當我按照教材設置證書，配置好kube-controller的相關條件后，啟動kube-controller-manage組件，卻意外報錯。
一、基本信息如下：
1. kube-controller-manager.service 文件如下
[Unit]
Description=kubernetes controller-manager service
After=network.target
After=network-online.target
Wants=network-online.target
# because the etcd service isn't in this machine
# After=etcd.service
# Wants=etcd.service
[Service]
EnvironmentFile=/k8s/kubernetes/cfg/kube-controller-manager-env
ExecStart=/k8s/kubernetes/bin/kube-controller-manager \
--port=0 \
--secure-port=10252 \
--bind-address=127.0.0.1 \
--kubeconfig=${KUBECONFIG} \
--authentication-kubeconfig=${KUBECONFIG} \
--authorization-kubeconfig=${KUBECONFIG} \
--service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE} \
--cluster-name=kubernetes \
--cluster-signing-cert-file=/k8s/kubernetes/ssl/k8s-ca.pem \
--cluster-signing-key-file=/k8s/kubernetes/ssl/k8s-ca-key.pem \
--experimental-cluster-signing-duration=8760h \
--root-ca-file=/k8s/kubernetes/ssl/k8s-ca.pem \
--service-account-private-key-file=/k8s/kubernetes/ssl/k8s-ca-key.pem \
--leader-elect=true \
--feature-gates=RotateKubeletServerCertificate=true \
--controllers=*,bootstrapsigner,tokencleaner \
--horizontal-pod-autoscaler-use-rest-clients=true \
--horizontal-pod-autoscaler-sync-period=10s \
--tls-cert-file=/k8s/kubernetes/ssl/kube-controller-manager-server.pem \
--tls-private-key-file=/k8s/kubernetes/ssl/kube-controller-manager-server-key.pem \
--use-service-account-credentials=true \
--alsologtostderr=true \
--logtostderr=false \
--log-dir=${LOG_DIR} \
--v=4
LimitNOFILE=1000000
User=root
[Install]
WantedBy=multi-user.target
2. 環境配置文件，如下
KUBECONFIG="/k8s/kubernetes/cfg/kube-controller-manager.kubeconfig"
SERVICE_CLUSTER_IP_RANGE="10.0.0.0/24"
LOG_DIR="/var/log/k8s/kube-controller-manager"
3. 錯誤信息如下：
configmaps "extension-apiserver-authentication" is forbidden: User "kubernetes" cannot get resource "configmaps" in API group ""
二、錯誤原因和修復
后面發現根本不是configmap無權限或config文件生成有誤。而是我們的kube-controller-manager.service.文件中參數開啟了[非安全模式http]“--port=0”導致。
當我們刪除配置文件1中的兩行標黃的參數后，再重新執行服務啟動命令，這次發現kube-controller-manager成功啟動了。
備注：參數【安全模式https】“--secure-port=10252”一定要去掉，否則啟動服務會報錯“10252 已經被使用”
root >> systemctl daemon-reload
root >> systemctl restart kube-controller-manager
root >> netstat -nltp | grep kube
root >> kubectl get cs
root >> journalctl -u kube-controller-manager --since '2019-05-25 18:33:00'
