一、官網鏡像無法下載
解決方法：需要翻牆
配置docker翻牆機：
cat /usr/lib/systemd/system/docker.service
[Service]
Environment="HTTP_PROXY=http://10.53.16.201:1080/"
重啟docker服務
二、pause k8s鏡像下載失敗
pod啟動失敗，查看pod詳情(kubectl describe pods podname)
Events:
FirstSeen LastSeen Count From SubobjectPath Type Reason Message
--------- -------- ----- ---- ------------- -------- ------ -------
56s 56s 1 {default-scheduler } Normal Scheduled Successfully assigned nfs-rc-fc2w8 to duni-node1 11s 11s 1 {kubelet duni-node1} Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for gcr.io/google_containers/pause-amd64:3.0, this may be because there are no credentials on this request. details: (Get https://gcr.io/v1/_ping: dial tcp 74.125.203.82:443: i/o timeout)"
解決：
找到翻牆機器 下載鏡像，上傳到自己的私有倉庫:xxx.xxxx.xxxx/pause-amd64:3.0
gcr.io/google_containers/pause-amd64:3.0
修改kubelet 配置：
--pod-infra-container-image=xxx.xxxx.xxxx/pause-amd64:3.0 \
重啟: kubelet
三、權限問題
通過rc配置文件起pod，rc中配置了privileged為true，發現pod狀態一直Running不起來，查看pod詳情發現
[root@docker tmp]# kubectl describe pods nfs-rc-acbo1 Name: nfs-rc-acbo1 Namespace: default Node: duni-node2 Labels: role=nfs-server Status: Pending IP: Controllers: ReplicationController/nfs-rc Containers: nfs-server: Image: 192.168.100.90:5000/nfs-data Port: 2049/TCP Volume Mounts: <none> Environment Variables: <none> Conditions: Type Status PodScheduled True No volumes. QoS Class: BestEffort Tolerations: <none> Events: FirstSeen LastSeen Count From SubobjectPath Type Reason Message --------- -------- ----- ---- ------------- -------- ------ ------- 27s 27s 1 {default-scheduler } Normal Scheduled Successfully assigned nfs-rc-acbo1 to duni-node2 27s 27s 1 {kubelet duni-node2} Warning FailedValidation Error validating pod nfs-rc-acbo1.default from api, ignoring: spec.containers[0].securityContext.privileged: Forbidden: disallowed by policy
解決：
修改所有node以及master節點的k8s配置文件 vim /etc/kubernetes/config
$ KUBE_ALLOW_PRIV="--allow-privileged=true" $ systemctl restart kube-apiserver
四、getsockopt: connection timed out’問題
如果安裝的docker版本為1.13及以上，並且網絡暢通，flannel、etcd都正常，但還是會出現getsockopt: connection timed out'的錯誤，則可能是iptables配置問題。具體問題：
Error: 'dial tcp 10.233.50.3:8443: getsockopt: connection timed out
- 1
docker從1.13版本開始，可能將iptables FORWARD chain的默認策略設置為DROP，從而導致ping其他Node上的Pod IP失敗，遇到這種問題時，需要手動設置策略為ACCEPT：
sudo iptables -P FORWARD ACCEPT
- 1
使用iptables -nL命令查看，發現Forward的策略還是drop，可是我們明明執行了iptables -P FORWARD ACCEPT。原來，docker是在這句話執行之后啟動的，需要每次在docker之后再執行這句話。。。這么做有點太麻煩了，所以我們修改下docker的啟動腳本：
vi /usr/lib/systemd/system/docker.service
[Service] Type=notify # the default is not to use systemd for cgroups because the delegate issues still # exists and systemd currently does not support the cgroup feature set required # for containers run by docker
ExecStart=/usr/bin/dockerd $DOCKER_NETWORK_OPTIONS $DOCKER_OPTS $DOCKER_DNS_OPTIONS # 添加這行操作，在每次重啟docker之前都會設置iptables策略為ACCEPT
ExecStartPost=/sbin/iptables -I FORWARD -s 0.0.0.0/0 -j ACCEPT
ExecReload=/bin/kill -s HUP $MAINPID
五、部署 Ingress Controller 的問題
部署完了后端就得把最重要的組件 Nginx+Ingres Controller(官方統一稱為 Ingress Controller) 部署上
➜ ~ kubectl create -f nginx-ingress-controller.yaml daemonset "nginx-ingress-lb" created
注意：官方的 Ingress Controller 有個坑，至少我看了 DaemonSet 方式部署的有這個問題：沒有綁定到宿主機 80 端口，也就是說前端 Nginx 沒有監聽宿主機 80 端口(這還玩個卵啊)；所以需要把配置搞下來自己加一下 hostNetwork，截圖如下
hostNetwork: true ##這行
containers:
- name: nginx-ingress-controller
image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.9.0
六、問題6
kube-proxy: E0103 18:30:04.060770 40611 proxier.go:977] conntrack return with error: error looking for path of conntrack: exec: "conntrack": executable file not found in $PATH
yum install conntrack-tools -y
七、api-server 多台api
uthentication.go:58] Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, [invalid bearer token, crypto/rsa: verification error, invalid bearer token
update-ca-trust
八、容器狀態為Terminating
強制刪除 狀態STATUS為Terminating：
kubectl delete pod kubernetes-dashboard-5c7d5fc568-gq7lj --grace-period=0 --force -n kube-system
九、訪問dashboard的問題
Unauthorized問題
{ "kind": "Status",
"apiVersion": "v1",
"metadata": { },
"status": "Failure",
"message": "Unauthorized",
"reason": "Unauthorized",
"code": 401 }
解決方法：
新建basic_auth_file文件，並在其中添加：
admin,admin,1002
- 1
文件內容格式：password,username,uid
然后在api-server配置文件（即上面的配置文件）中添加--=/etc/kubernetes/basic_auth_file \
保存重啟kube-apiserver：