--insecure-skip-tls-verify 不适用于 kubefed join答案

【问题标题】：--insecure-skip-tls-verify doesn't work with kubefed join--insecure-skip-tls-verify 不适用于 kubefed join
【发布时间】：2018-10-02 19:05:39
【问题描述】：

我正在尝试使用 kubefed join 将集群添加到联邦：这是联邦 kube 配置文件：

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: REDACTED
    server: https://k8s-apiserver.cluster.local:8443
  name: kubernetes
- cluster:
    certificate-authority-data: REDACTED
    server: https://172.16.1.4:32471
  name: federation
- cluster:
    insecure-skip-tls-verify: true
    server: https://139.54.130.49:32046
  name: kubernetes-s1
contexts:
- context:
    cluster: kubernetes
    namespace: default
    user: kubectl
  name: default-context
- context:
    cluster: federation
    user: federation
  name: federation
- context:
    cluster: kubernetes
    namespace: kube-system
    user: kubectl
  name: kube-system-context
- context:
    cluster: kubernetes-s1
    namespace: default
    user: kubernetes-admins1
  name: kubernetes-admin-s1
current-context: federation
kind: Config
preferences: {}
users:
- name: federation
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
    token: e7506989-42eb-11e8-bf70-fa163eb593a3
- name: federation-basic-auth
  user:
    password: e7506937-42eb-11e8-bf70-fa163eb593a3
    username: admin
- name: kubectl
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: kubernetes-admins1
  user:
    token: eyJhbGciOiJSUz............

我运行这个命令：kubefed join site-1 --host-cluster-context=default-context --cluster-context=kubernetes-admin-s1 --insecure-skip-tls-verify=true，集群是已创建但处于脱机状态，无法访问；我正在使用令牌承载来访问目标集群的 api 服务器；我哪里错了？

kubectl describe clusters
Name:         site-1
Namespace:    
Labels:       <none>
Annotations:  federation.kubernetes.io/cluster-role-name=federation-controller-manager:federation-site-1-default-context
              federation.kubernetes.io/servive-account-name=site-1-default-context
API Version:  federation/v1beta1
Kind:         Cluster
Metadata:
  Creation Timestamp:  2018-04-22T17:37:40Z
  Resource Version:    1347
  Self Link:           /apis/federation/v1beta1/clusters/site-1
  UID:                 daf922d2-4653-11e8-aded-f225b0c7c174
Spec:
  Secret Ref:
    Name:  site-1-w4vv6
  Server Address By Client CID Rs:
    Client CIDR:     0.0.0.0/0
    Server Address:  https://139.54.130.49:32046
Status:
  Conditions:
    Last Probe Time:       2018-04-22T18:09:43Z
    Last Transition Time:  2018-04-22T17:37:42Z
    Message:               cluster is not reachable
    Reason:                ClusterNotReachable
    Status:                True
    Type:                  Offline
Events:                    <none>

【问题讨论】：

标签： kubernetes kubectl

【解决方案1】：

根据source code，该消息的含义与它所说的完全一样：

集群无法访问，因为控制器无法访问集群端点https://139.54.130.49:32046。

所以，只需检查端点是否正确以及是否可以从控制器连接。

【讨论】：

是的，联邦控制器使用tls认证访问目标集群的api服务器，如何告诉他像联邦api服务器一样跳过tls认证，因为我使用令牌访问目标api服务器
没有办法使用不安全的连接。 insecure-skip-tls-verify 只禁用 TLS 密钥的验证，不禁用 TLS 本身。