Question

尝试构建3节点Kubernetes集群并在CoreOS上运行并发布，我无法将任何节点加入集群API Server不断引发有关TLS证书的错误。

I1128 23:08:47.715663       1 logs.go:41] http: TLS handshake error from 10.123.146.55:48344: remote error: bad certificate
I1128 23:08:47.829082       1 logs.go:41] http: TLS handshake error from 10.123.146.55:48346: remote error: bad certificate
I1128 23:08:47.881655       1 logs.go:41] http: TLS handshake error from 10.123.146.54:40896: remote error: bad certificate
I1128 23:08:47.923955       1 logs.go:41] http: TLS handshake error from 10.123.146.54:40898: remote error: bad certificate

工人证书有效 - 使用

验证

curl --key worker-key.pem -k https://10.123.146.53/api/v1/nodes --cert worker.pem  --cacert ca.pem

我只能看到相关的错误是Controller无法启动证书控制器：

I1128 22:45:12.452293       1 controllermanager.go:462] Starting certificates.k8s.io/v1alpha1 apis
I1128 22:45:12.452989       1 controllermanager.go:464] Starting certificate request controller
E1128 22:45:12.454607       1 controllermanager.go:474] Failed to start certificate controller: open /etc/kubernetes/ca/ca.pem: no such file or directory

从我可以告诉/ etc / kubernetes /包含在下面：

$ cat /etc/kubernetes/manifests/kube-controller-manager.yaml
apiVersion: v1
kind: Pod
metadata:
name: kube-controller-manager
namespace: kube-system
spec:
hostNetwork: true
containers:
- name: kube-controller-manager
  image: quay.io/coreos/hyperkube:v1.4.3_coreos.0
  command:
  - /hyperkube
  - controller-manager
  - --master=http://127.0.0.1:8080
  - --leader-elect=true
  - --service-account-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
  - --root-ca-file=/etc/kubernetes/ssl/ca.pem
  livenessProbe:
    httpGet:
      host: 127.0.0.1
      path: /healthz
      port: 10252
    initialDelaySeconds: 15
    timeoutSeconds: 1
  volumeMounts:
  - mountPath: /etc/kubernetes/ssl
    name: ssl-certs-kubernetes
    readOnly: true
  - mountPath: /etc/ssl/certs
    name: ssl-certs-host
    readOnly: true
volumes:
- hostPath:
    path: /etc/kubernetes/ssl
  name: ssl-certs-kubernetes
- hostPath:
    path: /usr/share/ca-certificates
  name: ssl-certs-host

Answer 1

-k中的curl标记忽略并隐藏TLS / SSL警告。如果您删除-k，您会看到这实际上是无效的TLS证书。

来自curl手册：

-k，--insecure允许连接到没有证书（H）的SSL站点

Kubernetes节点无法从10.123.146.55:48344加入群集-TLS握手错误：远程错误：错误证书

1 个答案: