kubernetes - kubeadm初始化后的kube-proxy CrashLoopBackOff

Question

我正在使用kubeadm在CentOS 7.4 / Docker 1.12.6上创建kubernetes v1.9.3集群。
我正在按照Using kubeadm to Create a Cluster的指示进行操作。

成功完成kubeadm init后，我得到状态kube-proxy的CrashLoopBackOff

# kubectl -n kube-system get pods
NAME                                  READY     STATUS             RESTARTS   AGE
etcd-ksa-m1.blue                      1/1       Running            0          1m
kube-apiserver-ksa-m1.blue            1/1       Running            0          1m
kube-controller-manager-ksa-m1.blue   1/1       Running            0          1m
kube-dns-6f4fd4bdf-24hcr              0/3       Pending            0          2m
kube-proxy-n5lxp                      0/1       CrashLoopBackOff   4          2m
kube-scheduler-ksa-m1.blue            1/1       Running            0          1m

kube-proxy日志中存在错误:

# kubectl -n kube-system logs kube-proxy-n5lxp
I0312 16:39:01.667127       1 feature_gate.go:190] feature gates: map[]
error: unable to read certificate-authority /var/run/secrets/kubernetes.io/serviceaccount/ca.crt for default due to open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory

我在kubernetes github中发现了一个类似的问题: kubernetes/issues/59461，但是它开放了很长时间没有解决方案。

我还在那里添加了有关我的环境的更多详细信息:kubernetes/issues/59461#issuecomment-372385993

Answer 1

我刚刚发现它与docker systemd配置有关。我有一些由puppet编写的docker配置。

docker-mountflags.conf似乎引起了

问题

我有以下配置:

# cat /etc/systemd/system/docker.service.d/docker-mountflags.conf
[Service]
MountFlags=private

通过将其更改为默认值，我能够解决kube-proxy问题:

# cat /etc/systemd/system/docker.service.d/docker-mountflags.conf
[Service]
MountFlags=slave

更改后的

我有状态为kube-proxy的Running

# kubectl -n kube-system get pods
NAME                                  READY     STATUS    RESTARTS   AGE
etcd-ksa-m1.blue                      1/1       Running   0          18m
kube-apiserver-ksa-m1.blue            1/1       Running   0          18m
kube-controller-manager-ksa-m1.blue   1/1       Running   0          18m
kube-dns-6f4fd4bdf-lsclt              0/3       Pending   0          19m
kube-proxy-g29bt                      1/1       Running   0          19m
kube-scheduler-ksa-m1.blue            1/1       Running   0          18m