添加新的控制平面节点失败 k8s 1.21.0

如何解决添加新的控制平面节点失败 k8s 1.21.0

我想在集群中添加一个新的控制平面节点。

所以，我在现有的控制平面服务器中运行： kubeadm token create --print-join-command

我在新的控制平面节点中运行此命令：

kubeadm join 10.0.0.151:8443 --token m3g8pf.gdop9wz08yhd7a8a --discovery-token-ca-cert-hash sha256:634db22bc69b47b8f2b9f733d2f5e95cf8e56b349e68ac611a56d9da0cf481b8 --control-plane --apiserver-advertise-address 10.0.0.10 --apiserver-bind-port 6443 --certificate-key 33cf0a1d30da4c714755b4de4f659d6d5a02e7a0bd522af2ebc2741487e53166

3. 我收到了这条消息：

[download-certs] Downloading the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace 
error execution phase control-plane-prepare/download-certs: error downloading certs: the Secret does not include the required certificate or key - name: external-e
tcd.crt,path: /etc/kubernetes/pki/apiserver-etcd-client.crt

4. 我在现有的生产控制平面节点中运行：

kubeadm init phase upload-certs --upload-certs
[upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
[upload-certs] Using certificate key:
0a3f5486c3b9303a4ace70ad0a9870c2605d67eebcd500d68a5e776bbd628a3b

5. 在新的控制平面节点中重新运行此命令：

kubeadm join 10.0.0.151:8443 --token m3g8pf.gdop9wz08yhd7a8a --discovery-token-ca-cert-hash sha256:634db22bc69b47b8f2b9f733d2f5e95cf8e56b349e68ac611a56d9da0cf481b8 --control-plane --apiserver-advertise-address 10.0.0.10 --apiserver-bind-port 6443 --certificate-key 0a3f5486c3b9303a4ace70ad0a9870c2605d67eebcd500d68a5e776bbd628a3b

我收到了同样的消息：

[download-certs] Downloading the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
error execution phase control-plane-prepare/download-certs: error downloading certs: the Secret does not include the required certificate or key - name: external-etcd.crt,path: /etc/kubernetes/pki/apiserver-etcd-client.crt
To see the stack trace of this error execute with --v=5 or higher

我怎么了？

在执行此操作之前，我已在新节点中安装了所有证书：

# ls /etc/kubernetes/pki/
apiserver.crt              apiserver.key                 ca.crt  front-proxy-ca.crt      front-proxy-client.key
apiserver-etcd-client.crt  apiserver-kubelet-client.crt  ca.key  front-proxy-ca.key      sa.key
apiserver-etcd-client.key  apiserver-kubelet-client.key  etcd    front-proxy-client.crt  sa.pub

我没有看到如何指定 etcd 证书文件：

Usage:
  kubeadm init phase upload-certs [flags]

Flags:
      --certificate-key string       Key used to encrypt the control-plane certificates in the kubeadm-certs Secret.
      --config string                Path to a kubeadm configuration file.
  -h,--help                         help for upload-certs
      --kubeconfig string            The kubeconfig file to use when talking to the cluster. If the flag is not set,a set of standard locations can be searched for an existing kubeconfig file. (default "/etc/kubernetes/admin.conf")
      --skip-certificate-key-print   Don't print the key used to encrypt the control-plane certificates.
      --upload-certs                 Upload control-plane certificates to the kubeadm-certs Secret.

Global Flags:
      --add-dir-header           If true,adds the file directory to the header of the log messages
      --log-file string          If non-empty,use this log file
      --log-file-max-size uint   Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0,the maximum file size is unlimited. (default 1800)
      --one-output               If true,only write logs to their native severity level (vs also writing to each lower severity level)
      --rootfs string            [EXPERIMENTAL] The path to the 'real' host root filesystem.
      --skip-headers             If true,avoid header prefixes in the log messages
      --skip-log-headers         If true,avoid headers when opening log files
  -v,--v Level                  number for the log level verbosity

解决方法

您还需要将 --config 标志传递给您的 kubeadm init phase 命令（如果需要，请使用 sudo）。所以，而不是：

kubeadm init phase upload-certs --upload-certs

你应该例如运行：

kubeadm init phase upload-certs --upload-certs --config kubeadm-config.yaml

此主题也由 Uploading control-plane certificates to the cluster 文档解释。