Kubernetes API 服务器连接被拒绝

Question

我正在尝试使用https://coreos.com/kubernetes/docs/latest/getting-started.html 处的说明设置 Kubernetes 集群。

我在第 2 步（部署主服务器）中，当我启动主服务时，主服务处于活动状态，但无法与 API 服务器通信。此外，启动了 6 个容器，但日志为空。请在下面找到 kubelet 日志：

    Jan 26 07:54:18 kubernetes-1.novalocal systemd[1]: Started kubelet.service.
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: W0126 07:54:20.214551    1115 server.go:585] Could not load kubeconfig file /var/lib/kubelet/kubeconfig: stat /var/lib/kubelet/kubeconfig: no such file or directory. Trying auth path instead.
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: W0126 07:54:20.214631    1115 server.go:547] Could not load kubernetes auth path /var/lib/kubelet/kubernetes_auth: stat /var/lib/kubelet/kubernetes_auth: no such file or directory. Continuing with defaults.
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.217269    1115 plugins.go:71] No cloud provider specified.
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.219217    1115 manager.go:128] cAdvisor running in container: "/system.slice/kubelet.service"
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.672952    1115 fs.go:108] Filesystem partitions: map[/dev/vda9:{mountpoint:/ major:254 minor:9 fsType: blockSize:0} /dev/vda3:{mountpoint:/usr major:254 minor:3 fsType: blockSize:0} /dev/vda6:{mountpoi
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.856238    1115 manager.go:163] Machine: {NumCores:2 CpuFrequency:1999999 MemoryCapacity:4149022720 MachineID:5a493caa9327449cabd050ac6cd2e065 SystemUUID:5A493CAA-9327-449C-ABD0-50AC6CD2E065 BootID:541d
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.858067    1115 manager.go:169] Version: {KernelVersion:4.3.3-coreos-r2 ContainerOsVersion:CoreOS 899.5.0 DockerVersion:1.9.1 CadvisorVersion: CadvisorRevision:}
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.862564    1115 server.go:798] Adding manifest file: /etc/kubernetes/manifests
    Jan 26 07:54:20 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:20.862655    1115 server.go:808] Watching apiserver
    Jan 26 07:54:21 kubernetes-1.novalocal kubelet[1115]: I0126 07:54:21.165506    1115 plugins.go:56] Registering credential provider: .dockercfg
    Jan 26 07:54:21 kubernetes-1.novalocal kubelet[1115]: E0126 07:54:21.171563    1115 kubelet.go:2284] Error updating node status, will retry: error getting node "192.168.111.32": Get http://127.0.0.1:8080/api/v1/nodes/192.168.111.32: dial tcp 127.0.0.1:8080: connection r
    Jan 26 07:54:21 kubernetes-1.novalocal kubelet[1115]: E0126 07:54:21.172329    1115 kubelet.go:2284] Error updating node status, will retry: error getting node "192.168.111.32": Get http://127.0.0.1:8080/api/v1/nodes/192.168.111.32: dial tcp 127.0.0.1:8080: connection r
    Jan 26 07:54:21 kubernetes-1.novalocal kubelet[1115]: E0126 07:54:21.173114    1115 kubelet.go:2284] Error updating node status, will retry: error getting node "192.168.111.32": Get http://127.0.0.1:8080/api/v1/nodes/192.168.111.32: dial tcp 127.0.0.1:8080: connection refused

另外，以下是启动的容器。

    2bf275350996        gcr.io/google_containers/podmaster:1.1      "/podmaster --etcd-se"   26 minutes ago      Up 26 minutes                           k8s_controller-manager-elector.5b0f7cea_kube-podmaster-192.168.111.32_kube-system_3b8350635fe89ab366063da0be8969fd_1f370f8c
    c64042286744        gcr.io/google_containers/podmaster:1.1      "/podmaster --etcd-se"   26 minutes ago      Up 26 minutes                           k8s_scheduler-elector.bc3d71be_kube-podmaster-192.168.111.32_kube-system_3b8350635fe89ab366063da0be8969fd_c9ecb387
    81bd74d0396a        gcr.io/google_containers/hyperkube:v1.1.2   "/hyperkube proxy --m"   26 minutes ago      Up 26 minutes                           k8s_kube-proxy.176f5569_kube-proxy-192.168.111.32_kube-system_8a987aa8c76c4d76bd80ccff5b65ffea_840d8228
    39494ed8e814        gcr.io/google_containers/pause:0.8.0        "/pause"                 27 minutes ago      Up 27 minutes                           k8s_POD.6d00e006_kube-podmaster-192.168.111.32_kube-system_3b8350635fe89ab366063da0be8969fd_36b73b1d
    632dc0a2f612        gcr.io/google_containers/pause:0.8.0        "/pause"                 27 minutes ago      Up 27 minutes                           k8s_POD.6d00e006_kube-apiserver-192.168.111.32_kube-system_86819bf93f678db0ee778b8c8bb658dc_815c6627
    361b297b37f9        gcr.io/google_containers/pause:0.8.0        "/pause"                 27 minutes ago      Up 27 minutes                           k8s_POD.6d00e006_kube-proxy-192.168.111.32_kube-system_8a987aa8c76c4d76bd80ccff5b65ffea_7a6182ed

Answer 1

这些正在尝试与不安全的 API 版本进行通信，这不应该在机器之间工作。这只适用于主人。此外，主节点未设置为接受工作 (register_node=false)，因此不会报告其状态。

我们缺少的关键信息，该日志来自哪台机器？ MASTER_HOST=参数你设置对了吗？

主节点的地址。在大多数情况下，这将是节点的可公开路由的 IP。工作节点必须能够通过端口 443 上的此地址到达主节点。

另外，请注意section of the docs：

请注意，在主节点上运行的 kubelet 可能会重复尝试将其状态发布到 API 服务器。这些警告是预期行为，可以忽略。未来的 Kubernetes 版本计划更优雅地处理这种常见的部署考虑。