<p>I want to execute command on GCP GKE node but I need to do it without manually sshing to the machine.</p>
<p>What I need:</p>
<ol>
<li>adding ntp.keys</li>
<li>configuring ntp.conf</li>
<li>restart ntp daemon (here I encountered a problem)</li>
</ol>
<p>Point 1 and 2 can be easly achived with DaemonSet. I mounted /etc/ntp/ directory to init container and created right files. Unofrtunately point 3 seems to be impossible. Is there any way I can run &quot;systemctl restart ntp&quot; on each node of the cluster?</p>
<p>My problem is mainly due to GCP API does not provide nodes endpoint so I can't get IPs of nodes and then run ansible to perform NTP configuration.
The goal is to **automatically **</p>
<ol>
<li>provision cluster (with terraform)</li>
<li>configure NTP client on each node</li>
</ol>

<p>You are on the right path, If you don't want to SSH into the node and manual job, what you can do is like create one <strong>Daemonset</strong> and automate <strong>SSH</strong> process.</p>
<p><strong>Daemonset</strong> runs on all available <strong>nodes</strong> in <strong>Cluster</strong>. You can mount your <strong>shell</strong> <strong>script</strong> to <strong>Node</strong> path and <strong>execute</strong> it by doing <strong>SSH</strong> from <strong>Image</strong>.</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: daemonset-access
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cron-namespace-admin-rbac
subjects:
  - kind: ServiceAccount
    name: daemonset-access
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: umalog
  labels:
    k8s-app: umalog
spec:
  selector:
    matchLabels:
      name: umalog
  template:
    metadata:
      labels:
        name: umalog
    spec:
      serviceAccountName: daemonset-access
      securityContext:
        fsGroup: 1000
      containers:
      - command:
        - bash
        - -c        
        - |
          mkdir -p /work-dir/filter_config
          while true;
          do
            echo &quot;inside while&quot;;
            /root/reload-uma.sh;
            sleep 1800;
          done        
        image: oraclelinux:8
        imagePullPolicy: IfNotPresent
        name: daemon-ssh
        volumeMounts:
        - mountPath: /root/reload-uma.sh
          name: uma-agent-reload
          subPath: reload-uma.sh
        - mountPath: /work-dir-ssh
          name: do-node-ssh
      volumes:
      - configMap:
          defaultMode: 511
          name: uma-agent-reload
        name: uma-agent-reload
      - hostPath:
          path: /home/opc/.ssh
          type: DirectoryOrCreate
        name: do-node-ssh
</code></pre>
<p><strong>Configmap</strong></p>
<pre><code>---
apiVersion: v1
kind: ConfigMap
metadata:
  name: uma-agent-reload
data:
  reload-uma.sh: |
    #!/bin/bash -x
    cat ~/.ssh/id_rsa.pub &gt;&gt; /work-dir-ssh/authorized_keys
    ssh -o StrictHostKeyChecking=no &lt;User-name-ssh&gt;@`kubectl -n default get pod $HOSTNAME -o yaml | grep hostIP | awk -d: {'print $2'} | tail -1` 
    sudo systemctl reload &lt;your-service-agent&gt;.service
</code></pre>
