x509: certificate signed by unknown authority (possibly because of “crypto/rsa: verification error“

「爱情、让人受尽委屈。」 2022-11-21 01:05 192阅读 0赞

执行下面命令初始化k8s集群时

kubeadm init --pod-network-cidr 10.21.0.0/16 \
        --image-repository registry.cn-hangzhou.aliyuncs.com/google_containers

通过 kubectl get pods -n kube-system 查看pods状态

发现coredns对应的pod状态为ContainerCreating，

通过**kubectl describe pods -n kube-system coredns-6c76c8bb89-9br5d** 查看对应pod状态有下面错误信息：

reate pod sandbox: rpc error: code = Unknown desc = \[failed to set up sandbox container "5ac64afb8a4f7c98aeeb5f459a80410cb9b180ad92322adc0bfe0b9ce1c81107" network for pod "coredns-6c76c8bb89-jlzgn": networkPlugin cni failed to set up pod "coredns-6c76c8bb89-jlzgn\_kube-system" network: error getting ClusterInformation: Get https://\[10.96.0.1\]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"), failed to clean up sandbox container "5ac64afb8a4f7c98aeeb5f459a80410cb9b180ad92322adc0bfe0b9ce1c81107" network for pod "coredns-6c76c8bb89-jlzgn": networkPlugin cni failed to teardown pod "coredns-6c76c8bb89-jlzgn\_kube-system" network: error getting ClusterInformation: Get https://\[10.96.0.1\]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")\]

网上搜索一圈无效后又研究了下**kubeadm reset**命令执行后的输出结果：

The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d

The reset process does not reset or clean up iptables rules or IPVS tables.  
If you wish to reset iptables, you must do so manually by using the "iptables" command.

If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)  
to reset your system's IPVS tables.

The reset process does not clean your kubeconfig files and you must remove them manually.  
Please, check the contents of the $HOME/.kube/config file.

然后根据上面的提示把/etc/cni/net.d目录删掉，然后重新执行kubeadm init命令就可以了。