我在 CoreOS 上安装了 Kubernetes,并在 pod 中运行 DNS 插件。
我的问题是:kube2sky 无法访问 api-server。默认情况下,它使用 127.0.0.1:8080,而 docker 容器无法使用该地址。由于 api-server 正在监听 localhost,因此我将 kube_master_url 切换为服务器版本。此端点需要身份验证。
这是来自 kube2sky pod 的日志:
I1119 02:01:48.603839 1 kube2sky.go:389] Etcd server found: http://127.0.0.1:4001
I1119 02:01:49.604512 1 kube2sky.go:455] Using https://10.3.0.1:443 for kubernetes master
I1119 02:01:49.604524 1 kube2sky.go:456] Using kubernetes API v1
E1119 02:01:49.616085 1 reflector.go:136] Failed to list *api.Service: Get https://10.3.0.1:443/api/v1/services: x509: failed to load system roots and no roots provided
E1119 02:01:49.616142 1 reflector.go:136] Failed to list *api.Endpoints: Get https://10.3.0.1:443/api/v1/endpoints: x509: failed to load system roots and no roots provided
如何将身份验证凭据放入 pod 以便 kube2sky 使用它?
这是 pod 的声明:
apiVersion: v1
kind: ReplicationController
metadata:
name: kube-dns-v9
namespace: kube-system
labels:
k8s-app: kube-dns
version: v9
kubernetes.io/cluster-service: "true"
spec:
replicas: 1
selector:
k8s-app: kube-dns
version: v9
template:
metadata:
labels:
k8s-app: kube-dns
version: v9
kubernetes.io/cluster-service: "true"
spec:
containers:
- name: etcd
image: gcr.io/google_containers/etcd:2.0.9
resources:
limits:
cpu: 100m
memory: 50Mi
command:
- /usr/local/bin/etcd
- -data-dir
- /var/etcd/data
- -listen-client-urls
- http://127.0.0.1:2379,http://127.0.0.1:4001
- -advertise-client-urls
- http://127.0.0.1:2379,http://127.0.0.1:4001
- -initial-cluster-token
- skydns-etcd
volumeMounts:
- name: etcd-storage
mountPath: /var/etcd/data
- name: kube2sky
image: gcr.io/google_containers/kube2sky:1.11
resources:
limits:
cpu: 100m
memory: 50Mi
args:
# command = "/kube2sky"
- -domain=cluster.local
- -kube_master_url=https://10.3.0.1:443
- name: skydns
image: gcr.io/google_containers/skydns:2015-10-13-8c72f8c
resources:
limits:
cpu: 100m
memory: 50Mi
args:
# command = "/skydns"
- -machines=http://127.0.0.1:4001
- -addr=0.0.0.0:53
- -ns-rotate=false
- -domain=cluster.local.
ports:
- containerPort: 53
name: dns
protocol: UDP
- containerPort: 53
name: dns-tcp
protocol: TCP
livenessProbe:
httpGet:
path: /healthz
port: 8080
scheme: HTTP
initialDelaySeconds: 30
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /healthz
port: 8080
scheme: HTTP
initialDelaySeconds: 1
timeoutSeconds: 5
- name: healthz
image: gcr.io/google_containers/exechealthz:1.0
resources:
limits:
cpu: 10m
memory: 20Mi
args:
- -cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1 >/dev/null
- -port=8080
ports:
- containerPort: 8080
protocol: TCP
volumes:
- name: etcd-storage
emptyDir: {}
dnsPolicy: Default # Don't use cluster DNS.
答案1
我认为您没有正确设置服务帐户准入控制器或服务帐户和令牌控制器。
如果您这样做:kubectl get pods --all-namespaces -l k8s-app=kube-dns -o yaml
,您是否看到任何提及mountPath: /var/run/secrets/kubernetes.io/serviceaccount
?
或者您可能更改了 apiserver 的私钥或证书?
答案2
SSL 密钥缺少我的 kubernetes api-server 服务的 IP。轮换 SSL 密钥时,我必须删除旧的服务帐户密钥并重新启动 kubelet。这样就创建了一个新的服务帐户。服务帐户凭据会自动安装到 /run/secrets/kubernetes.io/serviceaccount 处的 pod 中。kubectl 会使用此位置作为查找凭据的后备位置。