etcd集群不可用或配置错误；无法验证证书；因为它不包含任何 IP SAN

Question

所以我正在尝试在 Kubernetes 集群上创建一个 pod。这是我从中创建 pod 的 yml 文件。

kind: Pod
apiVersion: v1
metadata:
  name: task-pv-pod2
spec:
  containers:
    - name: task-pv-container2
      image: <<image_name>>

容器在创建容器时挂起。这是 kubectl describe pod 的输出。

Events:
  FirstSeen LastSeen    Count   From                    SubObjectPath   Type        Reason      Message
  --------- --------    -----   ----                    -------------   --------    ------      -------
  10s       10s     1   default-scheduler                   Normal      Scheduled   Successfully assigned task-pv-pod2 to ip-10-205-234-170.ec2.internal
  8s        8s      1   kubelet, ip-10-205-234-170.ec2.internal         Warning     FailedSync  Error syncing pod, skipping: failed to "SetupNetwork" for "task-pv-pod2_default" with SetupNetworkError: "NetworkPlugin cni failed to set up pod \"task-pv-pod2_default\" network: client: etcd cluster is unavailable or misconfigured; error #0: x509: cannot validate certificate for 10.205.234.170 because it doesn't contain any IP SANs\n; error #1: x509: cannot validate certificate for 10.205.235.160 because it doesn't contain any IP SANs\n; error #2: x509: cannot validate certificate for 10.205.234.162 because it doesn't contain any IP SANs\n"

  7s    6s  2   kubelet, ip-10-205-234-170.ec2.internal     Warning FailedSync  Error syncing pod, skipping: failed to "TeardownNetwork" for "task-pv-pod2_default" with TeardownNetworkError: "NetworkPlugin cni failed to teardown pod \"task-pv-pod2_default\" network: client: etcd cluster is unavailable or misconfigured; error #0: x509: cannot validate certificate for 10.205.234.170 because it doesn't contain any IP SANs\n; error #1: x509: cannot validate certificate for 10.205.235.160 because it doesn't contain any IP SANs\n; error #2: x509: cannot validate certificate for 10.205.234.162 because it doesn't contain any IP SANs\n"

有谁知道这可能是什么原因造成的。为了让 Kubernetes 作为云提供商与 aws 一起工作，我必须在 hyperkube 容器中设置一个代理变量。公司

Answer 1

您访问的名称（或 IP）似乎不信任您的 ETCD 证书。我建议您使用kubectl get cs 检查您的集群健康状况，并在需要时修改 k8s 与 ETCD 对话的方式。