kube-apiserver 报错 Unable to authenticate the request“ err=“[x509: certificate signed by unknown ...

rockstics

已于 2022-04-12 13:41:36 修改

阅读量8.2k

点赞数 1

分类专栏： kubernetes 文章标签： kubernetes docker 容器

于 2022-02-11 16:29:51 首次发布

本文链接：https://blog.csdn.net/rockstics/article/details/122880590

版权

kubernetes 专栏收录该内容

11 篇文章 1 订阅

订阅专栏

问题描述：

采用ansible 二进制方式部署kubernetes，部署完成后kubectl get node 节点状态 NotReady
kubectl get pod -n kube-system 发现 calico 处于 Pending 状态
查看pod日志

kubectl logs -f calico-node-7fw9h -n kube-system

报错为：
Authorization error (user=kubernetes, verb=get, resource=nodes, subresource=proxy)

systemctl status kubelet  -l

发现报错
Feb 11 09:56:48 kubernetesM02 kubelet[20889]: E0211 09:56:48.153429 20889 kubelet_node_status.go:93] “Unable to register node with API server” err=“Unauthorized” node=“kubernetesm02”
Feb 11 09:56:50 kubernetesM02 kubelet[20889]: E0211 09:56:50.097095 20889 reflector.go:138] k8s.io/kubernetes/pkg/kubelet/config/apiserver.go:45: Failed to watch *v1.Pod: failed to list *v1.Pod: Unauthorized

怀疑是kube-apiserver 问题

systemctl status kube-apiserver -l

发现报错

Feb 11 14:34:11 kubernetesM02 kube-apiserver[16692]: E0211 14:34:11.507411 16692 authentication.go:63] “Unable to authenticate the request” err=“[x509: certificate signed by unknown authority (possibly because of “crypto/rsa: verification error” while trying to verify candidate authority certificate “kubernetes”), verifying certificate SN=223578824471382834555747287975620980748, SKID=, AKID=F4:9A:82:54:A9:67:BB:64:A7:F6:E9:33:A4:A0:C2:4B:6A:A8:D0:1B failed: x509: certificate signed by unknown authority (possibly because of “crypto/rsa: verification error” while trying to verify candidate authority certificate “kubernetes”)]”

百度后怀疑是证书问题

解决方法：

删除kubelet 的证书

rm  /etc/kubernetes/ssl/kubelet.*

重启kubelet
如果引入了 bootstrap 机制，会自动重新生成并颁发证书，否则需要手动颁发证书
kubectl get node 再次查看节点状态已正常
手动办法证书方法如下：

kubectl get csr #查看证书请求
NAME                                                   AGE    SIGNERNAME                                    REQUESTOR           CONDITION
node-csr-PJit5dDGv1tO3e3ELjBXu5ORF4NtL8K7qkS2AM2KE7g   3m6s   kubernetes.io/kube-apiserver-client-kubelet   kubelet-bootstrap   Approved,Issued

kubectl certificate approve node-csr-PJit5dDGv1tO3e3ELjBXu5ORF4NtL8K7qkS2AM2KE7g  #批准证书请求 
certificatesigningrequest.certificates.k8s.io/node-csr-PJit5dDGv1tO3e3ELjBXu5ORF4NtL8K7qkS2AM2KE7g approved