k8s镜像源

registry.k8s.io:

mirrors.sjtug.sjtu.edu.cn/registry.k8s.io 
registry-k8s-io.mirrors.sjtug.sjtu.edu.cn

mirrors.sjtug.sjtu.edu.cn/k8s.gcr.io 
k8s-gcr-io.mirrors.sjtug.sjtu.edu.cn

metrics.yaml

--kubelet-insecure-tls=True

cd /data/work
cat > proxy-client-csr.json <<EOF
{
  "CN": "aggregator",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Guangdong",
      "L": "Shenzhen",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}

EOF

cfssl gencert  -profile=kubernetes  -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json  proxy-client-csr.json | cfssljson -bare proxy-client

cp -a proxy-client*.pem    /etc/kubernetes/ssl/



kube-apiserver.conf
 --enable-aggregator-routing=true \
 --runtime-config=api/all=true \
 --requestheader-allowed-names=aggregator \
 --requestheader-group-headers=X-Remote-Group \
 --requestheader-username-headers=X-Remote-User \
 --requestheader-extra-headers-prefix=X-Remote-Extra- \
 --requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \
 --proxy-client-cert-file=/etc/kubernetes/ssl/proxy-client.pem \
 --proxy-client-key-file=/etc/kubernetes/ssl/proxy-client-key.pem \