Kubernetes仪表板安装给出x509：由未知权限错误签名的证书

Question

尝试在 Ubuntu 16.04 中安装 kubernetes 仪表板导致 x509: certificate signed by unknown authority 错误。

具有单个节点的 Kubernetes 集群运行良好，部署也在进行中。

尝试在 kubernetes-dashboard.yaml 文件中启用 apiserver-host 属性而不使用任何锁定。

kubectl 应用 -f https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended/kubernetes-dashboard.yaml 无法连接到服务器：x509：证书由未知机构签名

任何建议。

kubectl 的输出 get all -n kube-system

NAME                                         READY   STATUS    RESTARTS   AGE
pod/calico-node-6dgkc                        2/2     Running   4          4d23h
pod/calico-node-v8xjr                        2/2     Running   0          2d4h
pod/coredns-fb8b8dccf-8jznp                  1/1     Running   2          4d23h
pod/coredns-fb8b8dccf-pl87d                  1/1     Running   2          4d23h
pod/etcd-ets-kubernetes                      1/1     Running   2          4d23h
pod/kube-apiserver-ets-kubernetes            1/1     Running   2          4d23h
pod/kube-controller-manager-ets-kubernetes   1/1     Running   2          4d23h
pod/kube-proxy-24qjz                         1/1     Running   0          2d4h
pod/kube-proxy-ccqpn                         1/1     Running   2          4d23h
pod/kube-scheduler-ets-kubernetes            1/1     Running   2          4d23h

NAME                   TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                  AGE
service/calico-typha   ClusterIP   10.110.39.31   <none>        5473/TCP                 4d23h
service/kube-dns       ClusterIP   10.96.0.10     <none>        53/UDP,53/TCP,9153/TCP   4d23h
Error from server (Forbidden): replicationcontrollers is forbidden: User "system:node:ets-kubernetes" cannot list resource "replicationcontrollers" in API group "" in the namespace "kube-system"
Error from server (Forbidden): daemonsets.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "daemonsets" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): deployments.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "deployments" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): replicasets.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "replicasets" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): statefulsets.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "statefulsets" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:node:ets-kubernetes" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "kube-system"
Error from server (Forbidden): jobs.batch is forbidden: User "system:node:ets-kubernetes" cannot list resource "jobs" in API group "batch" in the namespace "kube-system"
Error from server (Forbidden): cronjobs.batch is forbidden: User "system:node:ets-kubernetes" cannot list resource "cronjobs" in API group "batch" in the namespace "kube-system"

kubectl 获取节点的输出

NAME             STATUS   ROLES    AGE     VERSION
ets-kubernetes   Ready    master   4d23h   v1.14.1
ets-node         Ready    <none>   2d4h    v1.14.1

---

Kubectl 输出.PNG

证书错误.PNG

Answer 1

如果您指定如何部署集群会更好，但请尝试重新生成您的集群证书。如果您使用了kubeadm，那么您可以从控制平面节点运行

kubeadm alpha certs renew

欲了解更多信息check this

根据原帖的更新进行编辑：

根据您更新的输出，正如您从事件中看到的那样，不知何故有很多行，例如：

User "system:node:ets-kubernetes" cannot list resource .........

这意味着，上述用户没有相关角色来对指定资源执行这些操作。

要解决此问题，您必须为此用户创建相关的角色和角色绑定。 您可以从官方Using RBAC Authorization 文档中获取更多信息