kubectl get svc kubernetes

"hosts": [
    "${公网访问地址}"（如有）,
    "${集群内访问地址}",
    "*.cluster.local", 
    "127.0.0.1"
]

# 准备自建集群的CA证书及配置文件，一般在k8s master节点的 /etc/kubernetes/pki 目录下，获取的相关文件如下:
$ ls 
ca-config.json  ca-key.pem  ca.pem

# 设置 CA_PATH 环境变量，将存放CA证书的目录设置为环境变量 ${CA_PATH}
$ export CA_PATH=`pwd`

# 设置 CA_PROFILE 环境变量，将CA配置文件中定义的证书签发策略名保存到环境变量中
$ export CA_PROFILE=$(jq -r '.signing.profiles | to_entries[0].key' ca.config)

# 创建vk证书签发的csr文件
$ cat >vk-csr.json <<EOF
{
  "CN": "system:node",
  "hosts": [
   "xx.xx.xx.xx", #用户集群的公网访问 IP，如192.168.0.17
   "yy.yy.yy.yy", #用户集群的集群内访问 IP，如192.168.18.4。可通过kubectl cluster-info获取
   "*.cluster.local", 
   "127.0.0.1"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:node",
      "OU": "cloudnative"
    }
  ]
}
EOF

# 使用cfssl生成证书
$ cfssl gencert -ca=${CA_PATH}/ca.pem -ca-key=${CA_PATH}/ca-key.pem -config=${CA_PATH}/ca-config.json -profile=${CA_PROFILE} vk-csr.json | cfssljson -bare vk

# 证书文件
$ ls
vk.csr  vk-csr.json  vk-key.pem  vk.pem

# 设置 CA_PATH 以及 CA_PROFILE 变量，方法同上
$ ls ${CA_PATH}
ca-config.json  ca-key.pem  ca.pem

# 创建kube-proxy证书签发的csr文件
$ cat >kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "hosts": [
   "xx.xx.xx.xx", #用户集群的公网访问 IP，如192.168.0.17   
   "yy.yy.yy.yy", #用户集群的集群内访问 IP，如192.168.18.4。可通过kubectl cluster-info获取   
   "*.cluster.local",
   "127.0.0.1"
   ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:kube-proxy",
      "OU": "cloudnative"
    }
  ]
}
EOF

# 使用cfssl生成证书
$ cfssl gencert -ca=${CA_PATH}/ca.pem -ca-key=${CA_PATH}/ca-key.pem -config=${CA_PATH}/ca-config.json -profile=${CA_PROFILE} kube-proxy-csr.json | cfssljson -bare kube-proxy

# 证书文件
$ ls
kube-proxy.csr  kube-proxy-csr.json  kube-proxy-key.pem  kube-proxy.pem

$ ls
kube-proxy.csr  kube-proxy-csr.json  kube-proxy-key.pem  kube-proxy.pem  vk.csr  vk-csr.json  vk-key.pem  vk.pem

# 需指定namespace为kube-system
$ kubectl -n kube-system create secret generic vk-certs --from-file ./ 

# 需指定namespace为kube-system
$ kubectl -n kube-system create secret generic vk-aksk \
  --from-literal=ak=<Your AK> \
  --from-literal=sk=<Your SK>

$ helm repo add bce-public https://kubernetes-charts.baidubce.com/public 
# 需指定namespace为kube-system
$ helm -n kube-system install vk -f values.yaml bce-public/cce-virtual-kubelet

# Default values for bci-virtual-kubelet.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Virtual kubelet image. Keep the tag empty to use the default tag.
images:
  virtualKubelet: # Virtual kubelet image. Keep the tag empty to use the default tag.
    repository: "registry.baidubce.com/cce-plugin-pro/bci-virtual-kubelet"
    tag: "bciv2"
  kubectl: # Kubectl image. Keep the tag empty to use the default tag.
    repository: "registry.baidubce.com/cce-plugin-pro/kubectl"
    tag: ""

# Maximum log backups for virtual kubelet. Each log file will consume 256MiB disk space.
maximumLogBackups: "4"
# 必填项，地域简称. 取值项: bj,su,gz,bd,hkg,fwh
region: ""

# 必填项，用户自建集群的cluster id. 需要保证唯一性。
clusterID: ""

# Attributes of BCI pods running on the virtual node.
bci:
  # Subnet list, specify one subnet at least.
  # If multiple subnets are specified, one subnet will be randomly chosen for each pod creation attempt.
  # 必填项，subnets
  subnets:
  - zone: ""
    subnetID: ""
  - zone: ""
    subnetID: ""
  # 必填项，securityGroupID，Security group applied on pod.
  securityGroupID: ""

# Attributes of virtual node.
virtualNode:
  # Virtual node count to create, default 1.
  nodeCount: 1
  # The virtual nodes will be named as ${nodeNamePrefix}-0, ${nodeNamePrefix}-1, ...
  nodeNamePrefix: "bci-virtual-kubelet"
  # CPU capacity.
  cpuCapacity: "1000"
  # Memory capacity.
  memoryCapacity: "4Ti"
  # Pods capacity.
  podsCapacity: "1000"
  # IPs capacity.
  ipsCapacity: "1000"
  # ENIs capacity.
  enisCapacity: "1000"
  # Ephemeral-storage capacity.
  ephemeralStorageCapacity: "40Ti"
  # Enable NodeLease or not. NodeLease is only available for k8s version > 1.14
  enableNodeLease: true
  # Enable pod cache or not.
  enablePodCache: true

# Keep the endpoints empty to use the default values. Override them if needed.
endpoints:
  # 必填项，BCI 在目标地域 OpenAPI Endpoint
  bci: ""

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: type
          operator: NotInvalues:
          - virtual-kubelet