Enable Service Topology on k8s

Question

I'm using k8s with kubeadm version 1.17. I'm trying to enable Service Topology feature gates but I can't. Documentation say to use "--feature-gates="ServiceTopology=true,EndpointSlice=true". I tried to use that in "kubeadm init"... But kubeadm say that is not available to the cluster. Can you help me? That is the documentation that I'm following: https://kubernetes.io/docs/tasks/administer-cluster/enabling-service-topology/

Arghya Sadhu · Answer 1 · 2020-07-10T17:27:53.330

3

It's not a flag of kubeadm. You need to enable it for each kubernetes control plane component such as controller manager, API Server, Scheduler, Kube proxy. The yamls for each of these components located at /etc/kubernetes/manifests location on all the master nodes need to be modified to add the feature flag - --feature-gates=ServiceTopology=true

API Server yaml for example

root@kind-control-plane:/# cat /etc/kubernetes/manifests/kube-apiserver.yaml 
apiVersion: v1
kind: Pod
metadata:
  annotations:
    kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 172.18.0.2:6443
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=172.18.0.2
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    - --feature-gates=ServiceTopology=true

Edit:

For kube proxy a custom kubeadm config file need to be created to add the feature flag

apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
...
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
FeatureGates:
  ServiceTopology: true

Reference here

edited Jul 10 '20 at 17:27

answered Jun 09 '20 at 17:25

Arghya Sadhu

41,002
9
78
107

Thank you! So, after the change, how can I apply this changes on my cluster? – Clarencio Jun 09 '20 at 17:34
It will automatically be applied by kubelet..to force apply just remove the yaml from that location and place it back – Arghya Sadhu Jun 09 '20 at 17:36
After the change, I have the following error: "The connection to the server 10.50.11.133:6443 was refused - did you specify the right host or port?" – Clarencio Jun 09 '20 at 17:48
check if API Server pod is running after the change. kubectl get pods -n kube-system – Arghya Sadhu Jun 09 '20 at 17:50
kubectl get pods get the same error, but using "sudo docker ps", I can see that the pod "k8s_POD_kube-apiserver-k8s..." is paused. – Clarencio Jun 09 '20 at 17:54
I tried in my setup and it worked. Have you added the parameter at the end of command section in the yaml? – Arghya Sadhu Jun 10 '20 at 02:59
Thank you, I set " --feature-gates=ServiceTopology=true,EndpointSlice=true" and that works. But my services stopped now. My pods can't connect to my services. – Clarencio Jun 10 '20 at 13:59
You need to create a kubeadm configuration file for that https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init/#kube-proxy – Arghya Sadhu Jun 11 '20 at 17:48
Ok, should I reset cluster with "kubeadm reset"? – Clarencio Jun 11 '20 at 18:01
yeah reset it and init it with a kubeadm config file – Arghya Sadhu Jun 11 '20 at 18:02
Glad to know that worked check this https://stackoverflow.com/help/someone-answers – Arghya Sadhu Jun 12 '20 at 14:31
For the Kube Proxy configuration, the key is actually `featureGates`, not `FeatureGates`. – Exagone313 Nov 27 '21 at 18:09

score 2 · Answer 2 · answered Jul 15 '20 at 18:40

In my case (kubeadm version 1.18.2), it works with the following kubeadm configuration .yaml file (podSubnet is there because I am using Flannel CNI). The key of kube-proxy is "featureGates" as mentioned in https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration

---
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
apiServer:
  extraArgs:
    feature-gates: "ServiceTopology=true,EndpointSlice=true"
controllerManager:
  extraArgs:
    feature-gates: "ServiceTopology=true,EndpointSlice=true"
scheduler:
  extraArgs:
    feature-gates: "ServiceTopology=true,EndpointSlice=true"
networking:
   podSubnet: "10.244.0.0/16"

---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
featureGates:
  ServiceTopology: true
  EndpointSliceProxying: true

Enable Service Topology on k8s

2 Answers2

Linked

Related