kuberenetes 升级后新加入节点报错

问题简述

原本用kubeadm安装的的kubernetes 1.11.x集群升级到1.12.x 后(使用kubeadm upgrade升级)发现无法将新的node加入到集群中,会出现以下报错信息

1
2
3
4
5
6
7
8
9
10
11
12
13
[preflight] running pre-flight checks
[WARNING RequiredIPVSKernelModulesAvailable]: the IPVS proxier will not be used, because the following required kernel modules are not loaded: [ip_vs_sh ip_vs ip_vs_rr ip_vs_wrr] or no builtin kernel ipvs support: map[ip_vs_rr:{} ip_vs_wrr:{} ip_vs_sh:{} nf_conntrack_ipv4:{} ip_vs:{}]
you can solve this problem with following methods:
1. Run 'modprobe -- ' to load missing kernel modules;
2. Provide the missing builtin kernel ipvs support

[discovery] Trying to connect to API Server "172.19.170.254:6443"
[discovery] Created cluster-info discovery client, requesting info from "https://172.19.170.254:6443"
[discovery] Requesting info from "https://172.19.170.254:6443" again to validate TLS against the pinned public key
[discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server "172.19.170.254:6443"
[discovery] Successfully established connection with API Server "172.19.170.254:6443"
[kubelet] Downloading configuration for the kubelet from the "kubelet-config-1.12" ConfigMap in the kube-system namespace
configmaps "kubelet-config-1.12" is forbidden: User "system:bootstrap:y1zgt7" cannot get configmaps in the namespace "kube-system"

修复方法

在master节点上执行步骤1-4,在从节点(将要加入集群的机器)上执行步骤5

步骤一

从现有的”ConfigMap kubelet-config-1.11” 创建一个新的ConfigMap “kubelet-config-1.12”

1
2
3
4
5
6
$ kubectl get cm --all-namespaces
$ kubectl -n kube-system get cm kubelet-config-1.11 -o yaml --export > kubelet-config-1.12-cm.yaml
$ vim kubelet-config-1.12-cm.yaml #modify at the bottom:
#name: kubelet-config-1.12
#delete selfLink
$ kubectl -n kube-system create -f kubelet-config-1.12-cm.yaml

步骤二:获取令牌前缀

1
2
3
4
5
$ kubeadm token list           #if no output, then create a token:
$ kubeadm token create
TOKEN ... ...
a0b1c2.svn4my9ifft4zxgg ... ...
# Token prefix is "a0b1c2"

步骤三

从现有角色“kubeadm:kubelet-config-1.11”创建一个新角色“kubeadm:kubelet-config-1.12”

1
2
3
4
5
6
7
$ kubectl get roles --all-namespaces
$ kubectl -n kube-system get role kubeadm:kubelet-config-1.11 -o yaml > kubeadm:kubelet-config-1.12-role.yaml
$ vim kubeadm\:kubelet-config-1.12-role.yaml #modify the following:
#name: kubeadm:kubelet-config-1.12
#resourceNames: kubelet-config-1.12
#delete creationTimestamp, resourceVersion, selfLink, uid (because --export option is not supported)
$ kubectl -n kube-system create -f kubeadm\:kubelet-config-1.12-role.yaml

步骤四

从现有角色绑定 “kubeadm:kubelet-config-1.11” 创建一个新角色绑定 “kubeadm:kubelet-config-1.12”

1
2
3
4
5
6
7
8
9
10
$ kubectl get rolebindings --all-namespaces
$ kubectl -n kube-system get rolebinding kubeadm:kubelet-config-1.11 -o yaml > kubeadm:kubelet-config-1.12-rolebinding.yaml
$ vim kubeadm\:kubelet-config-1.12-rolebinding.yaml #modify the following:
#metadata/name: kubeadm:kubelet-config-1.12
#roleRef/name: kubeadm:kubelet-config-1.12
#delete creationTimestamp, resourceVersion, selfLink, uid (because --export option is not supported)
- apiGroup: rbac.authorization.k8s.io #add these 3 lines as another group in "subjects:" at the bottom, with the 6 character token prefix from STEP 2
kind: Group
name: system:bootstrap:a0b1c2
$ kubectl -n kube-system create -f kubeadm\:kubelet-config-1.12-rolebinding.yaml

步骤5:从工作节点启动kubeadm join

1
2
3
$ sudo kubeadm join --token <token> <master-IP>:6443 --discovery-token-ca-cert-hash sha256:<key-value> 
# If you receive 2 ERRORS, run kubeadm join again with the following options:
$ sudo kubeadm join --token <token> <master-IP>:6443 --discovery-token-ca-cert-hash sha256:<key-value> --ignore-preflight-errors=FileAvailable--etc-kubernetes-bootstrap-kubelet.conf,FileAvailable--etc-kubernetes-pki-ca.crt
-------------本文结束感谢您的阅读-------------

本文标题:kuberenetes 升级后新加入节点报错

文章作者:icyboy

发布时间:2019年05月15日 - 20:00

最后更新:2019年05月15日 - 16:00

原始链接:http://icyxp.github.io/blog/2019/05/k8s-kubeadm-up-node-join-failed.html

许可协议: 署名-非商业性使用-禁止演绎 4.0 国际 转载请保留原文链接及作者。