我在预览帖子中搜索了此内容,但抱歉,找不到解决方法。
我在kubeadm v1.12上安装了指标服务器,并且从日志中得到了此错误:
在专用网络中有1个主节点和1个从属节点。
Get https://ip-10-0-1-154:10250/stats/summary/: x509: a certificate signed by an unknown authority, unable to fully scrape metrics from source
我没有安装任何证书。
如何安装新证书,以及在不设置新kubernetes集群的情况下需要更改的证书?
很抱歉出现noob问题,我尝试创建一个新证书,但无法更改kubelet。
答案 0 :(得分:4)
kubeadm的问题在于,它在kubelet
(/var/lib/kubelet/pki
,kubelet.crt
)下的节点上生成kubelet.key
证书,该证书由与所用证书不同的CA签署/etc/kubernetes/pki
(ca.crt)下的母版。一些背景here
。
您必须为CA在主/etc/kubernetes/pki/ca.crt
类似这样的东西:
$ mkdir ~/mycerts; cd ~/mycerts
$ cp /etc/kubernetes/pki/ca.crt ca.pem
$ cp /etc/kubernetes/pki/ca.key ca-key.pem
使用以下内容创建文件kubelet-csr.json
:
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"<your-node-name>",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [{
"C": "US",
"ST": "NY",
"L": "City",
"O": "Org",
"OU": "Unit"
}]
}
创建一个ca-config.json
文件:
{
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"kubernetes": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "8760h"
}
}
}
}
创建一个config.json
文件:
{
"signing": {
"default": {
"expiry": "168h"
},
"profiles": {
"www": {
"expiry": "8760h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
},
"client": {
"expiry": "8760h",
"usages": [
"signing",
"key encipherment",
"client auth"
]
}
}
}
}
生成证书:
$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
--config=ca-config.json -profile=kubernetes \
kubelet-csr.json | cfssljson -bare kubelet
将文件复制到您的节点:
$ scp kubelet.pem <node-ip>:/var/lib/kubelet/pki/kubelet.crt
$ scp kubelet-key.pem <node-ip>:/var/lib/kubelet/pki/kubelet.key
在您的节点上重新启动kubelet:
$ systemctl restart kubelet
PD。打开this来跟踪问题。