K8S學習心得 == kube-controller-manager 報錯configmaps "extension-apiserver-authentication" is forbidden: U

 

 

      當我按照教材設置證書，配置好kube-controller的相關條件後，啓動kube-controller-manage組件，卻意外報錯。

 

1、基本信息以下：

1. kube-controller-manager.service 文件以下

[Unit]
Description=kubernetes controller-manager service
After=network.target
After=network-online.target
Wants=network-online.target
# because the etcd service isn't in this machine
# After=etcd.service
# Wants=etcd.service

[Service]
EnvironmentFile=/k8s/kubernetes/cfg/kube-controller-manager-env
ExecStart=/k8s/kubernetes/bin/kube-controller-manager \
--port=0 \
--secure-port=10252 \
--bind-address=127.0.0.1 \
--kubeconfig=${KUBECONFIG} \
--authentication-kubeconfig=${KUBECONFIG} \
--authorization-kubeconfig=${KUBECONFIG} \
--service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE} \
--cluster-name=kubernetes \
--cluster-signing-cert-file=/k8s/kubernetes/ssl/k8s-ca.pem \
--cluster-signing-key-file=/k8s/kubernetes/ssl/k8s-ca-key.pem \
--experimental-cluster-signing-duration=8760h \
--root-ca-file=/k8s/kubernetes/ssl/k8s-ca.pem \
--service-account-private-key-file=/k8s/kubernetes/ssl/k8s-ca-key.pem \
--leader-elect=true \
--feature-gates=RotateKubeletServerCertificate=true \
--controllers=*,bootstrapsigner,tokencleaner \
--horizontal-pod-autoscaler-use-rest-clients=true \
--horizontal-pod-autoscaler-sync-period=10s \
--tls-cert-file=/k8s/kubernetes/ssl/kube-controller-manager-server.pem \
--tls-private-key-file=/k8s/kubernetes/ssl/kube-controller-manager-server-key.pem \
--use-service-account-credentials=true \
--alsologtostderr=true \
--logtostderr=false \
--log-dir=${LOG_DIR} \
--v=4
LimitNOFILE=1000000
User=root

[Install]
WantedBy=multi-user.target

 

2. 環境配置文件，以下

KUBECONFIG="/k8s/kubernetes/cfg/kube-controller-manager.kubeconfig"
SERVICE_CLUSTER_IP_RANGE="10.0.0.0/24"
LOG_DIR="/var/log/k8s/kube-controller-manager"

 

3. 錯誤信息以下：

configmaps "extension-apiserver-authentication" is forbidden: User "kubernetes" cannot get resource "configmaps" in API group ""

 

 

2、錯誤緣由和修復

後面發現根本不是configmap無權限或config文件生成有誤。而是咱們的kube-controller-manager.service.文件中參數開啓了[非安全模式http]「--port=0」致使。

當咱們刪除配置文件1中的兩行標黃的參數後，再從新執行服務啓動命令，此次發現kube-controller-manager成功啓動了。

備註：參數【安全模式https】「--secure-port=10252」必定要去掉，不然啓動服務會報錯「10252 已經被使用」

root >> systemctl daemon-reload

root >> systemctl restart kube-controller-manager

root >> netstat -nltp | grep kube

root >> kubectl get cs

root >> journalctl -u kube-controller-manager --since '2019-05-25 18:33:00'