在給kubernetes安裝dashboard時，可能會存在CA證書問題導致dashboard pod啟動失敗，用kubectl logs <podname> -n kube-system查看日志會發現有這樣的日志存在
Expected to load root CA config from /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, but got err: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory
這是因為kubernetes默認創建的secrets 資源不包含用于訪問apiserver的根證書
這需要重新生產證書和秘鑰
１ 使用easyrsa生成證書和秘鑰
wget https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
tar zxf easy-rsa.tar.gz
cd easy-rsa/easyrsa3
./easyrsa init-pki
2 創建根證書
./easyrsa --batch "--req-cn=masterip@date +%s" build-ca nopass
3 創建服務端證書和秘鑰
./easyrsa --subject-alt-name="IP:masterip,IP:clusterip,DNS:kubernetes.default" build-server-full kubernetes-master server nopass
本文用例
./easyrsa --subject-alt-name="IP:192.168.100.20,IP:10.10.10.1,DNS:kubernetes.default" build-server-full kubernetes-master server nopass
./easyrsa --dn-mode=org --req-cn=kubecfg --req-org=system:master --req-c= --req-st= --req-city= --req-email= --req-ou= build-client-full kubecfg nopass
4 拷貝pki/ca.crt、pki/issued/server.crt和pki/private/server.key至指定的目錄
mkdir /etc/kubernetes/pki
cp pki/ca.crt pki/issued/server.crt pki/private/server.key /etc/kubernetes/pki/
cp -fr pki/issued/kubecfg.crt /srv/kubernetes/
cp -fr pki/private/kubecfg.key /srv/kubernetes
chmod 644 /etc/kubernetes/pki/*
openssl x509 -noout -text -in /srv/kubernetes/server.crt
創建token
echo 123456,admin,admin > /srv/kubernetes/basic_auth.csv # 格式：密碼,用戶名,用戶ID
5 更新apiserver服務啟動參數
--client-ca-file=/etc/kubernetes/pki/ca.crt
--tls-cert-file=/etc/kubernetes/pki/server.crt
--tls-private-key-file=/etc/kubernetes/pki/server.key
--basic-auth-file=/srv/kubernetes/basic_auth.csv
6 更新controller-manager服務啟動參數
--service_account_private_key_file=/etc/kubernetes/pki/server.key
--root-ca-file=/etc/kubernetes/pki/ca.crt
7 刪除舊secrets資源
root@mon2:~# kubectl get secrets --all-namespaces
NAMESPACE NAME TYPE DATA AGE
default ceph-secret Opaque 1 22h
default default-token-50p5c kubernetes.io/service-account-token 3 4h
kubectl delete secret default-token-50p5c
8 重啟apiserver 和controller-manager
systemcal restart apiserver controller-manager
9 檢查新創建的secret是否包含根證書
root@mon2:~# kubectl get secrets --all-namespaces
NAMESPACE NAME TYPE DATA AGE
default ceph-secret Opaque 1 22h
default default-token-50p5c kubernetes.io/service-account-token 3 4h
kube-public default-token-667l9 kubernetes.io/service-account-token 3 4h
kube-system default-token-d9n7c kubernetes.io/service-account-token 3 4h
現在重新創建dashboard就不會出現證書找不到了
