kubernetes+virtual-kubelet对接openstack-zun:使用https方式报错 x509: certificate signed by unknown authority

1、环境说明

k8s集群由三个master构成，后续新创建virtual-kubelet节点对接openstack zun

# kubectl get nodes -o wide
NAME               STATUS   ROLES    AGE   VERSION                                INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION           CONTAINER-RUNTIME
k8s-m1             Ready    master   42h   v1.17.0                                172.0.2.139   <none>        CentOS Linux 7 (Core)   3.10.0-1062.el7.x86_64   docker://19.3.6
k8s-m2             Ready    master   42h   v1.17.0                                172.0.2.146   <none>        CentOS Linux 7 (Core)   3.10.0-1062.el7.x86_64   docker://19.3.6
k8s-m3             Ready    master   42h   v1.17.0                                172.0.2.234   <none>        CentOS Linux 7 (Core)   3.10.0-1062.el7.x86_64   docker://19.3.6

2、运行virtual-kubelet

2.1、对接zun的环境变量

对接OpenStack Train版本

# cat keystonerc_admin
unset OS_SERVICE_TOKEN
export OS_USERNAME=admin
export OS_PASSWORD=keystone
export OS_AUTH_URL=https://192.168.32.90:5000/v3
export PS1='[\u@\h \W(keystone_admin)]\$ '

export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_IDENTITY_API_VERSION=3

export OS_PROJECT_ID=d57f7ea9b3b94d9a87321807ec453ca8
export OS_REGION_NAME=RegionOne
export OS_DOMAIN_ID=default

2.2、运行virtual-kubelet出错

./virtual-kubelet --provider openstack --nodename virtual-kubelet --disable-taint

FATA[0000] Unable to get provider: Post https://192.168.32.90:5000/v3/auth/tokens: x509: certificate signed by unknown authority

3、解决问题

3.1、问题原因

此问题是因为go http客户端默认设置了双向认证，认为服务端的证书授权有问题，不是正规机构认证的证书
一般内部调试都是自己创建证书
所以，可以将双向认证改为单向认证，即客户端不去认证服务端的证书

3.2、错误代码位置

#ls virtual-kubelet\opentstack-zun\zun.go
func NewZunProvider(config string, rm *manager.ResourceManager, nodeName string, operatingSystem string, daemonEndpointPort int32) (*ZunProvider, error) {
...
	Provider, err := openstack.AuthenticatedClient(AuthOptions)
	if err != nil {
		return nil, fmt.Errorf("Unable to get provider: %s", err)
	}

3.3、函数调用链

# ls gophercloud/openstack/client.go
AuthenticatedClient -> NewClient

3.4、修改代码

增加如下代码：

	tr := &http.Transport{
		TLSClientConfig:    &tls.Config{InsecureSkipVerify: true},
	}
	p.HTTPClient = http.Client{Transport: tr}