kubernetes - coredns 崩溃并出现错误 "Failed to list *v1.Service: Get https://10.96.0.1:443/api/v1/****: dial tcp 10.96.0.1:443: connect: no route to host"

Question

CoreDNS Pod 未运行。请查看以下状态。

kubectl get po --all-namespaces -o wide | grep -i coredns
kube-system            coredns-6955765f44-8qhkr                    1/1     Running            0          24m     10.244.0.59      k8s-master          <none>           <none>
kube-system            coredns-6955765f44-lpmjk                    0/1     Running            0          24m     10.244.1.43      k8s-worker-node-1   <none>           <none>

请查看以下 Pod 日志。

kubectl logs coredns-6955765f44-lpmjk -n kube-system



E0420 03:43:03.855622       1 reflector.go:125] pkg/mod/k8s.io/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="fe9d92979b908ad39991be88ced0ced0ced3cccecfc7cec8cccecec6cbcfcecfd3c9c69acc9f98c9c7cc9c9f9c" rel="noreferrer noopener nofollow">[email protected]</a>/tools/cache/reflector.go:98: Failed to list *v1.Namespace: Get https://10.96.0.1:443/api/v1/namespaces?limit=500&resourceVersion=0: dial tcp 10.96.0.1:443: connect: no route to host
E0420 03:43:03.855622       1 reflector.go:125] pkg/mod/k8s.io/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a4c7c8cdc1cad089c3cbe4d2948a948a94899694959d94929694949c9195949589939cc096c5c2939d96c6c5c6" rel="noreferrer noopener nofollow">[email protected]</a>/tools/cache/reflector.go:98: Failed to list *v1.Namespace: Get https://10.96.0.1:443/api/v1/namespaces?limit=500&resourceVersion=0: dial tcp 10.96.0.1:443: connect: no route to host
E0420 03:43:03.855622       1 reflector.go:125] pkg/mod/k8s.io/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="bfdcd3d6dad1cb92d8d0ffc98f918f918f928d8f8e868f898d8f8f878a8e8f8e928887db8dded988868ddddedd" rel="noreferrer noopener nofollow">[email protected]</a>/tools/cache/reflector.go:98: Failed to list *v1.Namespace: Get https://10.96.0.1:443/api/v1/namespaces?limit=500&resourceVersion=0: dial tcp 10.96.0.1:443: connect: no route to host
E0420 03:43:03.855622       1 reflector.go:125] pkg/mod/k8s.io/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="1b7877727e756f367c745b6d2b352b352b36292b2a222b2d292b2b232e2a2b2a362c237f297a7d2c2229797a79" rel="noreferrer noopener nofollow">[email protected]</a>/tools/cache/reflector.go:98: Failed to list *v1.Namespace: Get https://10.96.0.1:443/api/v1/namespaces?limit=500&resourceVersion=0: dial tcp 10.96.0.1:443: connect: no route to host
E0420 03:43:05.859525       1 reflector.go:125] pkg/mod/k8s.io/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="3a5956535f544e175d557a4c0a140a140a17080a0b030a0c080a0a020f0b0a0b170d025e085b5c0d0308585b58" rel="noreferrer noopener nofollow">[email protected]</a>/tools/cache/reflector.go:98: Failed to list *v1.Namespace: Get https://10.96.0.1:443/api/v1/namespaces?limit=500&resourceVersion=0: dial tcp 10.96.0.1:443: connect: no route to host
E0420 03:43:05.859525       1 reflector.go:125] pkg/mod/k8s.io/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="63000f0a060d174e040c2315534d534d534e5153525a53555153535b565253524e545b07510205545a51010201" rel="noreferrer noopener nofollow">[email protected]</a>/tools/cache/reflector.go:98: Failed to list *v1.Namespace: Get https://10.96.0.1:443/api/v1/namespaces?limit=500&resourceVersion=0: dial tcp 10.96.0.1:443: connect: no route to host

Answer 1

要解决 CoreDNS Pod 的没有到主机的路由问题，您必须通过运行以下命令刷新 iptables:

systemctl stop kubelet
systemctl stop docker
iptables --flush
iptables -tnat --flush
systemctl start kubelet
systemctl start docker

另请注意，flannel 已从 kubeadm documentation 中的 CNI 列表中删除。 :

The reason for that is that Cluster Lifecycle have been getting a number of issues related to flannel (either in kubeadm or kops tickets) and we don't have good answers for the users as the project is not actively maintained. - Add note that issues for CNI should be logged in the respective issue trackers and that Calico is the only CNI we e2e test kubeadm against.

因此推荐的方法也将迁移到 Calico CNI。