1kubectl get svc kubernetes

1"hosts": [
2    "${公网访问地址}"（如有）,
3    "${集群内访问地址}",
4    "*.cluster.local", 
5    "127.0.0.1"
6]

1# 准备自建集群的CA证书及配置文件，一般在k8s master节点的 /etc/kubernetes/pki 目录下，获取的相关文件如下:
2$ ls 
3ca-config.json  ca-key.pem  ca.pem
4
5# 设置 CA_PATH 环境变量，将存放CA证书的目录设置为环境变量 ${CA_PATH}
6$ export CA_PATH=`pwd`
7
8# 设置 CA_PROFILE 环境变量，将CA配置文件中定义的证书签发策略名保存到环境变量中
9$ export CA_PROFILE=$(jq -r '.signing.profiles | to_entries[0].key' ca.config)
10
11# 创建vk证书签发的csr文件
12$ cat >vk-csr.json <<EOF
13{
14  "CN": "system:node",
15  "hosts": [
16   "xx.xx.xx.xx", #用户集群的公网访问 IP，如192.168.0.17
17   "yy.yy.yy.yy", #用户集群的集群内访问 IP，如192.168.18.4。可通过kubectl cluster-info获取
18   "*.cluster.local", 
19   "127.0.0.1"
20  ],
21  "key": {
22    "algo": "rsa",
23    "size": 2048
24  },
25  "names": [
26    {
27      "C": "CN",
28      "ST": "BeiJing",
29      "L": "BeiJing",
30      "O": "system:node",
31      "OU": "cloudnative"
32    }
33  ]
34}
35EOF
36
37# 使用cfssl生成证书
38$ cfssl gencert -ca=${CA_PATH}/ca.pem -ca-key=${CA_PATH}/ca-key.pem -config=${CA_PATH}/ca-config.json -profile=${CA_PROFILE} vk-csr.json | cfssljson -bare vk
39
40# 证书文件
41$ ls
42vk.csr  vk-csr.json  vk-key.pem  vk.pem

1# 设置 CA_PATH 以及 CA_PROFILE 变量，方法同上
2$ ls ${CA_PATH}
3ca-config.json  ca-key.pem  ca.pem
4
5# 创建kube-proxy证书签发的csr文件
6$ cat >kube-proxy-csr.json <<EOF
7{
8  "CN": "system:kube-proxy",
9  "hosts": [
10   "xx.xx.xx.xx", #用户集群的公网访问 IP，如192.168.0.17   
11   "yy.yy.yy.yy", #用户集群的集群内访问 IP，如192.168.18.4。可通过kubectl cluster-info获取   
12   "*.cluster.local",
13   "127.0.0.1"
14   ],
15  "key": {
16    "algo": "rsa",
17    "size": 2048
18  },
19  "names": [
20    {
21      "C": "CN",
22      "ST": "BeiJing",
23      "L": "BeiJing",
24      "O": "system:kube-proxy",
25      "OU": "cloudnative"
26    }
27  ]
28}
29EOF
30
31# 使用cfssl生成证书
32$ cfssl gencert -ca=${CA_PATH}/ca.pem -ca-key=${CA_PATH}/ca-key.pem -config=${CA_PATH}/ca-config.json -profile=${CA_PROFILE} kube-proxy-csr.json | cfssljson -bare kube-proxy
33
34# 证书文件
35$ ls
36kube-proxy.csr  kube-proxy-csr.json  kube-proxy-key.pem  kube-proxy.pem

1$ ls
2kube-proxy.csr  kube-proxy-csr.json  kube-proxy-key.pem  kube-proxy.pem  vk.csr  vk-csr.json  vk-key.pem  vk.pem
3
4# 需指定namespace为kube-system
5$ kubectl -n kube-system create secret generic vk-certs --from-file ./ 

1# 需指定namespace为kube-system
2$ kubectl -n kube-system create secret generic vk-aksk \
3  --from-literal=ak=<Your AK> \
4  --from-literal=sk=<Your SK>

1$ helm repo add bce-public https://kubernetes-charts.baidubce.com/public 
2# 需指定namespace为kube-system
3$ helm -n kube-system install vk -f values.yaml bce-public/cce-virtual-kubelet

1# Default values for bci-virtual-kubelet.
2# This is a YAML-formatted file.
3# Declare variables to be passed into your templates.
4
5# Virtual kubelet image. Keep the tag empty to use the default tag.
6images:
7  virtualKubelet: # Virtual kubelet image. Keep the tag empty to use the default tag.
8    repository: "registry.baidubce.com/cce-plugin-pro/bci-virtual-kubelet"
9    tag: "bciv2"
10  kubectl: # Kubectl image. Keep the tag empty to use the default tag.
11    repository: "registry.baidubce.com/cce-plugin-pro/kubectl"
12    tag: ""
13
14# Maximum log backups for virtual kubelet. Each log file will consume 256MiB disk space.
15maximumLogBackups: "4"
16# 必填项，地域简称. 取值项: bj,su,gz,bd,hkg,fwh
17region: ""
18
19# 必填项，用户自建集群的cluster id. 需要保证唯一性。
20clusterID: ""
21
22# Attributes of BCI pods running on the virtual node.
23bci:
24  # Subnet list, specify one subnet at least.
25  # If multiple subnets are specified, one subnet will be randomly chosen for each pod creation attempt.
26  # 必填项，subnets
27  subnets:
28  - zone: ""
29    subnetID: ""
30  - zone: ""
31    subnetID: ""
32  # 必填项，securityGroupID，Security group applied on pod.
33  securityGroupID: ""
34
35# Attributes of virtual node.
36virtualNode:
37  # Virtual node count to create, default 1.
38  nodeCount: 1
39  # The virtual nodes will be named as ${nodeNamePrefix}-0, ${nodeNamePrefix}-1, ...
40  nodeNamePrefix: "bci-virtual-kubelet"
41  # CPU capacity.
42  cpuCapacity: "1000"
43  # Memory capacity.
44  memoryCapacity: "4Ti"
45  # Pods capacity.
46  podsCapacity: "1000"
47  # IPs capacity.
48  ipsCapacity: "1000"
49  # ENIs capacity.
50  enisCapacity: "1000"
51  # Ephemeral-storage capacity.
52  ephemeralStorageCapacity: "40Ti"
53  # Enable NodeLease or not. NodeLease is only available for k8s version > 1.14
54  enableNodeLease: true
55  # Enable pod cache or not.
56  enablePodCache: true
57
58# Keep the endpoints empty to use the default values. Override them if needed.
59endpoints:
60  # 必填项，BCI 在目标地域 OpenAPI Endpoint
61  bci: ""

1affinity:
2  nodeAffinity:
3    requiredDuringSchedulingIgnoredDuringExecution:
4      nodeSelectorTerms:
5      - matchExpressions:
6        - key: type
7          operator: NotInvalues:
8          - virtual-kubelet