amazon-web-services - 为什么 Kubernetes apiserver 向 etcd 服务器提供了错误的证书？

Question

在 AWS EC2 实例上的 CoreOS 上运行 Kubernetes，我无法执行 apiserver成功通过 hyperkube Docker 容器。问题是 etcd server由于证书错误而拒绝连接。

这是怎么回事:

$ docker run -v/etc/ssl/etcd:/etc/ssl/etcd:ro gcr.io/google_containers/hyperkube:v1.1.2/hyperkube apiserver --bind-address=0.0.0.0 - -insecure-bind-address=127.0.0.1 --etcd-servers=https://172.31.29.111:2379 --allow-privileged=true --service-cluster-ip-range=10.3.0.0/24 --secure -port=443 --advertise-address=172.31.29.111 --admission-control=NamespaceLifecycle、NamespaceExists、LimitRanger、SecurityContextDeny、ServiceAccount、ResourceQuota --tls-cert-file=/etc/ssl/etcd/master1-master-client .pem --tls-private-key-file=/etc/ssl/etcd/master1-master-client-key.pem --client-ca-file=/etc/ssl/etcd/ca.pem --kubelet-证书颁发机构=/etc/ssl/etcd/ca.pem --kubelet-client-certificate=/etc/ssl/etcd/master1-master-client.pem --kubelet-client-key=/etc/ssl/etcd/master1-master-client-key.pem --kubelet-https=true
I0227 17:07:34.117098 1 plugins.go:71] 未指定云提供商。
I0227 17:07:34.549806 1 master.go:368] 未指定节点端口范围。默认为 30000-32767。
[restful] 2016/02/27 17:07:34 log.go:30: [restful/swagger] 列表可在 https://172.31.29.111:443/swaggerapi/获得
[restful] 2016/02/27 17:07:34 log.go:30: [restful/swagger] https://172.31.29.111:443/swaggerui/映射到文件夹/swagger-ui/
E0227 17:07:34.659701 1 cacher.go:149] 意外的 ListAndWatch 错误:pkg/storage/cacher.go:115:无法列出 *api.Pod:501:无法访问所有给定的对等点(无法向成员提议[https://172.31.29.111:2379] 两次 [最后一个错误:获取 https://172.31.29.111:2379/v2/keys/registry/pods?quorum=false&recursive=true&sorted=true: 远程错误:证书错误]) [0]


证书应该是好的。如果我在该 Docker 镜像中执行交互式 shell，我可以毫无问题地通过 curl 获取 etcd URL。 那么，这种情况出了什么问题，我该如何解决？

Answer 1

我发现我可以通过使用 --etcd-config 而不是 --etcd-servers 来解决这个问题:

docker run -p 443:443 -v/etc/kubernetes:/etc/kubernetes:ro -v/etc/ssl/etcd:/etc/ssl/etcd:ro gcr.io/google_containers/hyperkube :v1.1.2/hyperkube apiserver --bind-address=0.0.0.0 --insecure-bind-address=127.0.0.1 --etcd-config=/etc/kubernetes/etcd.client.conf --allow-privileged=true --service-cluster-ip-range=10.3.0.0/24 --secure-port=443 --advertise-address=172.31.29.111 --admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota -- kubelet-certificate-authority=/etc/ssl/etcd/ca.pem --kubelet-client-certificate=/etc/ssl/etcd/master1-master-client.pem --kubelet-client-key=/etc/ssl/etcd/master1-master-client-key.pem --client-ca-file=/etc/ssl/etcd/ca.pem --tls-cert-file=/etc/ssl/etcd/master1-master-client .pem --tls-private-key-file=/etc/ssl/etcd/master1-master-client-key.pem


etcd.client.conf:

{
“簇”: {
“机器”:[“https://172.31.29.111:2379”]
},
“配置”:{
“certFile”:“/etc/ssl/etcd/master1-master-client.pem”，
“keyFile”:“/etc/ssl/etcd/master1-master-client-key.pem”
}
}