Kuberneters节点加入证书过期问题解决方案

比眉伴天荒 2023-03-05 09:51 6阅读 0赞

证书过期加入集群报错如下：

root@worker00 ~]# kubeadm join 172.16.0.106:6443 --token bovuz7.a7rzxono6gk5jt78 --discovery-token-ca-cert-hash sha256:49e20dee4a7794f99ab6999daed1f32b0e8585bdbf8c96636dea502448982789
    W0804 17:04:08.455469    4376 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
    [preflight] Running pre-flight checks
    error execution phase preflight: couldn't validate the identity of the API Server: could not find a JWS signature in the cluster-info ConfigMap for token ID "bovuz7"
    To see the stack trace of this error execute with --v=5 or higher

解决方案,重新生成token，以及sha256：

root@master00 ~]# kubeadm token create
    W0804 17:12:29.119893   19826 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
    ahmkaw.06mtkupwl3dvt3up
    [root@master00 ~]# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
    49e20dee4a7794f99ab6999daed1f32b0e8585bdbf8c96636dea502448982789
    [root@master00 ~]#

更换token和sha256再次加入即可：

[root@worker00 ~]# kubeadm join 172.16.0.106:6443 --token ahmkaw.06mtkupwl3dvt3up --discovery-token-ca-cert-hash sha256:49e20dee4a7794f99ab6999daed1f32b0e8585bdbf8c96636dea502448982789
    W0804 17:15:01.868306    5148 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
    [preflight] Running pre-flight checks
    [preflight] Reading configuration from the cluster...
    [preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
    [kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace
    [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
    [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
    [kubelet-start] Starting the kubelet
    [kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
    
    This node has joined the cluster:
    * Certificate signing request was sent to apiserver and a response was received.
    * The Kubelet was informed of the new secure connection details.
    
    Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
    
    [root@worker00 ~]#