kubernetes - Kubernetes仪表板安装给出x509:证书由未知权限错误签名
问题描述
尝试在 Ubuntu 16.04 中安装 kubernetes 仪表板导致 x509: certificate signed by unknown authority 错误。
具有单个节点的 Kubernetes 集群运行良好,部署也在进行中。
尝试在没有任何锁定的情况下在 kubernetes-dashboard.yaml 文件中启用 apiserver-host 属性。
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended/kubernetes-dashboard.yaml 无法连接到服务器:x509:证书由未知机构签名
有什么建议么。
kubectl 的输出 get all -n kube-system
NAME READY STATUS RESTARTS AGE
pod/calico-node-6dgkc 2/2 Running 4 4d23h
pod/calico-node-v8xjr 2/2 Running 0 2d4h
pod/coredns-fb8b8dccf-8jznp 1/1 Running 2 4d23h
pod/coredns-fb8b8dccf-pl87d 1/1 Running 2 4d23h
pod/etcd-ets-kubernetes 1/1 Running 2 4d23h
pod/kube-apiserver-ets-kubernetes 1/1 Running 2 4d23h
pod/kube-controller-manager-ets-kubernetes 1/1 Running 2 4d23h
pod/kube-proxy-24qjz 1/1 Running 0 2d4h
pod/kube-proxy-ccqpn 1/1 Running 2 4d23h
pod/kube-scheduler-ets-kubernetes 1/1 Running 2 4d23h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/calico-typha ClusterIP 10.110.39.31 <none> 5473/TCP 4d23h
service/kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 4d23h
Error from server (Forbidden): replicationcontrollers is forbidden: User "system:node:ets-kubernetes" cannot list resource "replicationcontrollers" in API group "" in the namespace "kube-system"
Error from server (Forbidden): daemonsets.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "daemonsets" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): deployments.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "deployments" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): replicasets.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "replicasets" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): statefulsets.apps is forbidden: User "system:node:ets-kubernetes" cannot list resource "statefulsets" in API group "apps" in the namespace "kube-system"
Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:node:ets-kubernetes" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "kube-system"
Error from server (Forbidden): jobs.batch is forbidden: User "system:node:ets-kubernetes" cannot list resource "jobs" in API group "batch" in the namespace "kube-system"
Error from server (Forbidden): cronjobs.batch is forbidden: User "system:node:ets-kubernetes" cannot list resource "cronjobs" in API group "batch" in the namespace "kube-system"
kubectl 获取节点的输出
NAME STATUS ROLES AGE VERSION
ets-kubernetes Ready master 4d23h v1.14.1
ets-node Ready <none> 2d4h v1.14.1
解决方案
如果您指定如何部署集群但尝试重新生成集群证书会更好。如果你kubeadm
从控制平面节点使用然后你可以运行
kubeadm alpha certs renew
有关更多信息,请查看此
根据原始帖子的更新进行编辑:
根据您更新的输出,正如您从事件中看到的那样,不知何故有很多行,例如:
User "system:node:ets-kubernetes" cannot list resource .........
这意味着,上述用户没有相关角色来对指定资源执行这些操作。
要解决此问题,您必须为此用户创建相关的角色和角色绑定。您可以从官方使用 RBAC 授权文档中获取更多信息
推荐阅读
- javascript - 如何在 CSS 中重新创建此切换?
- docker - docker push 给我那个错误:“带有标签的图像在本地不存在”
- reactjs - 将文件上传到firebase存储并获取URL以保存在数据库中以进行反应
- javascript - 如果记录为空数据表 AJAX - dataSrc,则显示警告
- google-cloud-platform - 用于项目登录的 Google Cloud Console ip 限制
- c - 创建一个函数,按升序显示 00 到 99 之间的两位数字的所有不同组合(C 编程)
- c - 传递char未初始化的指针地址和成员变量的分配和提取
- c++ - 使用 C++ 通过 Windows 剪贴板进行 IPC
- ios - 在 ios swift 中使用 Slider 值绘制图形
- java - 在 OncePerRequestFilter 中返回正文