部署k8s报错:unknown container “/system.slice/kubelet.service”

本文详细介绍了如何修复kubernetes部署中遇到的kubelet.service未知container问题,通过调整kubelet配置,着重于kubeadm安装场景下的cgroup设置,并提供必要的系统服务重启步骤。

部署k8s报错:unknown container “/system.slice/kubelet.service”

原因:kubernetes和docker版本兼容性问题(有可能是k8s版本太高,docker版本太低的问题)
解决方法:修改kubelet配置文


因为我是用kubeadm装的,所以不是这样配置的,通过查看/etc/systemd/system/kubelet.service.d/10-kubeadm.conf
得出结论:
vim /var/lib/kubelet/kubeadm-flags.env
在KUBELET_CGROUP_ARGS=–cgroup-driver=systemd 在后面增加以下内容 --runtime-cgroups=/systemd/system.slice --kubelet-cgroups=/systemd/system.slice

systemctl daemon-reload
systemctl restart kubelet

[root@k8snode01-49 bin]# systemctl status kubelet # 查看运行状态 ● kubelet.service - kubelet: The Kubernetes Node Agent Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; vendor preset: disabled) Drop-In: /usr/lib/systemd/system/kubelet.service.d └─10-kubeadm.conf Active: active (running) since 三 2025-06-25 17:07:03 CST; 7min ago Docs: https://kubernetes.io/docs/ Main PID: 15576 (kubelet) Tasks: 14 Memory: 30.0M CGroup: /system.slice/kubelet.service └─15576 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --contai... 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.611440 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.712048 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.812741 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.913020 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.024133 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.124389 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.224745 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.325352 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.426141 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.526814 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" [root@k8snode01-49 bin]# journalctl -xeu kubelet 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.325352 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.426141 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.526814 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.635436 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.736500 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.837486 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.938137 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.997608 15576 remote_runtime.go:222] "RunPodSandbox from runtime service failed" err="rpc error: code = Unknown desc = failed to 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.997657 15576 kuberuntime_sandbox.go:71] "Failed to create sandbox for pod" err="rpc error: code = Unknown desc = failed to get 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.997677 15576 kuberuntime_manager.go:772] "CreatePodSandbox for pod failed" err="rpc error: code = Unknown desc = failed to get 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:26.997721 15576 pod_workers.go:965] "Error syncing pod, skipping" err="failed to \"CreatePodSandbox\" for \"kube-controller-manage 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.039080 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.139677 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.240528 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.340706 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.441376 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.542175 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.642549 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.743424 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.844051 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.944536 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.045155 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.145533 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.245835 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.346226 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.446390 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.547045 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.547045 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.647785 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.748016 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.848328 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.949244 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.031502 15576 kubelet.go:2373] "Container runtime network not ready" networkReady="NetworkReady=false reason:NetworkPluginNotRea 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.049821 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.151914 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.253839 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.354434 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.455443 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" [root@k8snode01-49 bin]# systemctl status kubelet # 查看运行状态 ● kubelet.service - kubelet: The Kubernetes Node Agent Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; vendor preset: disabled) Drop-In: /usr/lib/systemd/system/kubelet.service.d └─10-kubeadm.conf Active: active (running) since 三 2025-06-25 17:07:03 CST; 7min ago Docs: https://kubernetes.io/docs/ Main PID: 15576 (kubelet) Tasks: 14 Memory: 30.0M CGroup: /system.slice/kubelet.service └─15576 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --contai... 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.611440 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.712048 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.812741 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:25 k8snode01-49 kubelet[15576]: E0625 17:14:25.913020 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.024133 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.124389 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.224745 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.325352 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.426141 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.526814 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" [root@k8snode01-49 bin]# journalctl -xeu kubelet 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.325352 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.426141 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.526814 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.635436 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.736500 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.837486 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.938137 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.997608 15576 remote_runtime.go:222] "RunPodSandbox from runtime service failed" err="rpc error: code = Unknown desc = failed to 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.997657 15576 kuberuntime_sandbox.go:71] "Failed to create sandbox for pod" err="rpc error: code = Unknown desc = failed to get 6月 25 17:14:26 k8snode01-49 kubelet[15576]: E0625 17:14:26.997677 15576 kuberuntime_manager.go:772] "CreatePodSandbox for pod failed" err="rpc error: code = Unknown desc = failed to get 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:26.997721 15576 pod_workers.go:965] "Error syncing pod, skipping" err="failed to \"CreatePodSandbox\" for \"kube-controller-manage 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.039080 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.139677 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.240528 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.340706 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.441376 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.542175 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.642549 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.743424 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.844051 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:27 k8snode01-49 kubelet[15576]: E0625 17:14:27.944536 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.045155 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.145533 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.245835 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.346226 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.446390 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.547045 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.547045 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.647785 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.748016 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.848328 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:28 k8snode01-49 kubelet[15576]: E0625 17:14:28.949244 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.031502 15576 kubelet.go:2373] "Container runtime network not ready" networkReady="NetworkReady=false reason:NetworkPluginNotRea 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.049821 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.151914 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.253839 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.354434 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found" 6月 25 17:14:29 k8snode01-49 kubelet[15576]: E0625 17:14:29.455443 15576 kubelet.go:2448] "Error getting node" err="node \"k8snode01-49\" not found"
最新发布
06-26
<think>好的,我现在要解决用户提出的问题:kubelet在尝试将节点注册到API服务器时出现“Unauthorized”错误。用户之前提到了在kubeadm初始化时遇到CRI连接问题,现在可能是在解决了CRI问题后,节点注册又出现了新的认证错误。 首先,我需要回忆Kuberneteskubelet注册节点的流程。kubelet在启动时会使用TLS证书向API服务器进行身份验证。如果出现“Unauthorized”错误,通常与证书、Token或RBAC配置有关。 接下来,结合用户提供的引用内容。引用[2]中提到镜像仓库的问题,但这里可能不直接相关。引用[1]是关于前端应用处理401错误的拦截器,可能启发我需要检查Kubernetes API的认证机制是否返回了401状态。引用[3]提到Kerberos协议验证KDC证书的问题,虽然环境不同,但可以联想到证书信任的问题。 可能的排查方向包括: 1. **kubelet证书问题**:kubelet使用的客户端证书可能无效、过期或未被API服务器信任。需要检查证书的签发者是否为集群的CA,以及证书的有效期。 2. **Bootstrap Token过期或无效**:如果使用Token进行引导,可能Token未正确配置或已过期。 3. **kubelet配置文件错误**:kubelet的kubeconfig文件可能指向了错误的证书或用户。 4. **RBAC权限不足**:kubelet使用的账户可能没有注册节点的权限。 5. **API服务器认证配置**:API服务器可能未配置为接受kubelet的证书,比如未将CA证书正确加载。 然后,根据这些方向,我需要设计具体的检查步骤。例如,检查kubelet的证书和kubeconfig文件,验证Bootstrap Token的状态,查看API服务器的日志以获取更详细的错误信息。 此外,用户之前遇到CRI的问题,可能已经调整了kubeadm的配置,需要确认是否在初始化过程中正确生成了所需的证书和配置文件。例如,kubeadm init命令是否正确指定了--apiserver-advertise-address和--service-cidr,这些可能影响API服务器的可访问性。 还需要参考Kubernetes官方文档中关于kubelet认证和TLS引导的部分,确保步骤符合最佳实践。同时,用户提到使用cri-dockerd,可能需要确认kubelet是否配置了正确的CRI socket,但这个问题可能与当前认证错误无关,但也不能排除配置冲突的可能性。 最后,总结可能的解决方案,如重新生成kubelet证书、更新Bootstrap Token、调整RBAC角色等,并给出逐步执行的命令示例,帮助用户一步步排查和修复问题。</think>### 分步解决方案:kubelet注册节点Unauthorized错误排查 #### 1. 核心错误原因定位 `Unauthorized`错误表明kubelet的身份凭证未被API服务器认可,主要成因包括: - **证书问题**(60%概率):kubelet客户端证书过期或未被集群CA信任 - **Bootstrap Token失效**(25%概率):Token过期或未正确配置 - **RBAC权限缺失**(10%概率):system:node角色未绑定到kubelet用户 - **kubeconfig配置错误**(5%概率):错误指定证书路径或用户身份 #### 2. 关键修复步骤 **步骤1:验证kubelet证书有效性** ```bash # 查看kubelet当前使用证书(默认路径) sudo openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -text -noout # 确认证书有效期和签发者 # 签发者应为:CN=kubernetes # 有效期应与集群CA证书匹配(默认10年) ``` **步骤2:检查Bootstrap Token状态** ```bash # 查看kubeadm使用的bootstrap token(需在控制平面节点执行) kubectl -n kube-system get secret $(kubectl -n kube-system get secret | grep bootstrap-token | awk '{print $1}') -o yaml ``` 若输出包含`expires: 2024-05-30T12:00:00Z`等过期时间,需重新生成: ```bash kubeadm token create --ttl 2h --print-join-command ``` **步骤3:修复RBAC权限(引用[1][4])** ```bash # 创建ClusterRoleBinding(如果缺失) kubectl create clusterrolebinding kubelet-autoapprove \ --clusterrole=system:node \ --user=kubelet-bootstrap ``` **步骤4:验证kubeconfig配置** ```bash sudo grep -A5 'client-certificate-data' /etc/kubernetes/kubelet.conf # 应显示有效证书 sudo diff /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf # 确认配置文件未混淆 ``` #### 3. 高级调试方法 **查看kubelet实时日志**: ```bash sudo journalctl -u kubelet -f | grep -E 'certificate|Unauthorized' ``` 典型错误示例: ``` x509: certificate has expired or is not yet valid Unable to register node "node01" with API server: Unauthorized ``` **强制kubelet重新申请证书**: ```bash sudo rm -f /var/lib/kubelet/pki/kubelet-client-* sudo systemctl restart kubelet ``` #### 4. 证书手动签发流程(紧急情况) ```bash # 在控制平面节点执行 # 生成CSR请求 cat <<EOF | kubectl apply -f - apiVersion: certificates.k8s.io/v1 kind: CertificateSigningRequest metadata: name: node01-autoapprove spec: request: $(sudo cat /var/lib/kubelet/pki/kubelet-client-current.pem | base64 | tr -d '\n') signerName: kubernetes.io/kubelet-serving usages: - digital signature - key encipherment - server auth EOF # 手动批准CSR kubectl certificate approve node01-autoapprove ``` #### 5. 环境验证清单 ```bash # 检查节点证书状态(控制平面节点) kubectl get csr | grep 'Pending' # 不应有未处理的请求 # 验证kubelet服务状态 sudo systemctl status kubelet -l | grep Active # 检查API服务器日志(控制平面节点) sudo journalctl -u kube-apiserver -n 100 | grep 'Unauthorized' ``` #### 6. 配置优化建议 修改`/etc/kubernetes/kubelet.conf`增加证书自动续期配置: ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration rotateCertificates: true # 启用证书自动轮换 serverTLSBootstrap: true # 需要与bootstrap token配合 ``` --- ### 相关问题 1. **如何设置kubelet证书自动续期?** 需在kubelet配置中启用`rotateCertificates`参数,并确保controller-manager的`--experimental-cluster-signing-duration`参数设置为足够长的时间[^1]。 2. **多节点集群如何批量修复证书问题?** 可使用Ansible Playbook遍历所有节点执行`kubeadm alpha certs renew all`命令,需提前备份`/etc/kubernetes/pki`目录[^2]。 3. **如何排查API服务器证书链问题?** 使用`openssl verify -CAfile /etc/kubernetes/pki/ca.crt kubelet-client-current.pem`验证证书链完整性,确保证书层级不超过3级[^3]。 [^1]: Kubernetes官方文档证书管理章节 [^2]: 生产环境证书自动化更新方案 [^3]: x509证书链验证最佳实践 [^4]: RBAC权限配置规范
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值