添加Windows Worker Node至K8s集群时kube-proxy启动失败

环境信息 #

• Kubernetes版本：v1.23.13
• 容器运行时：containerd
• CNI插件：Flannel
• 控制节点：Ubuntu 18.04（VMware ESXi虚拟机）
• Windows节点：Windows Server 2019（独立虚拟机）
• 操作依据：官方添加Windows节点文档（已归档）

现象 #

Windows节点成功加入集群，但以下Pod部署失败：

• kube-proxy-windows-hq7bb：状态为CrashLoopBackOff，重启次数达10次
• kube-flannel-ds-windows-amd64-xfhjl：状态为ImagePullBackOff

kube-proxy Pod错误详情 #

Normal   Created   (x5 over )  kubelet  创建容器kube-proxy
Normal   Pulled    (x5 over )  kubelet  容器镜像"sigwindowstools/kube-proxy:v1.23.13-nanoserver"已存在于本地
Warning  Failed                         kubelet  错误：failed to create containerd task: hcsshim::CreateComputeSystem kube-proxy: 目录名称无效。
(额外信息：{"Owner":"containerd-shim-runhcs-v1.exe","SchemaVersion":{"Major":2,"Minor":1},"Container":{"GuestOs":{"HostName":"kube-proxy-windows-hq7bb"},"Storage":{"Layers":[{"Id":"e30f10e1-6696-5df6-af3f-156a372bce4e","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\19"},{"Id":"8aa59a8b-78d3-5efe-a3d9-660bd52fd6ce","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\18"},{"Id":"f222f973-9869-5b65-a546-cb8ae78a32b9","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\17"},{"Id":"133385ae-6df6-509b-b342-bc46338b3df4","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\16"},{"Id":"f6f9524c-e3f0-5be2-978d-7e09e0b21299","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\15"},{"Id":"0d9d58e6-47b6-5091-a552-7cc2027ca06f","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\14"},{"Id":"6715ca06-295b-5fba-9224-795ca5af71b9","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\13"},{"Id":"75e64a3b-69a5-52cf-b39f-ee05718eb1e2","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\12"},{"Id":"8698c4b4-b092-57c6-b1eb-0a7ca14fcf4e","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\11"},{"Id":"7c9a6fb7-2ca8-5ef7-bbfe-cabbff23cfa4","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\10"},{"Id":"a10d4ad8-f2b1-5fd6-993f-7aa642762865","Path":"C:\ProgramData\containerd\root\io.containerd.snapshotter.v1.windows\snapshots\9"}],"Path":"\\?\Volume{64336318-a64f-436e-869c-55f9f8e4ea62}"},"MappedDirectories":[{"HostPath":"c:\","ContainerPath":"c:\host"},{"HostPath":"c:\var\lib\kubelet\pods\1cd0c333-3cd0-4c90-9d22-884ea73e8b69\containers\kube-proxy\0e58a001","ContainerPath":"c:\dev\termination-log"},{"HostPath":"c:\var\lib\kubelet\pods\1cd0c333-3cd0-4c90-9d22-884ea73e8b69\volumes\kubernetes.io~configmap\kube-proxy","ContainerPath":"c:\var\lib\kube-proxy","ReadOnly":true},{"HostPath":"c:\var\lib\kubelet\pods\1cd0c333-3cd0-4c90-9d22-884ea73e8b69\volumes\kubernetes.io~configmap\kube-proxy-windows","ContainerPath":"c:\var\lib\kube-proxy-windows","ReadOnly":true},{"HostPath":"c:\var\lib\kubelet\pods\1cd0c333-3cd0-4c90-9d22-884ea73e8b69\volumes\kubernetes.io~projected\kube-api-access-4zs46","ContainerPath":"c:\var\run\secrets\kubernetes.io\serviceaccount","ReadOnly":true},{"HostPath":"c:\var\lib\kubelet\pods\1cd0c333-3cd0-4c90-9d22-884ea73e8b69\etc-hosts","ContainerPath":"C:\Windows\System32\drivers\etc\hosts"}],"MappedPipes":[{"ContainerPipeName":"rancher_wins","HostPath":"\\.\pipe\rancher_wins"}],"Networking":{"Namespace":"4a4d0354-251a-4750-8251-51ae42707db2"}},"ShouldTerminateOnLastHandleClosed":true}): unknown
Warning  BackOff   (x23 over )  kubelet  退避重启失败的容器

集群Pod状态 #

kubectl get pods -A
NAMESPACE     NAME                                      READY   STATUS             RESTARTS             AGE
kube-system   coredns-64897985d-2mkd5                   1/1     Running            0                    19h
kube-system   coredns-64897985d-qhhbz                   1/1     Running            0                    19h
kube-system   etcd-scspa2658542001                      1/1     Running            2                    19h
kube-system   kube-apiserver-scspa2658542001            1/1     Running            8 (3h4m ago)         19h
kube-system   kube-controller-manager-scspa2658542001   1/1     Running            54 (126m ago)        19h
kube-system   kube-flannel-ds-hjw8s                     1/1     Running            14 (18h ago)         19h
kube-system   kube-flannel-ds-windows-amd64-xfhjl       0/1     ImagePullBackOff   0                    29m
kube-system   kube-proxy-windows-hq7bb                  0/1     CrashLoopBackOff   10 (<invalid> ago)   29m
kube-system   kube-proxy-wx2x9                          1/1     Running            0                    19h
kube-system   kube-scheduler-scspa2658542001            1/1     Running            92 (153m ago)        19h

针对kube-proxy的“目录名称无效”错误 #

该错误源于Windows容器挂载路径格式问题或containerd配置异常，按以下步骤排查：

1. 修正containerd配置
   编辑Windows节点上的C:\Program Files\containerd\config.toml，确保配置项正确：

   [plugins."io.containerd.grpc.v1.cri".containerd]
     snapshotter = "windows"
     default_runtime_name = "runhcs"
   [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runhcs]
     runtime_type = "io.containerd.runhcs.v1"
   

   重启containerd服务：Restart-Service containerd

2. 修复挂载路径格式
   检查Windows节点kubelet配置，确保--root-dir使用标准Windows路径（如C:\var\lib\kubelet），然后删除失败的Pod让DaemonSet重建：

   kubectl delete pod kube-proxy-windows-hq7bb -n kube-system
   

3. 验证Windows容器基础功能
   在Windows节点手动运行测试容器，确认containerd正常工作：

   ctr images pull mcr.microsoft.com/windows/nanoserver:ltsc2019
   ctr run --rm mcr.microsoft.com/windows/nanoserver:ltsc2019 test-container cmd /c echo hello
   

   若此命令失败，需重新配置或重装containerd。

针对Flannel Pod的ImagePullBackOff错误 #

1. 替换为适配版本的镜像
   编辑Flannel Windows DaemonSet，使用对应Kubernetes版本的镜像：

   kubectl edit ds kube-flannel-ds-windows-amd64 -n kube-system
   

   将镜像改为mcr.microsoft.com/oss/coreos/flannel:v0.18.1-windows-amd64（与v1.23.13兼容），保存后等待Pod重建。

2. 检查节点网络连通性
   确认Windows节点可访问镜像仓库：

   Test-NetConnection mcr.microsoft.com -Port 443
   

   若无法连通，需配置代理或调整防火墙规则，允许HTTPS访问镜像仓库。

3. 手动拉取镜像
   在Windows节点手动拉取Flannel镜像，避免Pod拉取失败：

   ctr images pull mcr.microsoft.com/oss/coreos/flannel:v0.18.1-windows-amd64
   

优先解决containerd配置问题，确保Windows容器可正常运行，再处理Flannel镜像拉取问题。若问题持续，可查看Windows节点kubelet日志（C:\var\log\kubelet.log）获取更多细节。

内容的提问来源于stack exchange，提问作者user2830260