語法
[09:33:04 root@ceshi-01 ~ $]kubeadm join --help
When joining a kubeadm initialized cluster, we need to establish bidirectional trust.
在加入 kubeadm 集群初始化時(shí)，我們需要建立雙向信任
This is split into discovery (having the Node trust the Kubernetes Control Plane) and TLS bootstrap (having the Kubernetes Control Plane trust the Node).
這被分為發(fā)現(xiàn)（使節(jié)點(diǎn)信任 Kubernetes 控制平面）和 TLS 引導(dǎo)（使 Kubernetes 控制平面信任節(jié)點(diǎn)）
There are 2 main schemes for discovery.
有兩種主要的發(fā)現(xiàn)方案
The first is to use a shared token along with the IP address of the API server.
第一種是使用共享令牌以及 API Server 的 IP 地址
The second is to provide a file - a subset of the standard kubeconfig file.
第二種是使用文件：標(biāo)準(zhǔn)的 kubeconfig 文件的子集
This file can be a local file or downloaded via an HTTPS URL.
此文件可以是本地文件割去，也可以通過 HTTPS URL 下載
The forms are
kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443,
kubeadm join --discovery-file path/to/file.conf,
or
kubeadm join --discovery-file https://url/file.conf.
Only one form can be used.
只能使用一種表格
If the discovery information is loaded from a URL, HTTPS must be used.
如果使用從 URL 加載發(fā)現(xiàn)信息，則必須使用 HTTPS
Also, in that case the host installed CA bundle is used to verify the connection.
此外挖胃，在這種情況下，主機(jī)安裝的 CA 證書用于驗(yàn)證鏈接
If you use a shared token for discovery,
如果您使用共享令牌進(jìn)行發(fā)現(xiàn)
you should also pass the --discovery-token-ca-cert-hash flag to validate the public key of the root certificate authority (CA) presented by the Kubernetes Control Plane.
您還應(yīng)該傳遞 --discovery-token-ca-cert-hash 標(biāo)志來驗(yàn)證 Kubernetes 控制平面提供的跟證書頒發(fā)機(jī)構(gòu)（CA）的公鑰
The value of this flag is specified as "<hash-type>:<hex-encoded-value>", where the supported hash type is "sha256".
此標(biāo)志的值指定為："<hash-type>:<hex-encoded-value>"景描，其中支持的哈希類型為："sha256".
The hash is calculated over the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469).
散列是在主題公鑰信息（SPKI）對象的字節(jié)上計(jì)算的（如RFC7469中所示）霸褒。
This value is available in the output of "kubeadm init" or can be calculated using standard tools.
該值在“kubeadm init”的輸出中可用，或者可以使用標(biāo)準(zhǔn)工具計(jì)算锰镀。
The --discovery-token-ca-cert-hash flag may be repeated multiple times to allow more than one public key.
--discovery-token-ca-cert-hash 標(biāo)志可以重復(fù)多次以允許多個(gè)公鑰。
If you cannot know the CA public key hash ahead of time,
如果您無法提前知道CA公鑰哈希咖刃，
you can pass the --discovery-token-unsafe-skip-ca-verification flag to disable this verification.
您可以傳遞--discovery-token-unsafe-skip-ca-verification標(biāo)志來禁用此驗(yàn)證泳炉。
This weakens the kubeadm security model since other nodes can potentially impersonate the Kubernetes Control Plane.
這削弱了kubeadm安全模型，因?yàn)槠渌?jié)點(diǎn)可能會冒充Kubernetes控制平面嚎杨。
The TLS bootstrap mechanism is also driven via a shared token.
TLS引導(dǎo)機(jī)制也通過共享令牌驅(qū)動(dòng)花鹅。
This is used to temporarily authenticate with the Kubernetes Control Plane to submit a certificate signing request (CSR) for a locally created
key pair.
這用于臨時(shí)通過Kubernetes控制平面進(jìn)行身份驗(yàn)證，以便為本地創(chuàng)建的密鑰對提交證書簽名請求（CSR）枫浙。
By default, kubeadm will set up the Kubernetes Control Plane to automatically approve these signing requests.
默認(rèn)情況下刨肃，kubeadm將設(shè)置Kubernetes控制平面以自動(dòng)批準(zhǔn)這些簽名請求古拴。
This token is passed in with the --tls-bootstrap-token abcdef.1234567890abcdef flag.
此令牌使用 --tls-bootstrap-token abcdef.1234567890abcdef 標(biāo)志傳入。
Often times the same token is used for both parts. In this case, the --token flag can be used instead of specifying each token individually.
通常真友，兩個(gè)部分都使用相同的標(biāo)記黄痪。 在這種情況下，可以使用--token標(biāo)志盔然，而不是單獨(dú)指定每個(gè)標(biāo)記桅打。
The "join [api-server-endpoint]" command executes the following phases:
“join [api-server-endpoint]”命令執(zhí)行以下階段：
```
preflight Run join pre-flight checks
運(yùn)行加入飛行前檢查
control-plane-prepare Prepare the machine for serving a control plane
準(zhǔn)備機(jī)器以服務(wù)控制平面
/download-certs [EXPERIMENTAL] Download certificates shared among control-plane nodes from the kubeadm-certs Secret
/certs Generate the certificates for the new control plane components
/kubeconfig Generate the kubeconfig for the new control plane components
/control-plane Generate the manifests for the new control plane components
kubelet-start Write kubelet settings, certificates and (re)start the kubelet
control-plane-join Join a machine as a control plane instance
/etcd Add a new local etcd member
/update-status Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap
/mark-control-plane Mark a node as a control-plane
```
用法:
kubeadm join [api-server-endpoint] [flags]
kubeadm join [command]
可用命令:
phase Use this command to invoke single phase of the join workflow
使用此命令可以調(diào)用連接工作流的單個(gè)階段
Flags:
--apiserver-advertise-address string If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on.
如果此節(jié)點(diǎn)要托管一個(gè)新的控制平面，那么應(yīng)該告訴 API Server 需要監(jiān)聽的 IP 地址
If not set the default network interface will be used.
如果未設(shè)置愈案，將使用默認(rèn)網(wǎng)絡(luò)接口挺尾。
--apiserver-bind-port int32 If the node should host a new control plane instance, the port for the API Server to bind to. (default 6443)
如果節(jié)點(diǎn)承載新的控制明面示例，此端口用于要綁定的 API Server 端口（默認(rèn)6443）
--certificate-key string Use this key to decrypt the certificate secrets uploaded by init.
使用此密鑰解密init上載的證書機(jī)密站绪。
--config string Path to kubeadm config file.
kubeadm 配置文件路徑
--control-plane Create a new control plane instance on this node
在此節(jié)點(diǎn)上創(chuàng)建一個(gè)新的控制平面
--cri-socket string Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value;
要連接的CRI套接字的路徑遭铺。 如果空kubeadm將嘗試自動(dòng)檢測此值;
use this option only if you have more than one CRI installed or if you have non-standard CRI socket.
僅當(dāng)您安裝了多個(gè)CRI或具有非標(biāo)準(zhǔn)CRI套接字時(shí)才使用此選項(xiàng)。
--discovery-file string For file-based discovery, a file or URL from which to load cluster information.
對于基于文件的發(fā)現(xiàn)恢准，從中加載集群信息的文件或URL魂挂。
--discovery-token string For token-based discovery, the token used to validate cluster information fetched from the API server.
或基于令牌的發(fā)現(xiàn)，用于驗(yàn)證從API服務(wù)器獲取的集群信息的令牌顷歌。
--discovery-token-ca-cert-hash strings For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").
對于基于令牌的發(fā)現(xiàn)锰蓬，請驗(yàn)證根CA公鑰是否與此哈希匹配（格式：“<type>：<value>”）幔睬。
--discovery-token-unsafe-skip-ca-verification For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.
對于基于令牌的發(fā)現(xiàn)眯漩，允許在沒有--discovery-token-ca-cert-hash固定的情況下加入。
-h, --help help for join
顯示幫助信息
--ignore-preflight-errors strings A list of checks whose errors will be shown as warnings.
將錯(cuò)誤顯示為警告麻顶，也就是忽略某些錯(cuò)誤以繼續(xù)安裝
Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.
例如：IsPrivilegedUser,Swap赦抖，如果值為 all 將忽略所有錯(cuò)誤
--node-name string Specify the node name.
指定節(jié)點(diǎn)名稱
--skip-phases strings List of phases to be skipped
要跳過的節(jié)點(diǎn)列表
--tls-bootstrap-token string Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.
在加入節(jié)點(diǎn)時(shí)，指定用于臨時(shí)通過Kubernetes控制平面進(jìn)行身份驗(yàn)證的令牌辅肾。
--token string Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.
如果未提供這些值队萤，請將此標(biāo)記用于discovery-token和tls-bootstrap-token。
Global Flags:
--log-file string If non-empty, use this log file
--log-file-max-size uint Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
--rootfs string [EXPERIMENTAL] The path to the 'real' host root filesystem.
--skip-headers If true, avoid header prefixes in the log messages
--skip-log-headers If true, avoid headers when opening log files
-v, --v Level number for the log level verbosity
Use "kubeadm join [command] --help" for more information about a command.
