集群内Pod用.NET Kubernetes客户端启动AKS Job遇SSL证书验证错误

问题重现 #

在AKS集群内的Pod中运行以下F#代码启动Kubernetes Job时，首次调用DeleteNamespacedJobAsync抛出SSL连接异常：

//F#
let startJob (yaml: string) = task {
    let config = KubernetesClientConfiguration.InClusterConfig()
    let job = KubernetesYaml.Deserialize<V1Job>(yaml)

    use client = new Kubernetes(config)
    let! _ = client.BatchV1.DeleteNamespacedJobAsync(job.Name(), job.Metadata.Namespace())
    let! _ = client.BatchV1.CreateNamespacedJobAsync(job, job.Namespace()) }

异常信息：

无法建立SSL连接，请查看内部异常。
远程证书被提供的RemoteCertificateValidationCallback拒绝。

解决方案 #

1. 调整TLS证书验证配置 #

集群内运行时，InClusterConfig有时无法正确加载AKS的CA证书，可通过以下两种方式修复：

方式一：指定CA证书路径（推荐生产环境）

集群内Pod的服务账号默认挂载CA证书到/var/run/secrets/kubernetes.io/serviceaccount/ca.crt，手动指定该路径即可：

let startJob (yaml: string) = task {
    let config = 
        let cfg = KubernetesClientConfiguration.InClusterConfig()
        // 显式指定集群CA证书路径
        cfg.CaCertPath <- "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
        cfg
    let job = KubernetesYaml.Deserialize<V1Job>(yaml)

    use client = new Kubernetes(config)
    let! _ = client.BatchV1.DeleteNamespacedJobAsync(job.Name(), job.Metadata.Namespace())
    let! _ = client.BatchV1.CreateNamespacedJobAsync(job, job.Namespace()) }

方式二：临时跳过TLS验证（仅测试环境）

如果只是测试场景，可临时关闭证书验证（生产环境禁止使用）：

let startJob (yaml: string) = task {
    let config = 
        let cfg = KubernetesClientConfiguration.InClusterConfig()
        cfg.SkipTlsVerify <- true
        cfg
    let job = KubernetesYaml.Deserialize<V1Job>(yaml)

    use client = new Kubernetes(config)
    let! _ = client.BatchV1.DeleteNamespacedJobAsync(job.Name(), job.Metadata.Namespace())
    let! _ = client.BatchV1.CreateNamespacedJobAsync(job, job.Namespace()) }

2. 验证服务账号权限 #

确保Pod使用的服务账号拥有操作Job的权限，创建对应的Role和RoleBinding：

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: <你的命名空间>
  name: job-operator-role
rules:
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["create", "delete", "get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: <你的命名空间>
  name: job-operator-binding
subjects:
- kind: ServiceAccount
  name: <Pod使用的服务账号名>
  namespace: <你的命名空间>
roleRef:
  kind: Role
  name: job-operator-role
  apiGroup: rbac.authorization.k8s.io

内容的提问来源于stack exchange，提问作者Franco Tiveron