如何向 Kubernetes 集群添加自定义 SSL 证书

如何向 Kubernetes 集群添加自定义 SSL 证书

我有一个 Kubernetes 集群,其中有 2 个主节点和 3 个工作节点,还有一个单独的哈普罗西服务器公有 IP

默认情况下,kubeadm 会生成集群所需的所有证书,并将证书存储在 /etc/kubernetes/pki 中

根据文档,我们可以将一个或多个自定义证书和相关密钥放在 /etc/kubernetes/pki 中,然后执行kubeadm init命令生成其余的证书。https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

由于我的集群已经启动并运行,因此 init 命令将因预检错误而失败。

因此,我按照以下步骤生成证书和 Kubernetes 配置

cd /etc/kubernetes/pki/
sudo rm ca.key ca.crt

sudo openssl genrsa -out ca.key 2048
sudo openssl req -x509 -new -nodes -key ca.key -subj "/CN=My Local CA" -days 10000 -out ca.crt

sudo kubeadm init phase certs all --control-plane-endpoint "haproxy_IP:6443"

cd /etc/kubernetes/
sudo rm admin.conf controller-manager.conf kubelet.conf scheduler.conf

sudo kubeadm init phase kubeconfig all --control-plane-endpoint "haproxy_IP:6443"

sudo rm $HOME/.kube/config
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

现在我遇到了以下错误

kubectl 获取节点

Error from server (InternalError): an error on the server ("") has prevented the request from succeeding

openssl s_client-连接haproxy_IP:6443

CONNECTED(00000005)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 315 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

kubectl 获取节点 --v=7

09:41:50.597844   31816 request.go:943] Got a Retry-After 1s response for attempt 8 to https://haproxy_IP:6443/api?timeout=32s
09:41:51.598061   31816 round_trippers.go:422] GET https://haproxy_IP:6443/api?timeout=32s
09:41:51.598112   31816 round_trippers.go:429] Request Headers:
09:41:51.598219   31816 round_trippers.go:433]     Accept: application/json, */*
09:41:51.598504   31816 round_trippers.go:433]     User-Agent: kubectl/v1.20.4 (linux/amd64) kubernetes/e87da0b
09:41:51.602249   31816 round_trippers.go:448] Response Status:  in 3 milliseconds
09:41:51.602301   31816 request.go:943] Got a Retry-After 1s response for attempt 9 to https://haproxy_IP:6443/api?timeout=32s
09:41:52.602523   31816 round_trippers.go:422] GET https://haproxy_IP:6443/api?timeout=32s
09:41:52.602558   31816 round_trippers.go:429] Request Headers:
09:41:52.602572   31816 round_trippers.go:433]     User-Agent: kubectl/v1.20.4 (linux/amd64) kubernetes/e87da0b
09:41:52.602585   31816 round_trippers.go:433]     Accept: application/json, */*
09:41:52.605922   31816 round_trippers.go:448] Response Status:  in 3 milliseconds
09:41:52.605980   31816 request.go:943] Got a Retry-After 1s response for attempt 10 to https://haproxy_IP:6443/api?timeout=32s
09:41:53.606187   31816 round_trippers.go:422] GET https://haproxy_IP:6443/api?timeout=32s
09:41:53.610028   31816 round_trippers.go:429] Request Headers:
09:41:53.610048   31816 round_trippers.go:433]     Accept: application/json, */*
09:41:53.610059   31816 round_trippers.go:433]     User-Agent: kubectl/v1.20.4 (linux/amd64) kubernetes/e87da0b
09:41:53.612676   31816 round_trippers.go:448] Response Status:  in 2 milliseconds
09:41:53.612837   31816 cached_discovery.go:121] skipped caching discovery info due to an error on the server ("") has prevented the request from succeeding
09:41:53.613146   31816 helpers.go:216] server response object: [{
  "metadata": {},
  "status": "Failure",
  "message": "an error on the server (\"\") has prevented the request from succeeding",
  "reason": "InternalError",
  "details": {
    "causes": [
      {
        "reason": "UnexpectedServerResponse"
      }
    ],
    "retryAfterSeconds": 1
  },
  "code": 500
}]
F0413 09:41:53.613294   31816 helpers.go:115] Error from server (InternalError): an error on the server ("") has prevented the request from succeeding

如果我重置将新的证书和配置文件与我以前的证书和配置文件放在一起,然后一切工作正常没有任何问题。

所以我怀疑我的方法缺少了一些东西。

非常感谢与此问题相关的想法或类似的经验。

相关内容