/sig node

/transfer kubeadm

我移除了节点标签并将其移动到k/kubeadm,但这可能是一个关于kubernetes/kubernetes的工单。将其移回原处。

/transfer kubernetes

我认为这应该是节点。
/sig node
节点负责pod生命周期，并且拥有日志轮转代码。我不确定静态pods的日志轮转是否真的有效。我在文档中看到了一些关于静态pods和日志轮转的提及，但不确定。
https://kubernetes.io/docs/concepts/cluster-administration/logging/#system-component-logs

我认为这应该是节点。
/sig node
节点负责pod生命周期，它们拥有日志轮转代码。我不确定静态pod的日志轮转是否真的有效。我在文档中看到了一些关于静态pod和日志轮转的提及，但不确定。
https://kubernetes.io/docs/concepts/cluster-administration/logging/#system-component-logs
实际上，静态pod的日志轮转运行良好。请参阅以下内容。只有etcd和k8s控制平面的静态pod。
那么kubelet如何确定容器日志应该被轮转？是否有任何apiserver请求它？如果它必须查询apiserver,但apiserver容器本身已关闭/重载。在这种情况下，kubelet可能无法清理之前的etcd/apiserver容器日志。
root@mst1:/var/log/pods/default_static-web-mst1_ab30fcbb6481a1c91aa9873ea51974ff/web# ll
总共24个
drwxr-xr-x 2 root root 4096 Sep 25 21:46 ./
drwxr-xr-x 3 root root 4096 Sep 25 21:28 ../
-rw-r----- 1 root root 5650 Sep 25 21:34 ---------- 3.log
-rw-r----- 1 root root 5649 Sep 25 21:46 ---------- 4.log

什么是API服务器的pod清单？

在这些文档中，它说将静态pod挂载到共享卷可能会导致旋转问题。

Kubelet处理日志旋转。

代码

$ sudo cat etcd.yaml 
apiVersion: v1
kind: Pod
metadata:
  annotations:
    kubeadm.kubernetes.io/etcd.advertise-client-urls: https://10.192.1.21:2379
  creationTimestamp: null
  labels:
    component: etcd
    tier: control-plane
  name: etcd
  namespace: kube-system
spec:
  containers:
  - command:
    - etcd
    - --advertise-client-urls=https://10.192.1.21:2379
    - --cert-file=/k8s/kubernetes/pki/etcd/server.crt
    - --cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
    - --client-cert-auth=true
    - --data-dir=/k8s/etcd
    - --experimental-initial-corrupt-check=true
    - --experimental-watch-progress-notify-interval=5s
    - --initial-advertise-peer-urls=https://10.192.1.21:2380
    - --initial-cluster=tb16-pod1-c1-mm1-master1=https://10.192.1.21:2380
    - --key-file=/k8s/kubernetes/pki/etcd/server.key
    - --listen-client-urls=https://127.0.0.1:2379,https://10.192.1.21:2379
    - --listen-metrics-urls=http://0.0.0.0:2381
    - --listen-peer-urls=https://10.192.1.21:2380
    - --name=tb16-pod1-c1-mm1-master1
    - --peer-cert-file=/k8s/kubernetes/pki/etcd/peer.crt
    - --peer-client-cert-auth=true
    - --peer-key-file=/k8s/kubernetes/pki/etcd/peer.key
    - --peer-trusted-ca-file=/k8s/kubernetes/pki/etcd/ca.crt
    - --snapshot-count=10000
    - --trusted-ca-file=/k8s/kubernetes/pki/etcd/ca.crt
    image: registry.k8s.io/etcd:3.5.9-0
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 8
      httpGet:
        host: 0.0.0.0
        path: /health?exclude=NOSPACE&serializable=true
        port: 2381
        scheme: HTTP
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 15
    name: etcd
    resources:
      requests:
        cpu: 100m
        memory: 100Mi
    startupProbe:
      failureThreshold: 24
      httpGet:
        host: 0.0.0.0
        path: /health?serializable=false
        port: 2381
        scheme: HTTP
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 15
    volumeMounts:
    - mountPath: /k8s/etcd
      name: etcd-k8s
    - mountPath: /k8s/kubernetes/pki/etcd
      name: etcd-certs
  hostNetwork: true
  priorityClassName: system-node-critical
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  volumes:
  - hostPath:
      path: /k8s/kubernetes/pki/etcd
      type: DirectoryOrCreate
    name: etcd-certs
  - hostPath:
      path: /k8s/etcd
      type: DirectoryOrCreate
    name: etcd-k8s
status: {}

/triage accepted