无法通过certificate-authority认证Kubernetes集群问题求助

问题描述 #

搭建kubeadm集群后，修改.kube/config文件：将硬编码的certificate-authority-data（CA证书的Base64编码值）导出到ca.b64.crt文件，同时把client-certificate和client-key的对应值迁移到磁盘独立文件。修改后的配置文件如下：

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.b64.crt
    server: https://172.31.127.100:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate: /etc/kubernetes/pki/admins/admin.b64.crt
    client-key: /etc/kubernetes/pki/admins/admin.b64.key

执行kubectl get po等命令时，触发错误：

xxxx:~$ k get po
error: unable to load root certificates: unable to parse bytes as PEM block

解决步骤 #

错误根源是导出的文件仅保存了Base64编码字符串，而kubectl要求证书/密钥必须是PEM格式的明文文件，需对编码内容解码：

• 解码CA证书：

  base64 -d /etc/kubernetes/pki/ca.b64.crt > /etc/kubernetes/pki/ca.crt
  

• 解码客户端证书：

  base64 -d /etc/kubernetes/pki/admins/admin.b64.crt > /etc/kubernetes/pki/admins/admin.crt
  

• 解码客户端密钥：

  base64 -d /etc/kubernetes/pki/admins/admin.b64.key > /etc/kubernetes/pki/admins/admin.key
  

• 更新.kube/config中的路径为解码后的明文文件：

  apiVersion: v1
  clusters:
  - cluster:
      certificate-authority: /etc/kubernetes/pki/ca.crt
      server: https://172.31.127.100:6443
    name: kubernetes
  contexts:
  - context:
      cluster: kubernetes
      user: kubernetes-admin
    name: kubernetes-admin@kubernetes
  current-context: kubernetes-admin@kubernetes
  kind: Config
  preferences: {}
  users:
  - name: kubernetes-admin
    user:
      client-certificate: /etc/kubernetes/pki/admins/admin.crt
      client-key: /etc/kubernetes/pki/admins/admin.key
  

• 验证修复效果：

  kubectl get pods
  

内容的提问来源于stack exchange，提问作者Khaled