Question

我的主节点中有两个网络接口-

192.168.56.118

10.0.3.15

在主节点上执行kubeadm init时，我得到了以下添加工人的命令

kubeadm join --token qr1czu.5lh1nt34ldiauc1u 192.168.56.118:6443 --discovery-token-ca-cert-hash sha256:e5d90dfa0fff67589551559c443762dac3f1e5c7a5d2b4a630e4c0156ad0e16c

如您所见，它显示了从worker连接的192.168.56.118 IP。但是在工作节点上执行相同操作时，出现以下错误。

[root@k8s-worker ~]# kubeadm join --token qr1czu.5lh1nt34ldiauc1u 192.168.56.118:6443 --discovery-token-ca-cert-hash sha256:e5d90dfa0fff67589551559c443762dac3f1e5c7a5d2b4a630e4c0156ad0e16c
[preflight] Running pre-flight checks
[discovery] Trying to connect to API Server "192.168.56.118:6443"
[discovery] Created cluster-info discovery client, requesting info from "https://192.168.56.118:6443"
[discovery] Requesting info from "https://192.168.56.118:6443" again to validate TLS against the pinned public key
[discovery] Failed to request cluster info, will try again: [Get https://192.168.56.118:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate is valid for 10.96.0.1, 10.0.3.15, not 192.168.56.118]

我尝试使用其他IP-10.0.3.15。但是，尽管在主服务器中禁用了防火墙，但它仍返回连接拒绝错误。

[root@k8s-worker ~]# kubeadm join --token qr1czu.5lh1nt34ldiauc1u 10.0.3.15:6443 --discovery-token-ca-cert-hash sha256:e5d90dfa0fff67589551559c443762dac3f1e5c7a5d2b4a630e4c0156ad0e16c
[preflight] Running pre-flight checks
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[discovery] Trying to connect to API Server "10.0.3.15:6443"
[discovery] Created cluster-info discovery client, requesting info from "https://10.0.3.15:6443"
[discovery] Failed to request cluster info, will try again: [Get https://10.0.3.15:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: dial tcp 10.0.3.15:6443: connect: connection refused]

如何强制证书使192.168.56.118有效？或任何想法如何解决此问题？

Answer 1

在使用--apiserver-cert-extra-sans <ip_address>初始化集群时，您需要提供额外的apiserver证书SAN（--apiserver-advertise-address）和api服务器公告地址（kubeadm init）。您的kubeadm init命令如下所示：

kubeadm init --apiserver-cert-extra-sans 192.168.56.118 --apiserver-advertise-address 192.168.56.118

使用上述命令初始化集群后，您将不会在加入集群时遇到证书问题

工作节点无法加入kubernetes中的主节点

1 个答案: