使用外部CA执行kubeadm init时遭遇controller-manager.conf不存在的错误求助

算力阿峰

2026-4-17

我正在尝试使用自定义证书颁发机构（CA）引导Kubernetes集群。我遵循了Kubernetes加固指南，该指南建议为etcd和其余控制平面使用单独的CA。除此之外，我还为前端代理证书设置了一个外部CA，总共有三个CA。我使用Vault生成这些CA，利用离线根CA。

此外，我的集群设计为与已在运行的外部etcd集群配合工作。

我遵循了外部CA文档和PKI要求。生成证书并将其放置在控制平面节点上后，我有以下目录结构：

/etc/kubernetes/
├── manifests
└── pki
    ├── apiserver.crt
    ├── apiserver-etcd-client.crt
    ├── apiserver-etcd-client.key
    ├── apiserver.key
    ├── apiserver-kubelet-client.crt
    ├── apiserver-kubelet-client.key
    ├── ca.crt
    ├── etcd
    │   ├── ca.crt
    │   ├── healthcheck-client.crt
    │   └── healthcheck-client.key
    ├── front-proxy-ca.crt
    ├── front-proxy-client.crt
    └── front-proxy-client.key

4 directories, 13 files

遵循高可用性设置指南，我将kubeadm-config.yaml配置如下：

apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: stable
controlPlaneEndpoint: "load_balencer_dns_name:6443"
networking:
  podSubnet: "192.168.0.0/16"
etcd:
  external:
    endpoints:
      - "https://ip_node_1:2379"
      - "https://ip_node_2:2379"
      - "https://ip_node_3:2379"
    caFile: "/etc/kubernetes/pki/etcd/ca.crt"
    certFile: "/etc/kubernetes/pki/apiserver-etcd-client.crt"
    keyFile: "/etc/kubernetes/pki/apiserver-etcd-client.key"

然而，当运行以下命令时：

kubeadm init --config kubeadm-config.yaml --upload-certs --v=6

我遇到了以下错误：

I0315 16:38:30.120235   39470 initconfiguration.go:260] loading configuration from "kubeadm-config.yaml"
I0315 16:38:30.121084   39470 initconfiguration.go:122] detected and using CRI socket: unix:///var/run/crio/crio.sock
I0315 16:38:30.121228   39470 interface.go:432] Looking for default routes with IPv4 addresses
I0315 16:38:30.121243   39470 interface.go:437] Default route transits interface "ens18"
I0315 16:38:30.121333   39470 interface.go:209] Interface ens18 is up
I0315 16:38:30.121378   39470 interface.go:257] Interface "ens18" has 2 addresses :[ip].
I0315 16:38:30.121396   39470 interface.go:224] Checking addr  ip/cidr.
I0315 16:38:30.121409   39470 interface.go:231] IP found ip
I0315 16:38:30.121428   39470 interface.go:263] Found valid IPv4 address ip for interface "ens18".
I0315 16:38:30.121437   39470 interface.go:443] Found active IP ip 
I0315 16:38:30.121457   39470 kubelet.go:196] the value of KubeletConfiguration.cgroupDriver is empty; setting it to "systemd"
I0315 16:38:30.127682   39470 version.go:187] fetching Kubernetes version from URL: https://dl.k8s.io/release/stable.txt
I0315 16:38:30.713146   39470 certs.go:519] validating certificate period for CA certificate
I0315 16:38:30.713239   39470 certs.go:519] validating certificate period for API server certificate
I0315 16:38:30.713859   39470 certs.go:519] validating certificate period for API server kubelet client certificate
I0315 16:38:30.714411   39470 certs.go:519] validating certificate period for ca certificate
stat /etc/kubernetes/controller-manager.conf: no such file or directory
the controller-manager.conf file does not exists or it is not valid
k8s.io/kubernetes/cmd/kubeadm/app/phases/kubeconfig.ValidateKubeconfigsForExternalCA
    cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go:406
k8s.io/kubernetes/cmd/kubeadm/app/cmd.newInitData
    cmd/kubeadm/app/cmd/init.go:368
k8s.io/kubernetes/cmd/kubeadm/app/cmd.newCmdInit.func3
    cmd/kubeadm/app/cmd/init.go:170
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).InitData
    cmd/kubeadm/app/cmd/phases/workflow/runner.go:183
k8s.io/kubernetes/cmd/kubeadm/app/cmd.newCmdInit.func1
    cmd/kubeadm/app/cmd/init.go:116
github.com/spf13/cobra.(*Command).execute
    vendor/github.com/spf13/cobra/command.go:940
github.com/spf13/cobra.(*Command).ExecuteC
    vendor/github.com/spf13/cobra/command.go:1068
github.com/spf13/cobra.(*Command).Execute
    vendor/github.com/spf13/cobra/command.go:992
k8s.io/kubernetes/cmd/kubeadm/app.Run
    cmd/kubeadm/app/kubeadm.go:50
main.main
    cmd/kubeadm/kubeadm.go:25
runtime.main
    /usr/local/go/src/runtime/proc.go:267
runtime.goexit
    /usr/local/go/src/runtime/asm_amd64.s:1650

经过研究，我发现有相关问题提到，在外部CA模式下，需要预先配置其他文件，但我无法确认这一点。

我还尝试拆分kubeadm init步骤，运行以下命令：

kubeadm init phase kubeconfig controller-manager --config kubeadm-config.yaml

但仍然遇到相同的错误。

我的kubeadm、kubelet、kubectl版本均为1.29.2。我甚至尝试修改kubeadm-config文件，指定：

kubernetesVersion: "1.29.2"

但还是遇到同样的错误。

我现在向社区寻求帮助！

编辑：

我还尝试了--ignore-preflight-errors参数，将其添加到kubeadm init命令中：

kubeadm init --ignore-preflight-errors=All --config kubeadm-config.yaml

但仍然出现相同的错误。

备注：内容来源于stack exchange，提问作者Admineral