Kubernetes kube dns获取kube代理无法列出*core.Endpoints

新的Kubernetes（1.10.0）集群使用安装在RHEL7裸机虚拟机上的kubeadm（1.10.0）进行升级

Linux 3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Dec 28 14:23:39 EST 2017 x86_64 x86_64 x86_64 GNU/Linux

kubeadm.x86_64                       1.10.0-0                installed
kubectl.x86_64                       1.10.0-0                installed
kubelet.x86_64                       1.10.0-0                installed
kubernetes-cni.x86_64                0.6.0-0                 installed

和1.12 docker

docker-engine.x86_64                 1.12.6-1.el7.centos     installed
docker-engine-selinux.noarch         1.12.6-1.el7.centos     installed

安装法兰绒v0.9.1吊舱网络

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.9.1/Documentation/kube-flannel.yml

kubeadm init Com和我跑的是

kubeadm init --pod-network-cidr=10.244.0.0/16 --kubernetes-version stable-1.10

这将成功完成，并且工作节点上的kubeadm连接也成功。我可以在主机上部署busybox pod，并且NSLookup是成功的，但是一旦我将任何东西部署到工作节点，我就会从主机上的工作节点收到失败的API调用：

E0331 03:28:44.368253       1 reflector.go:205] k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion/factory.go:86: Failed to list *core.Service: Get https://172.30.0.85:6443/api/v1/services?limit=500&resourceVersion=0: dial tcp 172.30.0.85:6443: getsockopt: connection refused
E0331 03:28:44.368987       1 reflector.go:205] k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion/factory.go:86: Failed to list *core.Endpoints: Get https://172.30.0.85:6443/api/v1/endpoints?limit=500&resourceVersion=0: dial tcp 172.30.0.85:6443: getsockopt: connection refused
E0331 03:28:44.735886       1 event.go:209] Unable to write event: 'Post https://172.30.0.85:6443/api/v1/namespaces/default/events: dial tcp 172.30.0.85:6443: getsockopt: connection refused' (may retry after sleeping)
E0331 03:28:51.980131       1 reflector.go:205] k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion/factory.go:86: Failed to list *core.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:kube-proxy" cannot list endpoints at the cluster scope
I0331 03:28:52.048995       1 controller_utils.go:1026] Caches are synced for service config controller
I0331 03:28:53.049005       1 controller_utils.go:1026] Caches are synced for endpoints config controller

然后就超时了

kubectl exec -it busybox -- nslookup kubernetes
Server:    10.96.0.10
Address 1: 10.96.0.10

nslookup: can't resolve 'kubernetes'
command terminated with exit code 1

我看过许多关于stackoverflow和github的类似帖子，似乎都是通过设置iptables解决的——一个FORWARD-j接受，但这次不是。我还包括了worker节点的iptables

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
KUBE-SERVICES  all  --  anywhere             anywhere             /* kubernetes service portals */
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-SERVICES  all  --  anywhere             anywhere             /* kubernetes service portals */
DOCKER     all  --  anywhere            !loopback/8           ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
KUBE-POSTROUTING  all  --  anywhere             anywhere             /* kubernetes postrouting rules */
MASQUERADE  all  --  172.17.0.0/16        anywhere
RETURN     all  --  10.244.0.0/16        10.244.0.0/16
MASQUERADE  all  --  10.244.0.0/16       !base-address.mcast.net/4
RETURN     all  -- !10.244.0.0/16        box2.ara.ac.nz/24
MASQUERADE  all  -- !10.244.0.0/16        10.244.0.0/16

Chain DOCKER (2 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain KUBE-MARK-DROP (0 references)
target     prot opt source               destination
MARK       all  --  anywhere             anywhere             MARK or 0x8000

Chain KUBE-MARK-MASQ (6 references)
target     prot opt source               destination
MARK       all  --  anywhere             anywhere             MARK or 0x4000

Chain KUBE-NODEPORTS (1 references)
target     prot opt source               destination

Chain KUBE-POSTROUTING (1 references)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere             /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000

Chain KUBE-SEP-HZC4RESJCS322LXV (1 references)
target     prot opt source               destination
KUBE-MARK-MASQ  all  --  10.244.0.18          anywhere             /* kube-system/kube-dns:dns-tcp */
DNAT       tcp  --  anywhere             anywhere             /* kube-system/kube-dns:dns-tcp */ tcp to:10.244.0.18:53

Chain KUBE-SEP-JNNVSHBUREKVBFWD (1 references)
target     prot opt source               destination
KUBE-MARK-MASQ  all  --  10.244.0.18          anywhere             /* kube-system/kube-dns:dns */
DNAT       udp  --  anywhere             anywhere             /* kube-system/kube-dns:dns */ udp to:10.244.0.18:53

Chain KUBE-SEP-U3UDAUPXUG5BP2NG (2 references)
target     prot opt source               destination
KUBE-MARK-MASQ  all  --  box1.ara.ac.nz       anywhere             /* default/kubernetes:https */
DNAT       tcp  --  anywhere             anywhere             /* default/kubernetes:https */ recent: SET name: KUBE-SEP-U3UDAUPXUG5BP2NG side: source mask: 255.255.255.255 tcp to:172.30.0.85:6443

Chain KUBE-SERVICES (2 references)
target     prot opt source               destination
KUBE-MARK-MASQ  tcp  -- !10.244.0.0/16        10.96.0.1            /* default/kubernetes:https cluster IP */ tcp dpt:https
KUBE-SVC-NPX46M4PTMTKRN6Y  tcp  --  anywhere             10.96.0.1            /* default/kubernetes:https cluster IP */ tcp dpt:https
KUBE-MARK-MASQ  udp  -- !10.244.0.0/16        10.96.0.10           /* kube-system/kube-dns:dns cluster IP */ udp dpt:domain
KUBE-SVC-TCOU7JCQXEZGVUNU  udp  --  anywhere             10.96.0.10           /* kube-system/kube-dns:dns cluster IP */ udp dpt:domain
KUBE-MARK-MASQ  tcp  -- !10.244.0.0/16        10.96.0.10           /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:domain
KUBE-SVC-ERIFXISQEP7F7OF4  tcp  --  anywhere             10.96.0.10           /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:domain
KUBE-NODEPORTS  all  --  anywhere             anywhere             /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL

Chain KUBE-SVC-ERIFXISQEP7F7OF4 (1 references)
target     prot opt source               destination
KUBE-SEP-HZC4RESJCS322LXV  all  --  anywhere             anywhere             /* kube-system/kube-dns:dns-tcp */

Chain KUBE-SVC-NPX46M4PTMTKRN6Y (1 references)
target     prot opt source               destination
KUBE-SEP-U3UDAUPXUG5BP2NG  all  --  anywhere             anywhere             /* default/kubernetes:https */ recent: CHECK seconds: 10800 reap name: KUBE-SEP-U3UDAUPXUG5BP2NG side: source mask: 255.255.255.255
KUBE-SEP-U3UDAUPXUG5BP2NG  all  --  anywhere             anywhere             /* default/kubernetes:https */

Chain KUBE-SVC-TCOU7JCQXEZGVUNU (1 references)
target     prot opt source               destination
KUBE-SEP-JNNVSHBUREKVBFWD  all  --  anywhere             anywhere             /* kube-system/kube-dns:dns */

Chain WEAVE (0 references)
target     prot opt source               destination

Chain cali-OUTPUT (0 references)
target     prot opt source               destination

Chain cali-POSTROUTING (0 references)
target     prot opt source               destination

Chain cali-PREROUTING (0 references)
target     prot opt source               destination

Chain cali-fip-dnat (0 references)
target     prot opt source               destination

Chain cali-fip-snat (0 references)
target     prot opt source               destination

Chain cali-nat-outgoing (0 references)
target     prot opt source               destination

我还可以看到数据包被丢弃在法兰绒界面上

flannel.1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 10.244.1.0  netmask 255.255.255.255  broadcast 0.0.0.0
        inet6 fe80::a096:47ff:fe58:e438  prefixlen 64  scopeid 0x20<link>
        ether a2:96:47:58:e4:38  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 198  bytes 14747 (14.4 KiB)
        TX errors 0  dropped 27 overruns 0  carrier 0  collisions 0

法兰绒1：标志=4163 mtu 1450 inet 10.244.1.0网络掩码255.255.255.255广播0.0.0.0 inet6 fe80:：a096:47ff:fe58:e438预桥64作用域ID 0x20 乙醚a2:96:47:58:e4:38 txqueuelen 0（以太网） 接收数据包0字节0（0.0B） 接收错误0丢弃0超出0帧0 发送数据包198字节14747（14.4千字节） 发送错误0丢失27超限0载波0冲突0

---

我已经在其他虚拟机上安装了相同版本的Kubernetes/Docker和Flannel，它可以正常工作，但不确定为什么我会在这次安装中从工作节点获取这些失败的API调用到主代理？我有几次新的安装，并尝试了weave和calico pod网络，也取得了相同的结果。

正确，因此我通过将法兰绒网络更改为weave容器网络，以及kubeadm重置和重启虚拟机来实现这一点

---

不知道法兰绒和我的虚拟机出了什么问题，但很高兴它能正常运行

我想第一步是curl-ivkL''，看看您是否可以访问API服务器。它可以连接，我忘了说firewalld和selinux在两个VM上都被禁用了

。#curl-ivkL'172.30.0.85:6443'*即将连接（）到172.30.0.85端口6443（#0）*尝试172.30.0.85…*已连接到172.30.0.85（172.30.0.85）端口6443（#0）>GET/HTTP/1.1>用户代理：curl/7.29.0>主机：172.30.0.85:6443>接受：//*