►
Description
Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Kubeadm Deep Dive - Rostislav Georgiev, VMware & Rafael Lopez , SUSE
Don’t miss this talk if you want to understand what are the driving forces for kubeadm evolution, if you want to take your first opportunity to influence the roadmap, or, least but not last, if you are considering to step up as a new contributor helping making this happen. We’ll reserve time to talk about how to get involved with SIG Cluster Lifecycle and kubeadm, for all your questions, concerns, and feature requests!
https://sched.co/Zev8
A
Welcome
everyone.
Thank
you
for
joining
thecube
adm
deep
dive.
Today
we
are
going
to
do
an
introduction
of
what
qadm
is.
We
will
also
look
at
what
is
the
current
state
of
qadm
and
what
is
the
future
for
it?
So
for
that
please
rush
with
me,
so
we're
going
to
make
an
introduction.
Please
rush
to
go
ahead.
B
A
Hello,
I'm
rafael,
I
work
for
suse
and
I'm
a
cuba
dm
contributor.
So
let's
get
into
the
contents
of
the
presentation.
So
what
is
qadm
qbd
mistaken
is
not
bootstrapper.
It's
basically
a
tool
to
get
a
new,
viable,
secure
cluster
running
in
a
user-friendly
way.
It's
it's
important
to
note
that
we
have
some
requirements
before
you
can
bootstrap
your
cluster.
A
A
Qpdm
will
not
install
any
cni
for
you
any
cni
plugin,
so
you
have
to
choose
which
cni
compliant.
You
want
to
to
use
and
install
that
after
cube
id
and
has
bootstrapped
your
cluster
on
our
end-to-end
tests,
we
are
using
calico,
but
you
can
use
any
cni
that
is
supported
by
kubernetes
or
vari
that
integrates
with
kubernetes
just
fine.
A
A
So
this
is
part
the
qbdm
is
part
of
the
c-cluster
life
cycle
project
or
the
sig.
So
the
objective
of
this
sig
is
to
simplify
creation,
configuration
upgrade
downgrade
and
tear
down
of
kubernetes
clusters
under
components.
So
qadm
is
like
the
glue
between
the
user
and
the
number
of
components
that
kubernetes
has.
A
In
this
case,
we
can
see
here
diagram.
We
have
a
number
of
components:
a
number
of
projects,
for
example,
each
cdadm
allows
you
to
create
a
number
and
a
number
of
ecb
instances,
a
number
of
ecb
clusters
along
the
lines
of
how
qbdm
allows
you
to
create
a
kubernetes
cluster.
Then
we
have
also
the
cluster
add-ons
project
on
the
sig,
also
cluster
api,
that
we
will
see
that
in
a
second
uses,
qadm
or
can
use
qadm.
A
We
have
a
very
good
base
of
users,
human
people
who
actually
goes
and
runs
or
uses
some
tooling
to
run
cube
adm,
but
from
from
some
time
many
projects
have
started
to
use
qb
as
well
and
to
to
actually
use
that
inside
their
project.
So,
for
example,
we
have
mini
cube,
we
have
kind-
or
we
have
cluster
api.
For
example,
classic
api
has
the
concept
of
bootstrap
provider,
and
the
bootstrap
provider,
for
example,
for
qadm,
allows
you
to
use
cluster
api
that
will
use
qadm
bootstrapper
to
actually
initialize
your
clusters.
A
So
how
does
qbn
work?
We
have
different
ways
of
setting
your
cluster.
One
is
a
single
control,
plane
scheme
and
the
other
is
the
aha
so
for
the
single
control
plane.
Basically,
your
worker
nodes
will
point
directly
to
the
control
plane
node.
So
this
is
a
very
simple
schema,
probably
for
some
kind
of
ci
or
something
that
you
want
to
to
test,
for
example,
in
a
really
fast
way,
and
then
we
have
the
hc
set
up
so
for
the
hc
setup
we
have
the
worker
nodes
that
will
talk
to
you
to
to
the
load.
A
Balancer
will
reach
directly
to
the
load
balancer
that
will
in
turn
load
balance.
All
your
api
servers
on
your
control
planes,
so
qbn
will
take
care
of
of
managing
the
control
planes
or
of
configuring.
The
control
planes,
upgrading
them,
but
qbdn
will
never
manage
your
load
balancer.
So
we
have
documentation
on
how
to
set
up
the
load
balancer,
but
qbdm
is
not
going
to
too
much
the
load
balance
for
you,
so
you
you
have
to
manage
that
in
the
best
way
that
you
are
doing
right
now.
A
So
where
is
the
main
workflow
of
of
qadm,
so
the
main
workflow
is
to
set
up
a
new
cluster.
So
for
that
we
have
to
go
to
the
first
machine
that
we
want
to
to
make
a
control,
plane,
node
and
run
cube
adm
in
it.
After
that
is
done,
we
already
have
an
api
server
controller,
my
scheduler
and
other
components
running
on
top
of
the
cluster,
and
we
want
to
deploy
pod
a
pod
network
addon
a
cni
plugin.
So
for
that
we
can
choose
the
the
cni
plugin
that
we
prefer.
A
As
I
said
before,
we
you
can
use
calico,
for
example,
that
is
running
in
our
end-to-end
testing
and
after
that,
after
that,
that
is
running
and
you
have
the
cni
plugin
ready.
You
can
join
more
control
play
notes,
so
for
that
you
have,
you
only
have
to
run
the
qbm
join
command.
Everything
is
documented.
Our
recommendation
is
pretty
extensive,
so
you,
you
only
have
to
look
to
have
a
look
at
that,
but
in
this
case
you
you
just
say
where
the
control
plane
host
is:
where
is
the
control
plane
port?
A
Where
is
the
token
the
joining
token,
the
bootstrap
token,
the
discovery
token
ci
search
has
so
you
know
that
you
are
reaching
the
the
api
server
that
you
expect.
There
is
no
money
in
the
media
happening.
You
say
that
this
is
a
control
plane
and
then
you
pass
on
the
certificate
key.
So
the
certificate
is
for
decrypting
some
secrets
that
were
upgraded
on
the
qbd.
A
We
need
some
certificates
that
were
auto
generated
and
uploaded
to
the
cluster
after
it
was
initialized
and
and
so,
if
you
join
more
control
planes,
you
want
an
hca
setup.
You
want
these
secrets
to
be
decrypted
and
the
certificate
key
is
how
it's
decrypted.
So
after
you
have
joined
these
these
optional
secondary
control
planes,
you
can
go
ahead
and
join
worker
notes.
A
A
That
is
in
front
of
all
your
api
servers,
but
this
can
be.
It
depends
on
your
setup,
so
you
again
use
the
token
the
bootstrap
token,
so
the
cubelet
in
this
workout
will
be
able
to
join
the
current
cluster
and
the
register
itself
and
then
again
the
discovery
token
ci
cert
has
so
it
again
knows
what
it's
reaching
to
and
it
can
validate
that,
but
qbdm
is
not
only
for
bootstrapping.
Qvdm
can
also
upgrade
your
cluster.
So
where
is
the
upgrade
workflow
of
qvdm?
A
A
I
I
have
this
version
of
kubernetes,
please
that
which
version
of
currencies
I
have
and
please
check
if
there
are
new
versions
available
released
so
now,
qbdm
upgrade
bank
will
tell
you
not
only
the
currencies
versions
but
also
other
atoms
like,
for
example,
core
dns
or
other
other
add-ons,
and
then
you
can
actually
upgrade
your
cluster.
If
you,
if
you
want
to
so
you
only
have
to
run
qadm
upgrade
apply
on
your
first
control,
plane
node.
It
doesn't
need
to
be
the
control
plane
where
you
bootstrapped.
A
If
you
have
any,
if
you
don't
have
an
hci
setup,
then
you
only
go
directly
with
the
workers
and
then
you
rank
uadm
upgrade
node
on
all
of
them
secondary
control,
planes
and
worker
nodes,
and
this
will
basically
read
the
configuration
and
see
what
needs
to
to
move
to.
So,
let's
see
what
is
deployed
when
we
deploy
a
control
plane
with
qbdm,
so
you
can
see
the
blue
boxes,
which
are
kubernetes
components,
the
the
part
where
we
are
talking
about
the
control
plane.
A
It's
basically
cube
controller
manager,
cube
scheduler,
cube
api
server
and
cube
proxy.
You
can
mix
and
match
and
remove
some
of
these
components.
But
this
is
the
default
setup.
So
we
are
going
to
focus
on
this
one.
So
it
will.
It
will
also
deploy
core
dns
as
a
as
an
addon.
Also
we
have
hcd,
which
is
something
that
we
also
deploy
as
a
static,
manifest
the
same
as
our
the
rest
of
the
control
plane.
A
But
the
ecd
is
only
running
on
the
control
plane
nodes
you
need
to
have
you
need
for
control
planes
to
talk
to
each
other
in
order
for
it
to
be
to
be
able
to
work
properly,
and
then
you
have
the
cni
plugin
pod
that
you
deployed
on
on
top
of
it.
This
will
typically
run
across
all
your
all
your
nodes,
control,
pane
and
worker
nodes,
and
then
on
your
worker
nodes.
A
You
only
have
the
cni
plugin
pod
that
we
said
before
cube
proxy
from
from
qedm
and
then
your
your
regular
workload.
So
that
is
basically
it,
and
that
is
what
is
deployed
and
we
try
to
make
it
minimal.
So
it's
it's
really
easy
for
you,
so
we
we
were
talking
before
about
the
config.
So
we,
when
we
upgrade,
we
read
the
configuration
that
we
are
running
actually
right
now
of
kubernetes,
so
we
know
there's
a
new
version
available.
Where
is
this?
Where
is
displaced?
A
So
this
is
a
configuration
map
living
on
the
namespace
keep
system,
it's
called
qedm
config,
and
this
contains
the
cluster
configuration
and
the
cluster
status
objects
that
basically
qadm
uses
and
upgrades,
or
touches
or
updates.
In
order
to
to
know
what
is
the
current
state
of
your
cluster
and
also
to
compare
that
to
a
future
state.
For
example,
if
you
are
trying
to
upgrade-
or
you
are
trying
to
do
something
else,
so
qbm
will
basically
download
this
config
map.
A
A
A
You
can
also
customize
your
static
pots,
so
qedm
will
write
the
static
pulse
that
qlik
brings
them
up.
So
for
this,
these
components
that
we
were
talking
before
each
cd
and
keyword,
these
components,
control,
plane,
components
you
could
use
customize
before
in
order
to
to
customize
these
static
pots.
But
this
changed
ros
will
we'll
talk
about
that
in
a
second
qatm
also
has
certificate
management,
so
it
can
create
certificates.
You
can
reuse
your
certificates.
A
If
you
provide
them,
it
will
also
renew
them
if
it
can,
if
it,
if
it
has
the
the
ca
and
the
key
for
the
ca,
so
qbdm
will,
in
general,
take
care
of
all
this.
For
you,
qbdm
has
a
managed
lcd
mode,
the
default
one.
We
call
this
the
stacked
ecd.
You
can
also
use
external
hcd
if
you
want
by
by
providing
this
into
the
configuration,
but
by
default.
Qbn
will
just
manage
this
for
you,
so
you
don't
you
don't
have
to
worry
about
that.
A
Even
on
nha
environments,
then
we
are
deploying
the
standard
add-ons
core
dns
and
qproxy
proxy,
so
you
can
opt
off,
opt
out
of
them,
but
by
default
they
are,
they
are
provided,
and
then
we
have
phase
support
so
on
the
workflow
that
we
were
seeing.
So
we
seen
before
all
these
phases
will
be
run
one
after
the
other,
but
you
can
instead
of
running
the
whole
workflow
just
run
the
parts
that
you
you
care
about.
The
part
that
you
want
to
run.
A
B
B
They
are
much
more
lighter
and
simpler
to
use
than
the
old
customized
patches
and
but
they're
basically
used
in
the
same
way
as
nice,
patches
to
patch
static
pots
on
a
per
node
basis,
as
we
are
actually
trying
to
deploy
a
control
plane.
Node
these
patches
are
specified
to
cubate
them
using
a
specific
directory
full
of
different
patches.
B
These,
for
example,
you
can
see
a
couple
of
patches
here
in
action.
The
first
touch
on
the
top
left
is
a
strategic
patch
in
yamo
format.
That's
going
to
be
applied
against
the
control
manager,
port
and
it's
going
to
introduce
a
new
annotation
called
the
externation,
with
a
value
of
hell
to
the
start.
Part
of
the
control
manager-
the
second
touch
here
on
the
right
is
being
applied
against
the
hcd
static
pot
and
it's
using
the
merge
strategy
in
joyson
json
format.
B
Another
thing
that
we
are
actually
preparing
for
you
on
in
119
is
some
component
config
updates.
Now
most
of
the
component
updates
are
actually
happening
under
the
hood,
but
in
119
you
can
see
that
we
have
actually
introduced
a
new
component.
Config
state
table.
That's
going
to
be
printed
out
at
the
end
of
the
cuban
upgrade
plan
command.
This
state
table
actually
shows
you
the
different
component
config
api
groups,
the
current
version
and
the
preferred
versions
of
these
configs.
B
Now
this
is
effort
is
actually
put
on
a
pulse
right
now,
simply
because
it
requires
a
lot
of
different
changes
to
ci
and
release
infrastructure.
It
also
requires
a
little
bit
thinking
on
how
versioning
is
going
to
be
applied
and
stuff
like
that,
so
we
are
currently
posing
on
that,
but
this
is
one
of
the
future
items
that
we
are
actively
looking
into.
B
B
B
Now
these
common
line
options
usually
take
something
like
hundreds
of
different
types,
so
it's
like
it's
good
to
just
put
them
in
a
single,
well-structured
object
and
have
that
supplied
instead
of
having
quite
long
command
line
command
lines
to
different
components.
So
this
is
why
we
are
trying
to
actually
implement
the
component
config
support
for
components
that
actually
supply
such
support
to
them.
So
we're
looking
forward
into
improving
the
ux
here
dramatically
and
have
this
implemented
with
regards
to
qbm
standard
configuration.
B
B
Integrating
with
custeratones
is
really
nice
because
to
allow
qblm
to
stop
maintaining
some
of
the
add-ons,
and
this
will
make
our
call
base
much
more
narrower
and
a
lot
less
buggy
also
trimming
the
issue
backlog
is
on
our
agenda.
Currently
we
have
a
little
bit
more
than
20
issues
in
our
tracker,
but
this
is
not
too
much
it's
not
too
little,
but
it
needs
tackling
too.
B
B
B
The
first
option
is
reaching
to
us
on
slack.
We
are
active
in
the
sequester
life
cycle
channels
in
the
equipment
channel.
The
sea
cluster
lifecycle
channel
is
a
little
bit
more
development
oriented
channel,
and
the
cuban
channel
is
a
little
bit
more
user-oriented
one.
Both
of
these
channels
are
on
kubernetes.
B
Another
thing
is
that
we
have
weekly
meetings
each
wednesday
at
9,
00,
9
00
am
a
year
specific
time,
a
link
to
the
google
doc
containing
the
agenda
and
the
zoom
link
can
be
found
on
the
bottom.
But
in
order
to
access
that
document,
you
first
have
to
join
our
google
group,
that
is,
the
google
group
for
kubernetes
sequester
lifecycle.
B
Thanks
to
these
folks,
here
kubernetes
has
been
brought
to
you
for
the
past
year
and
a
half
to
two
years.
Of
course,
there
are
many
other
contributors,
one
that
came
before
those
and
the
ones
that
did
some
simple
patches
over
the
past
two
years,
but
these
are
the
major
contributors
and
the
folks
that
who
actually
look
after
and
take
care
of
puberty.
B
B
This
survey
is
a
really
nice
one
and
it
covers
both
high
level
questions,
as
well
as
different
questions
regarding
different
projects
that
are
under
the
hat
of
a
sequester
life
cycle
to
access
that
survey.
Please
use
the
qr
code
showed
here
and
remember
that
when
you
actually
fill
in
that
survey,
you
actually
great
help
different
projects
in
the
city
as
a
whole.