我在 aws ec2 上创建了 3 个节点。在这三个节点中，我有一个类型为 t2.medium 的主节点和 2 个类型为 t2.micro 的工作节点
我最近两天遇到了一个问题The connection to the server 172.31.58.39:6443 was refused - did you specify the right host or port?，但无法解决。我搜索了与此问题相关的所有内容，但没有一个解决方案有效。
EC2: t2.medium
OS: Ubuntu 22.04
kubeadm version:
&version.Info{Major:"1",
Minor:"28",
GitVersion:"v1.28.2",
GitCommit:"89a4ea3e1e4ddd7f7572286090359983e0387b2f",
GitTreeState:"clean", BuildDate:"2023-09-13T09:34:32Z",
GoVersion:"go1.20.8",
Compiler:"gc",
Platform:"linux/amd64"}
kubectl version:
Client Version: v1.28.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
kubectl get nodes
E0923 17:25:20.923628 7300 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")
E0923 17:25:20.928061 7300 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")
E0923 17:25:20.932249 7300 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")
E0923 17:25:20.936440 7300 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")
E0923 17:25:20.940482 7300 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Kubernetes")
Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Kubernetes")
有些人会遇到此错误
kubectl get nodes
Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")
有时会出现此错误
kubectl get nodes
The connection to the server 172.31.58.39:6443 was refused - did you specify the right host or port?
kubectl cluster-info
E0924 07:51:01.606793 10760 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": dial tcp 172.31.58.39:6443: connect: connection refused
E0924 07:51:01.607243 10760 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": dial tcp 172.31.58.39:6443: connect: connection refused
E0924 07:51:01.608930 10760 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": dial tcp 172.31.58.39:6443: connect: connection refused
E0924 07:51:01.610408 10760 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": dial tcp 172.31.58.39:6443: connect: connection refused
E0924 07:51:01.611920 10760 memcache.go:265] couldn't get current server API group list: Get "https://172.31.58.39:6443/api?timeout=32s": dial tcp 172.31.58.39:6443: connect: connection refused
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
The connection to the server 172.31.58.39:6443 was refused - did you specify the right host or port?
.kube/config
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0F----
server: https://172.31.58.39:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJ----
client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJ---
netstat -pnlt | grep 6443
Got nothing
some time get this response from above command
tcp6 1 0 :::6443 :::* LISTEN 89485/kube-apiserve
firewall-cmd --list-all
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'docker' (see --get-active-zones)
You most likely need to use --zone=docker option.
public
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
主节点安全组（入站）
– sgr-084c44b571f12226d 8080 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-01784eb1f091d49f9 6430 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-071619a3b2faa66e6 22 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-0ef554af49b020d01 6784 UDP 0.0.0.0/0 MasterSecurityGroups –
– sgr-0f54b7b5d068e3fc8 6783 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-05e5c889e6d056897 2379 - 2380 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-03adee8559fe297ca 6443 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-0bd29c6cad853563b 443 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-06a00288ac397903a 80 TCP 0.0.0.0/0 MasterSecurityGroups –
– sgr-05eed4b9a8e95625c 30000 - 32767 TCP 0.0.0.0/0 MasterSecurityGroups –
我对我自己的 IP 和本地 IP 感到困惑EC2，让我告诉你我已经检查过了，
curl -s ifconfig.me
然后我得到了
54.157.171.165 => This is my master node Public IPv4 address
但是.kube/config从我的本地 IP 进入服务器时，端口6443
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTi====
server: https://172.31.58.39:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: LS0tLS1CRUdJTiBD====
client-key-data: LS0tLS1C====
答案1
解决此错误无法连接到服务器：tls：无法验证证书：x509：由未知颁发机构签名的证书（可能是因为在尝试验证候选颁发机构证书“kubernetes”时出现“crypto/rsa：验证错误”）
请尝试以下步骤：
1检查 $HOME/.kube/config 文件中是否存在有效证书并生成新证书。
2使用以下命令删除环境变量 KUBECONFIG：
unset KUBECONFIG
或者将其设置为默认的 KUBECONFIG 位置：
export KUBECONFIG=/etc/kubernetes/admin.conf
3另一个解决方法是替换“admin”用户的现有 kubeconfig：
mv $HOME/.kube $HOME/.kube.bak mkdir $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config
您需要确保使用正确的 kubeconfig，因为重新安装 Kubernetes 会创建一个新的证书。
在 setKubeconfig 选项中使用 $HOME/.kube/config，或者直接将其复制到你设置了 vs code 扩展以读取配置的路径。使用以下命令
cp $HOME/.kube/config /{{path-for-kubeconfig}}
解决此错误与服务器 172.31.58.39:6443 的连接被拒绝 - 您是否指定了正确的主机或端口？
尝试在主节点上执行以下步骤来解决您的问题
sudo-i
交换-a
出口
strace -eopenat kubectl 版本
另一个建议是使用 sudo systemctl restart containerd 重新启动容器。