solve k8s problem

介绍

记录在使用k8s过程中所遇到的问题，以及解决方案

kubectl get nodes 证书ip问题

Unable to connect to the server: x509: certificate is valid for 10.233.0.1, 172.19.157.57, 172.19.157.57, 10.233.0.1, 127.0.0.1, 172.19.157.57, 172.19.252.199, not 47.xxx.xx.x

• 场景

阿里云安装，全部使用私网地址，创建service account后使用kubectl从公网访问报错

• 解决方案 supplementary_addresses_in_ssl_keys 添加公网地址

vi inventory/mycluster/group_vars/k8s-cluster/k8s-cluster.yml

supplementary_addresses_in_ssl_keys: [47.xxx.xx.x]

# 重新安装部署，使配置生效
ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml

• 参考

Invalid x509 certificate for kubernetes master

经验证kubespray v2.14.1不需要执行rm /etc/kubernetes/pki/apiserver.*

system:anonymous 无法访问 k8s dashboard

`services "https:kubernetes-dashboard:" is forbidden: User "system:anonymous" cannot get services/proxy in the namespace "kube-system"`

• 解决方案 添加system:anonymous的访问权限

cat <<EOF | kubectl apply -f -
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-anonymous
rules:
- apiGroups: [""]
  resources: ["services/proxy"]
  resourceNames: ["https:kubernetes-dashboard:"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- nonResourceURLs: ["/ui", "/ui/*", "/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/*"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard-anonymous
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard-anonymous
subjects:
- kind: User
  name: system:anonymous
EOF

• 参考

Enable Access for Kubernetes Dashboard via external VIP or Floating IP