Kubernetes KubeDNS x509:加载系统根失败，未提供根，但进行了卷曲工作

我在kubernetes的最新版本（1.5.1）中遇到了一个问题。我有一个安静的非常规设置，由5个Redhat Enterprise server组成。3个是节点，2个是主节点。两位大师都在etcd集群上，法兰绒也加入了裸金属。 我在kube DNS容器中有此循环日志：

未能列出*api.Endpoints:获取https://*.*.33:443/api/v1/Endpoints？resourceVersion=0:x509:未能加载系统根目录，且未提供根目录

我做了大量关于证书的测试。Curl可以完美地使用相同的凭据。这一代人是在库伯内特斯的正式推荐下产生的

这是我的不同配置文件（如果需要，只需检查ip和主机名）

kube-apiserver.yml

{
  "kind": "Pod",
  "apiVersion": "v1",
  "metadata": {
    "name": "kube-apiserver",
    "namespace": "kube-system",
    "labels": {
      "component": "kube-apiserver",
      "tier": "control-plane"
    }
  },
  "spec": {
    "volumes": [
      {
        "name": "certs",
        "hostPath": {
          "path": "/etc/ssl/certs"
        }
      },
      {
        "name": "pki",
        "hostPath": {
          "path": "/etc/kubernetes"
        }
      }
    ],
    "containers": [
      {
        "name": "kube-apiserver",
        "image": "gcr.io/google_containers/kube-apiserver-amd64:v1.5.1",
        "command": [
          "/usr/local/bin/kube-apiserver",
          "--v=0",
          "--insecure-bind-address=127.0.0.1",
          "--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota",
          "--service-cluster-ip-range=100.64.0.0/12",
          "--service-account-key-file=/etc/kubernetes/pki/apiserver-key.pem",
          "--client-ca-file=/etc/kubernetes/pki/ca.pem",
          "--tls-cert-file=/etc/kubernetes/pki/apiserver.pem",
          "--tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem",
          "--secure-port=5443",
          "--allow-privileged",
          "--advertise-address=X.X.X.33",
          "--etcd-servers=http://X.X.X.33:2379,http://X.X.X.37:2379",
          "--kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP"
        ],
        "resources": {
          "requests": {
            "cpu": "250m"
          }
        },
        "volumeMounts": [
          {
            "name": "certs",
            "mountPath": "/etc/ssl/certs"
          },
          {
            "name": "pki",
            "readOnly": true,
            "mountPath": "/etc/kubernetes/"
          }
        ],
        "livenessProbe": {
          "httpGet": {
            "path": "/healthz",
            "port": 8080,
            "host": "127.0.0.1"
          },
          "initialDelaySeconds": 15,
          "timeoutSeconds": 15
        }
      }
    ],
    "hostNetwork": true
  }
}

kube-controller-manager.yml

{
  "kind": "Pod",
  "apiVersion": "v1",
  "metadata": {
    "name": "kube-controller-manager",
    "namespace": "kube-system",
    "labels": {
      "component": "kube-controller-manager",
      "tier": "control-plane"
    }
  },
  "spec": {
    "volumes": [
      {
        "name": "pki",
        "hostPath": {
          "path": "/etc/kubernetes"
        }
      }
    ],
    "containers": [
      {
        "name": "kube-controller-manager",
        "image": "gcr.io/google_containers/kube-controller-manager-amd64:v1.5.1",
        "command": [
          "/usr/local/bin/kube-controller-manager",
          "--v=0",
          "--address=127.0.0.1",
          "--leader-elect=true",
          "--master=https://X.X.X.33",
          "--cluster-name= kubernetes",
          "--kubeconfig=/etc/kubernetes/kubeadminconfig",
          "--root-ca-file=/etc/kubernetes/pki/ca.pem",
          "--service-account-private-key-file=/etc/kubernetes/pki/apiserver-key.pem",
          "--cluster-signing-cert-file=/etc/kubernetes/pki/ca.pem",
          "--cluster-signing-key-file=/etc/kubernetes/pki/ca-key.pem"
        ],
        "resources": {
          "requests": {
            "cpu": "200m"
          }
        },
        "volumeMounts": [
          {
            "name": "pki",
            "readOnly": true,
            "mountPath": "/etc/kubernetes/"
          }
        ],
        "livenessProbe": {
          "httpGet": {
            "path": "/healthz",
            "port": 10252,
            "host": "127.0.0.1"
          },
          "initialDelaySeconds": 15,
          "timeoutSeconds": 15
        }
      }
    ],
    "hostNetwork": true
  }
}

kube-scheduler.yml

{
  "kind": "Pod",
  "apiVersion": "v1",
  "metadata": {
    "name": "kube-scheduler",
    "namespace": "kube-system",
    "labels": {
      "component": "kube-scheduler",
      "tier": "control-plane"
    }
  },
  "spec": {
"volumes": [
      {
        "name": "pki",
        "hostPath": {
          "path": "/etc/kubernetes"
        }
      }
    ],
    "containers": [
      {
        "name": "kube-scheduler",
        "image": "gcr.io/google_containers/kube-scheduler-amd64:v1.5.1",
        "command": [
          "/usr/local/bin/kube-scheduler",
          "--v=0",
          "--address=127.0.0.1",
          "--leader-elect=true",
      "--kubeconfig=/etc/kubernetes/kubeadminconfig",
          "--master=https://X.X.X.33"
        ],
        "resources": {
          "requests": {
            "cpu": "100m"
          }
        },
       "volumeMounts": [
          {
            "name": "pki",
            "readOnly": true,
            "mountPath": "/etc/kubernetes/"
          }
        ],
        "livenessProbe": {
          "httpGet": {
            "path": "/healthz",
            "port": 10251,
            "host": "127.0.0.1"
          },
          "initialDelaySeconds": 15,
          "timeoutSeconds": 15
        }
      }
    ],
    "hostNetwork": true
  }
}

haproxy.yml

{
  "kind": "Pod",
  "apiVersion": "v1",
  "metadata": {
    "name": "haproxy",
    "namespace": "kube-system",
    "labels": {
      "component": "kube-apiserver",
      "tier": "control-plane"
    }
  },
  "spec": {
    "volumes": [
      {
        "name": "vol",
        "hostPath": {
          "path": "/etc/haproxy/haproxy.cfg"
        }
      }
    ],
    "containers": [
      {
        "name": "haproxy",
        "image": "docker.io/haproxy:1.7",
        "resources": {
          "requests": {
            "cpu": "250m"
          }
        },
        "volumeMounts": [
          {
            "name": "vol",
            "readOnly": true,
            "mountPath": "/usr/local/etc/haproxy/haproxy.cfg"
          }
        ]
      }
    ],
    "hostNetwork": true
  }
}

库贝莱特服务公司

[Unit]
Description=Kubernetes Kubelet Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service 
Requires=docker.service

[Service]
WorkingDirectory=/var/lib/kubelet 
EnvironmentFile=/etc/kubernetes/kubelet     ExecStart=/usr/bin/kubelet \
        $KUBELET_ADDRESS \
        $KUBELET_POD_INFRA_CONTAINER \
        $KUBELET_ARGS \
        $KUBE_LOGTOSTDERR \
        $KUBE_ALLOW_PRIV \
        $KUBELET_NETWORK_ARGS \
        $KUBELET_DNS_ARGS
Restart=on-failure

[Install]
WantedBy=multi-user.target

库贝莱

KUBELET_ADDRESS="--address=0.0.0.0 --port=10250"
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest"
KUBELET_ARGS="--kubeconfig=/etc/kubernetes/kubeadminconfig --require-kubeconfig=true --pod-manifest-path=/etc/kubernetes/manifests"
KUBE_LOGTOSTDERR="--logtostderr=true --v=9"
KUBE_ALLOW_PRIV="--allow-privileged=true"
KUBELET_DNS_ARGS="--cluster-dns=100.64.0.10 --cluster-domain=cluster.local"

库巴德明肯

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.pem
    server: https://X.X.X.33
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: admin
  name: admin@kubernetes
- context:
    cluster: kubernetes
    user: kubelet
  name: kubelet@kubernetes
current-context: admin@kubernetes
kind: Config
users:
- name: admin
  user:
    client-certificate: /etc/kubernetes/pki/admin.pem
    client-key: /etc/kubernetes/pki/admin-key.pem

我已经在互联网上看到了与此问题相关的大部分问题，因此我希望有人能提供一些提示来调试此问题。

2这里的问题：在多主机设计中，您总是需要数量不均的主机，以防止出现大脑分裂的情况。您的问题是：默认情况下，Redhat不安装根证书。安装证书包，它应该开始工作。这里有两个问题：在多主机设计中，您总是需要数量不均衡的主机，以防止出现大脑分裂的情况。您的问题是：默认情况下，Redhat不安装根证书。安装证书包，它应该开始工作。