-kubelet.conf
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.crt
    server: https://192.168.200.187:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: tls-bootstrap-token-user
  name: tls-bootstrap-token-user@kubernetes
current-context: tls-bootstrap-token-user@kubernetes
users:
- name: tls-bootstrap-token-user
  user:
    token: l3l5x4.l6f25kjdi4ds56ds
EOF

mkdir -p /var/lib/kubelet/
cat <<EOF>/var/lib/kubelet/config.yaml
allowedUnsafeSysctls:
- net.core.somaxconn
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 0s
    cacheUnauthorizedTTL: 0s
cgroupDriver: systemd
cgroupRoot: /
cgroupsPerQOS: true
clusterDNS:
- 10.97.128.10
clusterDomain: cluster.local
containerLogMaxFiles: 5
containerLogMaxSize: 50Mi
containerRuntimeEndpoint: unix:///var/run/containerd/containerd.sock
cpuManagerReconcilePeriod: 0s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 25%
  imagefs.inodesFree: 15%
  memory.available: 500Mi
  nodefs.available: 20%
  nodefs.inodesFree: 10%
evictionMaxPodGracePeriod: 300
evictionMinimumReclaim:
  imagefs.available: 2Gi
  memory.available: 0Mi
  nodefs.available: 500Mi
evictionPressureTransitionPeriod: 5m0s
evictionSoft:
  imagefs.available: 30%
  imagefs.inodesFree: 25%
  memory.available: 500Mi
  nodefs.available: 25%
  nodefs.inodesFree: 15%
evictionSoftGracePeriod:
  imagefs.available: 2m30s
  imagefs.inodesFree: 2m30s
  memory.available: 2m30s
  nodefs.available: 2m30s
  nodefs.inodesFree: 2m30s
fileCheckFrequency: 0s
hairpinMode: hairpin-veth
healthzBindAddress: 127.0.0.1
healthzPort: 10248
httpCheckFrequency: 0s
imageGCHighThresholdPercent: 55
imageGCLowThresholdPercent: 50
imageMaximumGCAge: 0s
imageMinimumGCAge: 0s
kind: KubeletConfiguration
kubeAPIBurst: 100
kubeAPIQPS: 50
kubeReserved:
  cpu: 500m
  ephemeral-storage: 3Gi
  memory: 500Mi
kubeReservedCgroup: /kubelet.slice
kubeletCgroups: /kubelet.slice
logging:
  flushFrequency: 0
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
maxOpenFiles: 1000000
maxParallelImagePulls: 5
maxPods: 20
memorySwap: {}
memoryThrottlingFactor: 0.9
nodeStatusMaxImages: 50
nodeStatusReportFrequency: 20s
nodeStatusUpdateFrequency: 30s
podPidsLimit: 4096
podsPerCore: 5
registerNode: true
resolvConf: /run/systemd/resolve/resolv.conf
rotateCertificates: true
runtimeRequestTimeout: 0s
serializeImagePulls: false
shutdownGracePeriod: 15s
shutdownGracePeriodCriticalPods: 5s
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 0s
syncFrequency: 0s
systemReserved:
  cpu: 500m
  ephemeral-storage: 1Gi
  memory: 1000Mi
tlsCipherSuites:
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
tlsMinVersion: VersionTLS13
volumeStatsAggPeriod: 0s
EOF



cat <<EOF>/etc/systemd/system/kubelet.service.d/10-kubeadm.conf
[Service]
ExecStart=
ExecStart=/usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml
EOF


systemctl daemon-reload
systemctl restart kubelet
systemctl status kubelet

on master

# Посмотреть запросы на сертификат
kubectl get csr -A

# Одобрить запрос для вашей ноды
kubectl certificate approve <имя_найденного_csr>