x509：kubernetes 中未知权威签署的证书答案

【问题标题】：x509: certificate signed by unknown authority in kubernetesx509：kubernetes 中未知权威签署的证书
【发布时间】：2021-12-14 15:12:20
【问题描述】：

当我将新服务部署到此集群时，我的 kubernetes 集群突然显示此错误：

Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "02ceaa702704151a69b1f9f5210d4a68956c2b41050b711319f07d38f57364af": error getting ClusterInformation: Get "https://10.96.0.1:443/apis/crd.projectcalico.org/v1/clusterinformations/default": x509: certificate signed by unknown authority

这个集群在几个月内运行良好，我使用这个命令来检查我的 kubernetes 集群证书，如下所示：

[root@k8smasterone ~]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '
            Not Before: Aug  3 13:31:21 2021 GMT
            Not After : Aug  4 04:40:53 2022 GMT

证书没有过期 util 2022.08，为什么会显示这个错误？我应该怎么做才能解决这个问题？这是所有证书的过期状态：

[root@k8smasterone ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Aug 03, 2022 13:31 UTC   234d                                    no      
apiserver                  Aug 04, 2022 04:40 UTC   234d            ca                      no      
apiserver-etcd-client      Aug 03, 2022 13:31 UTC   234d            etcd-ca                 no      
apiserver-kubelet-client   Aug 03, 2022 13:31 UTC   234d            ca                      no      
controller-manager.conf    Aug 03, 2022 13:31 UTC   234d                                    no      
etcd-healthcheck-client    Aug 03, 2022 13:31 UTC   234d            etcd-ca                 no      
etcd-peer                  Aug 03, 2022 13:31 UTC   234d            etcd-ca                 no      
etcd-server                Aug 03, 2022 13:31 UTC   234d            etcd-ca                 no      
front-proxy-client         Aug 03, 2022 13:31 UTC   234d            front-proxy-ca          no      
scheduler.conf             Aug 03, 2022 13:31 UTC   234d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Aug 01, 2031 13:31 UTC   9y              no      
etcd-ca                 Aug 01, 2031 13:31 UTC   9y              no      
front-proxy-ca          Aug 01, 2031 13:31 UTC   9y              no

这是我的 kubernetes 版本信息：

[root@k8smasterone ~]# kubectl version
Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.3", GitCommit:"ca643a4d1f7bfe34773c74f79527be4afd95bf39", GitTreeState:"clean", BuildDate:"2021-07-15T21:04:39Z", GoVersion:"go1.16.6", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.2", GitCommit:"092fbfbf53427de67cac1e9fa54aaa09a28371d7", GitTreeState:"clean", BuildDate:"2021-06-16T12:53:14Z", GoVersion:"go1.16.5", Compiler:"gc", Platform:"linux/amd64"}

我确定 kube 代理在主节点中运行。

【问题讨论】：

x509: certificate signed by unknown authority 并不意味着证书已过期。这个错误可能有很多原因。你运行的是什么版本的 K8s？您的组织是否允许使用自签名证书？是否有 kubectl proxy 出于某种原因在主节点上运行？
我遇到了类似的问题，重新安装 calico 对我有用。
我没有重新安装calico，我尝试重新启动calico，对我不起作用。仍然不明白为什么会这样。 @Daigo

标签： kubernetes

【解决方案1】：

这不是证书过期的问题，而是集群组件之间的信任问题，似乎信任被破坏了。这可能是相关的。如果有帮助，请检查以下内容： https://discuss.kubernetes.io/t/solved-x509-certificate-error/14151 https://programmerah.com/failed-to-create-pod-sandbox-rpc-error-code-unknown-desc-failed-to-set-up-sandbox-container-28097/

【讨论】：