K8S join节点报错：configmaps xxx is forbidden: User “system:bootstrap:xxx“ cannot get resource “configmap

问题场景：

今天接手同事的K8S，说搭建一直无法join，运行命令join命令一直失败于是加了--v=10增加细节展示信息查看到底是什么错误：

[root@master ~]# kubeadm join 192.168.1.100:6443 --token qsb2ad.6953q4eiqq0kn2dt \
        --discovery-token-ca-cert-hash sha256:e0987c10f68b46c97a3a87d3acf0f8a03fa87262a4cb671b2f7038bf47db45c4

...

GET https://192.168.1.100:6443/api/v1/namespaces/kube-system/configmaps/kubelet-config-1.24?timeout=10s 403 Forbidden in 1 milliseconds
I0801 22:39:38.481970   12174 round_trippers.go:460] Response Headers:
I0801 22:39:38.481987   12174 round_trippers.go:463]     Audit-Id: 0f3f6e68-32c3-4284-97eb-285c85cd2e6e
I0801 22:39:38.481990   12174 round_trippers.go:463]     Cache-Control: no-cache, private
I0801 22:39:38.481993   12174 round_trippers.go:463]     Content-Type: application/json
I0801 22:39:38.481996   12174 round_trippers.go:463]     X-Content-Type-Options: nosniff
I0801 22:39:38.481999   12174 round_trippers.go:463]     X-Kubernetes-Pf-Flowschema-Uid: 34d87034-dce0-4828-bb11-0d9da5957c0a
I0801 22:39:38.482002   12174 round_trippers.go:463]     X-Kubernetes-Pf-Prioritylevel-Uid: 5ddc53a6-0354-4e66-b6d6-5e760554de62
I0801 22:39:38.482005   12174 round_trippers.go:463]     Content-Length: 342
I0801 22:39:38.482008   12174 round_trippers.go:463]     Date: Thu, 01 Aug 2024 14:39:38 GMT
I0801 22:39:38.482038   12174 request.go:1181] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"configmaps \"kubelet-config-1.24\" is forbidden: User \"system:bootstrap:qsb2ad\" cannot get resource \"configmaps\" in API group \"\" in the namespace \"kube-system\"","reason":"Forbidden","details":{"name":"kubelet-config-1.24","kind":"configmaps"},"code":403}
configmaps "kubelet-config-1.24" is forbidden: User "system:bootstrap:qsb2ad" cannot get resource "configmaps" in API group "" in the namespace "kube-system"
failed to get component configs
k8s.io/kubernetes/cmd/kubeadm/app/util/config.getInitConfigurationFromCluster
        /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/util/config/cluster.go:92
k8s.io/kubernetes/cmd/kubeadm/app/util/config.FetchInitConfigurationFromCluster

...

细节处错误信息：

I0801 22:39:38.482038   12174 request.go:1181] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"configmaps \"kubelet-config-1.24\" is forbidden: User \"system:bootstrap:qsb2ad\" cannot get resource \"configmaps\" in API group \"\" in the namespace \"kube-system\"","reason":"Forbidden","details":{"name":"kubelet-config-1.24","kind":"configmaps"},"code":403}
configmaps "kubelet-config-1.24" is forbidden: User "system:bootstrap:qsb2ad" cannot get resource "configmaps" in API group "" in the namespace "kube-system"
failed to get component configs

问题解决：

经过查找，是版本问题，建议查看k8s版本，他这是去查找configmaps对应的kubelet-config-1.24没有找到，可能是版本不对应，确实经过查找发现版本不同：

# master
[root@master ~]# kubelet --version
Kubernetes v1.24.9

# node2
[root@node2 ~]# kubelet --version
Kubernetes v1.22.12

# node1
[root@node1 ~]# kubelet --version
Kubernetes v1.22.12

将master换为1.22.12即可。