K8S常见错误

#kubernetes 错误：

Unable to connect to the server: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")

解决方法：如果是突发，多半是第二条失效，单独执行第二条命令即可。

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

错误2：有可能会遇到k8s不支持最新版docker的情况例如

[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 18.09.1. Latest validated version: 18.06

yum remove –y docker-ce
yum list docker-ce --showduplicates|sort -r

看到下面这行就表示主节点已经启动

You can now join any number of machines by running the following on each node
as root:
kubeadm join 192.168.188.130:6443 --token 9ardbs.4jhr5yaammfi7nnw --discovery-token-ca-cert-hash sha256:9fae5fb2de988967ba4e0e4ea468d39c942f92d19b59142fb8be3a27c6be8186

4、node加入master，将master最后一行提示复制过来执行即可

kubeadm join 192.168.188.130:6443 --token 9ardbs.4jhr5yaammfi7nnw --discovery-token-ca-cert-hash sha256:9fae5fb2de988967ba4e0e4ea468d39c942f92d19b59142fb8be3a27c6be8186

看到如下提示，表示连接成功

Run 'kubectl get nodes' on the master to see this node join the cluster.

如果报下面的错误，检查一下防火墙是否屏蔽了6443端口和两边服务器时间是否一至

[discovery] Failed to request cluster info, will try again: [Get <https://192.168.188.130:6443/api/v1/namespaces/kube-public/configmaps/cluster-info:> x509: certificate has expired or is not yet valid]

连接成功之后在MASTER 上执行 kubectl get nodes 如果报如下错误

The connection to the server localhost:8080 was refused - did you specify the right host or port?

执行如下命令：

export KUBECONFIG=/etc/kubernetes/admin.conf

如果想在node节点上使用kubectl 命令需要把 k8s-master 上 /etc/kubernetes/admin.conf 文件copy到几点机器上并使用 export KUBECONFIG=/etc/kubernetes/admin.conf, 这个在初始化的时候已经提到,, 可以用scp 命令拷贝

5、如果安装了不同网络插件，重置集群后需要清空/etc/cni/net.d 目录，不然可能会有如下错误

[reset] failed to remove etcd member: etcdserver: re-configuration failed due to not enough started members
.Please manually remove this etcd member using etcdctl

清空/etc/cni/net.d目录

rm -rf /etc/cni/net.d

有时用的k8s版本不一样，经常会遇到apiVersion:的版本不一样的情况，可以通过kubectl api-versions来查看当前版本支持的api版本

error: You must be logged in to the server (the server has asked for the client to provide credentials)

自建集群一年之后提示上面的错误，是因为~/.kube/config中的证书过期了，正常集群会自动更新，在master节点的/var/lib/kubelet/pki/kubelet-client-current.pem中，使用base64 -w 0 /var/lib/kubelet/pki/kubelet-client-current.pem将证书内容base64之后更新到所有kubectl命令服务器的~/.kube/config中，替换client-certificate-data和client-key-data的值

上一页K8S常用操作下一页K8S日志收集方案

最后更新于1年前