How join worker w/o anon access in Kubernetes

readme.md

WORK

cat <<EOF > /etc/kubernetes/auth-config.yaml
apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthenticationConfiguration
anonymous:
  enabled: true
  conditions:
  - path: /livez
  - path: /readyz
  - path: /healthz
EOF

nano /etc/kubernetes/manifests/kube-apiserver.yaml
adds

....
  - --authentication-config=/etc/kubernetes/auth-config.yaml
....
    volumeMounts:
....
    - mountPath: /etc/kubernetes/auth-config.yaml
      name: auth-config-volume
      readOnly: true
....
  volumes:
....
  - name: auth-config-volume
    hostPath:
      path: /etc/kubernetes/auth-config.yaml
      type: File
....
REMOVE: - --anonymous-auth=False
....

--anonymous-auth=True

kubectl patch rolebinding kubeadm:bootstrap-signer-clusterinfo -n kube-public --type='json' -p='[{"op": "add", "path": "/subjects/-", "value": {"apiGroup": "rbac.authorization.k8s.io", "kind": "Group", "name": "system:bootstrappers:kubeadm:default-node-token"}}]'
kubectl delete rolebinding kubeadm:bootstrap-signer-clusterinfo -n kube-public


cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubeadm:bootstrap-signer-clusterinfo
  namespace: kube-public
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeadm:bootstrap-signer-clusterinfo
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: system:anonymous
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:bootstrappers:kubeadm:default-node-token
EOF

или

1. Создаем роль в kube-public с правами на чтение configmap
kubectl create role kubeadm:bootstrap-signer-clusterinfo \
  --namespace=kube-public \
  --resource=configmaps \
  --resource-name=cluster-info \
  --verb=get
2. Привязываем её к группе твоих бутстрап-токенов
kubectl create rolebinding kubeadm:bootstrap-signer-clusterinfo \
  --namespace=kube-public \
  --role=kubeadm:bootstrap-signer-clusterinfo \
  --group=system:bootstrappers:kubeadm:default-node-token
  

cat <<EOF > /etc/kubernetes/bootstraps.conf
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: $(base64 -w 0 /etc/kubernetes/pki/ca.crt)
    server: https://192.168.200.187:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: tls-bootstrap-token-user
  name: tls-bootstrap-token-user@kubernetes
current-context: tls-bootstrap-token-user@kubernetes
users:
- name: tls-bootstrap-token-user
  user:
    token: bu5tiw.iq1i8h3t740fgy0l
EOF

scp /etc/kubernetes/bootstraps.conf 192.168.200.140://etc/kubernetes/bootstraps.conf

cat <<EOF>join-worker.yaml
---
apiVersion: kubeadm.k8s.io/v1beta4
caCertPath: /etc/kubernetes/pki/ca.crt
discovery:
  file:
    kubeConfigPath: "/etc/kubernetes/bootstraps.conf"
kind: JoinConfiguration
nodeRegistration:
  criSocket: unix:///run/containerd/containerd.sock
  imagePullPolicy: IfNotPresent
  imagePullSerial: true
  taints: null
timeouts:
  controlPlaneComponentHealthCheck: 4m0s
  discovery: 5m0s
  etcdAPICall: 2m0s
  kubeletHealthCheck: 4m0s
  kubernetesAPICall: 1m0s
  tlsBootstrap: 5m0s
  upgradeManifests: 5m0s
EOF

root@node140:~# cat join-worker.yaml
---
apiVersion: kubeadm.k8s.io/v1beta4
caCertPath: /etc/kubernetes/pki/ca.crt
discovery:
  file:
    kubeConfigPath: "/etc/kubernetes/bootstraps.conf"
kind: JoinConfiguration
nodeRegistration:
  criSocket: unix:///run/containerd/containerd.sock
  imagePullPolicy: IfNotPresent
  imagePullSerial: true
  taints: null
timeouts:
  controlPlaneComponentHealthCheck: 4m0s
  discovery: 5m0s
  etcdAPICall: 2m0s
  kubeletHealthCheck: 4m0s
  kubernetesAPICall: 1m0s
  tlsBootstrap: 5m0s
  upgradeManifests: 5m0s
root@node140:~#

kubeadm join --config=./join-worker.yaml -v=8
scp /etc/kubernetes/bootstraps.conf 192.168.200.140://etc/kubernetes/bootstraps.conf