env-check Configuration File (config.json) Analysis of Check Item Meanings and Impacts ​

env-check is distributed to each node via the run command to execute run-local, performing the following 8 checks on each node (run.go:167):

kernel, port, disk, clock, fileQuery, programCheck, route, iptables

log_file ​

Meaning: All log output from the check process is written to this file, including the start, pass, warning, and failure information for each check item.

Impact: Only affects the env-check tool's own logging, unrelated to BKE initialization.

output_format ​

Meaning: Controls the output format of the check results. text is suitable for command-line viewing, json is suitable for programmatic parsing.

Impact: Only affects the report display format, unrelated to BKE initialization.

paths (File Conflict Check — fileQuery) ​

Check Mechanism ​

Implemented via FileQuery.Execute() in pkg/query/query.go: for each path, it expands environment variables (such as $HOME) and wildcards (such as kube*), then checks whether the file/directory exists. If it exists, it is marked as a "conflict".

Check result determination (run.go:360-367):

• TotalExists == 0 → pass (all residual paths do not exist)
• TotalExists > 0 → fail (residual files exist)

14 Paths in Current Configuration ​

clean_force ​

Meaning:

• false: Interactively asks the user [y/n] before deleting each residual file.
• true: Skips confirmation and directly deletes all residual files.

Impact: Only affects the behavior in fileClean mode. The current configuration is false, deletion operations require the user to confirm one by one, preventing accidental deletion.

program_list (Program Check — programCheck) ​

Check Mechanism ​

Implemented via ApplicationChecker.Execute() in pkg/program/check.go: for each program, it uses exec.LookPath(name) to detect whether it can be found in PATH, then compares with the should_exist expected value.

Check result determination (run.go:396-403):

• TotalFailed == 0 → pass (all programs match the expected state)
• TotalFailed > 0 → fail (some programs do not match the expected state)

4 Programs in Current Configuration ​

Program Check Summary ​

hosts (Host List) ​

Current Configuration ​

Meaning: Defines the list of target hosts that env-check needs to check. The role of each host determines which port checks are performed (the port list corresponding to the role in port_check.ports).

Impact:

• In dispatch mode, env-check distributes its own binary to each host and executes checks remotely via SSH.
• role is used for role matching in port checks (port/check.go:130-155): the bootstrap role performs "bootstrap node port checks", master performs "Master node port checks", worker performs "Worker node port checks".
• The clock_threshold clock check also requires the hosts list (obtains the time of each host via SSH and compares with the local time).

clock_threshold (Clock Synchronization Check — clock) ​

Check Mechanism ​

Implemented via CheckerClock.Execute() in pkg/clock/clock.go: connects to each host via SSH to obtain the remote time, compares it with the local time, and calculates the time difference. If the time difference between any two hosts exceeds clock_threshold seconds, the check fails.

Impact ​

Note: The runClockCheck() in the current run.go:327-333 only returns the local time and marks it as pass. The actual multi-host clock comparison is performed by CheckerClock.Execute() in dispatch mode.

kernel_check (Kernel Version Check — kernel) ​

Check Mechanism ​

Implemented via Checker.Execute() in pkg/kernel/check.go: uses gopsutil/host.Info() to obtain the kernel version, and compares it with min_version according to operator.

Special handling (check.go:97-115): special judgment for the 3.10.0-xxx kernel of CentOS 7 (with old-style build number) — even if the version number >= 4.19, if the 3.10.0 prefix is detected with an old-style build number, it is also judged as not meeting the >= condition.

Impact ​

port_check (Port Occupancy Check — port) ​

Check Mechanism ​

Implemented via Checker.Execute() in pkg/port/check.go: selects the corresponding port list based on the node role, and performs a TCP dial to 127.0.0.1:<port> for each port. If the connection succeeds, the port is occupied. It can also identify the occupying process via gopsutil.

Check result determination (run.go:274-280):

• Used == 0 → pass (all ports are free)
• Used > 0 → fail (occupied ports exist)

Current Configuration ​

Bootstrap Ports (5) ​

Among them, ports 36443, 40080, 40443, and 38080 are configurable. If specific ports are used in bke init, they need to be replaced with the corresponding ports to check.

Master Ports (13) ​

Port 1338 is bound to 127.0.0.1 (loopback address), configured by the ContainerdConfig CR (metricsAddress: "127.0.0.1:1338"), and capbke reads this CR and renders it into the containerd config.toml on cluster nodes. The containerd on the bootstrap node uses bkeadm's own template ([metrics] address = ''), does not enable metrics, so the bootstrap port list does not include 1338.

Worker Ports (7) ​

Port Check Summary ​

disk_check (Disk Space Check — disk) ​

Check Mechanism ​

Implemented via Checker.Execute() in pkg/disk/check.go: for each check_items entry, uses gopsutil/disk.Usage() to obtain the disk usage of the specified path, and compares the Free space with MinFreeGB * 1GB.

If the path does not exist, it automatically searches upward for the mount point of the parent directory. If the check_items entry has a roles field configured, only nodes matching the role are checked (the current configuration does not set roles, so all nodes are checked).

Check result determination (run.go:315-322):

• InsufficientPath == 0 → pass (all paths have sufficient space)
• InsufficientPath > 0 → fail (paths with insufficient space exist)

Current Configuration Analysis ​

Impact ​

dispatch (Distribution Configuration) ​

Meaning of Each Field ​

Impact ​

Note: The dispatch configuration only affects the distribution behavior of the env-check tool, and is unrelated to BKE initialization.

route and iptables Checks ​

These two checks are executed by default in run-local (run.go:167), but are not explicitly configured in config.json — they use fixed logic and do not depend on configuration parameters.

route (Default Route Check) ​

Check Mechanism (pkg/route/route.go): executes the route -n command to parse the routing table and checks whether a default route exists. If there is no default route, the node's network configuration is abnormal, which may cause communication failure between BKE components.

Impact: Nodes without a default route cannot access the external network (pulling images, downloading binaries, etc.), and BKE initialization fails.

iptables (FORWARD Chain Policy Check) ​

Check Mechanism (pkg/iptables/iptables.go): executes the iptables -L FORWARD -n command to check whether the default policy of the FORWARD chain is ACCEPT.

Impact: If the FORWARD chain policy is DROP, cross-node communication between Kubernetes Pods will be dropped by iptables, causing network unreachability. Calico CNI relies on the FORWARD chain to forward Pod traffic. bkeadm's prepareEnvironment() installs iptables and switches to legacy mode, but does not set the FORWARD policy — this is the responsibility of capbke env init (sets iptables rules in init.go).