k8s的配置文件说明

一、Master 节点核心配置文件

spec:
  containers:
  - command:
    - --etcd-servers=https://10.0.0.1:2379     # etcd 地址
    - --service-cluster-ip-range=10.96.0.0/12   # Service IP 范围
    - --authorization-mode=Node,RBAC             # 授权模式
    - --client-ca-file=/etc/kubernetes/pki/ca.crt # CA 证书

| /etc/kubernetes/manifests/kube-controller-manager.yaml | Controller Manager | 管理控制器逻辑 |

- command:
  - --cluster-cidr=10.244.0.0/16       # Pod 网络 CIDR
  - --service-account-private-key-file=/etc/kubernetes/pki/sa.key
  - --root-ca-file=/etc/kubernetes/pki/ca.crt

| /etc/kubernetes/manifests/kube-scheduler.yaml | Scheduler | 调度策略配置 |

- command:
  - --kubeconfig=/etc/kubernetes/scheduler.conf
  - --leader-elect=true                # 启用 Leader 选举

二、Worker 节点核心配置文件

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0                     # 监听地址
port: 10250                          # 服务端口
authentication:                      # 认证配置
  webhook:
    enabled: true
evictionHard:                        # 资源驱逐阈值
  memory.available: "500Mi"
  nodefs.available: "10%"

| /etc/kubernetes/kubelet.conf | Kubelet | 集群认证信息 |

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <CA证书Base64>
    server: https://master:6443       # API Server 地址

三、集群级动态配置

kubectl get configmap -n kube-system coredns -o yaml
# 输出示例：
data:
  Corefile: |
    .:53 {
        errors
        health
        kubernetes cluster.local {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
        }
    }

| Secret | 存储敏感数据（如密码、TLS证书） | 加密存储 |

kubectl create secret generic db-password --from-literal=password=123

四、网络插件配置文件

data:
  typha_service_name: "none"       # 是否启用 Typha 服务
  veth_mtu: "1440"                 # 网络 MTU
  ipam:
    type: calico-ipam

| Flannel | /etc/kube-flannel/net-conf.json |

{
  "Network": "10.244.0.0/16",
  "Backend": {"Type": "vxlan"}
}

五、用户级配置文件

apiVersion: v1
clusters:
- cluster:
    server: https://master:6443
    certificate-authority-data: <CA证书>
  name: my-cluster
users:
- name: admin
  user:
    client-certificate-data: <用户证书>
    client-key-data: <用户私钥>
contexts:
- context:
    cluster: my-cluster
    user: admin
  name: my-context

六、关键排查命令

1. 查看动态配置是否生效

# 检查 ConfigMap 是否被 Pod 挂载
kubectl describe pod -n kube-system coredns-xxxx | grep Mounts
# 输出应包含：ConfigMap "coredns" mounted at /etc/coredns

2. 验证证书有效期

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -dates
# 输出示例：
Not Before: Mar  1 00:00:00 2023 GMT
Not After : Mar  1 00:00:00 2024 GMT

3. 检查组件日志

journalctl -u kubelet --since "5 minutes ago" | grep -i error

常见问题定位表

通过此文档，您可以快速定位到关键配置文件，解决类似 ConfigMap 同步失败、证书过期等问题。