k8s踩坑记录：details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file..)

k8s安装踩坑

1. 报错提示：details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)

解决方案：

查看/etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt 是一个软链接，但是链接过去后并没有真实的/etc/rhsm，所以需要使用yum安装：

yum install *rhsm*

安装完成后，执行一下（这个大概率拉取不到，如果拉取到可以直接重启k8s）

docker pull registry.access.redhat.com/rhel7/pod-infrastructure:latest

如果依然报错，可参考下面的方案：

wget http://mirror.centos.org/centos/7/os/x86_64/Packages/python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm

rpm2cpio python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm | cpio -iv --to-stdout ./etc/rhsm/ca/redhat-uep.pem | tee /etc/rhsm/ca/redhat-uep.pem

再执行拉取

docker pull registry.access.redhat.com/rhel7/pod-infrastructure:latest

然后重启服务 systemctl restart kubelet

这里就可以看到节点正常运行了

[root@VM-0-11-centos k8sdemo]# kubectl get pods
NAME             READY     STATUS    RESTARTS   AGE
mytomcat-3l64r   1/1       Running   0          15h
mytomcat-bnrfk   1/1       Running   0          15h

2.此外还有一个外部无法访问k8s容器的问题

网上给出的很多方案时关闭防火墙，但我这里并没有用，需要开启防火墙( systemctl start firewalld )并开启防火墙的包转发功能

firewall-cmd --add-masquerade --permanent && firewall-cmd --reload