ubuntu - kubectl - 访问 GKE 集群时收到 PROTOCOL ERROR

Question

我在 WSL 中使用 Ubuntu 20.04 并从 Ubuntu 运行 gcloud 和 kubectl 以连接到 GKE 集群。当我尝试列出 pod 或任何其他操作时，我收到以下集群信息错误:

$kubectl cluster-info dump
I0530 23:58:41.719004    1446 log.go:184] protocol error: received *http2.GoAwayFrame before a SETTINGS frame
Unable to connect to the server: connection error: PROTOCOL_ERROR

$ kubectl version
I0531 00:04:52.960264    1503 log.go:172] protocol error: received *http2.GoAwayFrame before a SETTINGS frame
I0531 00:04:53.139292    1503 log.go:172] protocol error: received *http2.GoAwayFrame before a SETTINGS frame
Client Version: version.Info{Major:"1", Minor:"17+", GitVersion:"v1.17.17-dispatcher", GitCommit:"a39a896b5018d0c800124a36757433c660fd0880", GitTreeState:"clean", BuildDate:"2021-01-28T21:47:26Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}
Unable to connect to the server: connection error: PROTOCOL_ERROR

这是操作系统版本输出:

$ cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.2 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.2 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

GKE 版本:1.17.17-gke.4900
我可以使用 IP 从集群下载证书，但无法连接到集群。我尝试连接不同版本的 kubectl，还尝试使用 google-sdk 和 kubectl 连接运行 docker 容器，但我也遇到了同样的错误。
可能是什么问题呢。我以前连接到集群，但它停止工作。这是 Windows 的问题还是任何设置问题？任何帮助深表感谢。
更新:
我尝试使用 kubectl 使用的 curl 命令。这是输出。

$ curl -k -v -XGET  -H "Accept: application/json, */*" -H "User-Agent: kubectl/v1.17.17 (linux/amd64) kubernetes/a39a89                                  [1/2466]> 6" 'https://CLUSTER_IP:443/version?timeout=32s'
Note: Unnecessary use of -X or --request, GET is already inferred.
* Uses proxy env variable no_proxy == ',*.docker.internal'
*   Trying CLUSTER_IP:443...
* TCP_NODELAY set
* Connected to CLUSTER_IP (CLUSTER_IP) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=CLUSTER_IP
*  start date: Apr 26 22:11:53 2021 GMT
*  expire date: Apr 25 22:11:53 2026 GMT
*  issuer: CN=Untrusted CA - Dont Trust
*  SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7fffca298820)
> GET /version?timeout=32s HTTP/2
> Host: CLUSTER_IP
> accept: application/json, */*
> user-agent: kubectl/v1.17.17 (linux/amd64) kubernetes/a39a89
> 6
>
* http2 error: Remote peer returned unexpected data while we expected SETTINGS frame.  Perhaps, peer does not support HTTP/2 properly.
* Connection #0 to host CLUSTER_IP left intact
curl: (16) Error in the HTTP2 framing layer

Answer 1

找到失败的原因:
是VPN导致了这个问题。
VPN 设置为解密流量，并在深度检查后拒绝 http2 请求。