k8s1.20.1 集群安裝 搭建完畢之后，從2020-12-30到2021-1-11的10多天時(shí)間里，突然想再給k8s集群增加個(gè)節(jié)點(diǎn)。

1. knode2節(jié)點(diǎn)完全克隆一個(gè)knode3

1. 1 機(jī)器環(huán)境

1.2 hostname

[root@knode2 ~]# hostnamectl set-hostname knode3 --static

1.3 網(wǎng)絡(luò)設(shè)置

[root@knode2 ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens33
BOOTPROTO="static" #dhcp改為static 
ONBOOT="yes" #開機(jī)啟用本配置
IPADDR=192.168.8.121 #靜態(tài)IP 192.168.8.122/192.168.8.123
GATEWAY=192.168.8.2 #默認(rèn)網(wǎng)關(guān)
NETMASK=255.255.255.0 #子網(wǎng)掩碼
DNS1=114.114.114.114 #DNS 配置
DNS2=8.8.8.8 #DNS 配置

[root@knode2 ~]# systemctl restart network

1.4 配置IP host映射關(guān)系

[root@knode2 ~]# echo "192.168.8.124 knode3" >> /etc/hosts
[root@knode2 ~]# reboot

2 往kmaster節(jié)點(diǎn)追加工作節(jié)點(diǎn)

2.1 查看追加命令（在kmaster查看）·

[root@kmaster ~]# cat kubeadm-init.log
Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.8.121:6443 --token abcdef.0123456789abcdef \
    --discovery-token-ca-cert-hash sha256:7459fa01464531734d3eee182461b77b043d31eff7df2233635654d7c199c947

2.2 刪除從knode2克隆的knode3連接信息

[root@knode3 ~]# rm -f /etc/kubernetes/kubelet.conf
[root@knode3 ~]# rm -f /etc/kubernetes/pki/ca.crt

2.3 追加節(jié)點(diǎn)(在knode3執(zhí)行)

這里可能執(zhí)行的時(shí)間稍稍有點(diǎn)長

[root@knode3 ~]# kkubeadm join 192.168.8.121:6443 --token abcdef.0123456789abcdef \
    --discovery-token-ca-cert-hash sha256:7459fa01464531734d3eee182461b77b043d31eff7df2233635654d7c199c947
[preflight] Running pre-flight checks
        [WARNING SystemVerification]: this Docker version is not on the list of validated versions: 20.10.1. Latest validated version: 19.03
error execution phase preflight: couldn't validate the identity of the API Server: could not find a JWS signature in the cluster-info ConfigMap for token ID "abcdef"
To see the stack trace of this error execute with --v=5 or higher

2.4 解決問題：

查看認(rèn)證信息（在看master查看）--原有的已經(jīng)截止到12-31過期了

[root@kmaster ~]# kubeadm token list
TOKEN                     TTL         EXPIRES                     USAGES                   DESCRIPTION                                                EXTRA GROUPS
abcdef.0123456789abcdef   <invalid>   2020-12-31T09:44:48+09:00   authentication,signing   <none>                                                     system:bootstrappers:kubeadm:default-node-token

[root@kmaster ~]# 

造成這種問題的原因可能有兩點(diǎn)：token失效 、CA證書失效。

2.4.1 生成token

生成永久token

[root@kmaster ~]# kubeadm token create --ttl 0
oij2et.1wl9wap9p2wp7at9

生成新的token:查看后有效期只有23小時(shí)

[root@kmaster ~]# kubeadm token create
m3nr37.81bu8er3ibyoyvw7
[root@kmaster ~]# kubeadm token list
TOKEN                     TTL         EXPIRES                     USAGES                   DESCRIPTION                                                EXTRA GROUPS
m3nr37.81bu8er3ibyoyvw7   23h         2021-01-12T23:29:49+09:00   authentication,signing   <none>                                                     system:bootstrappers:kubeadm:default-node-token

2.4.2 查看crt

[root@kmaster ~]# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
7459fa01464531734d3eee182461b77b043d31eff7df2233635654d7c199c947

2.4.3 把上述2.4.1和2.4.2組裝后，再次試用

追加節(jié)點(diǎn)(在knode3執(zhí)行)

[root@knode3 ~]# systemctl stop kubelet
[root@knode3 ~]# rm -f /etc/kubernetes/kubelet.conf
[root@knode3 ~]# rm -f /etc/kubernetes/pki/ca.crt
[root@knode3 ~]# systemctl start kubelet
[root@knode3 ~]# kubeadm join 192.168.8.121:6443 --token oij2et.1wl9wap9p2wp7at9 \
    --discovery-token-ca-cert-hash sha256:7459fa01464531734d3eee182461b77b043d31eff7df2233635654d7c199c947
...
error execution phase kubelet-start: error uploading crisocket: timed out waiting for the condition

2.4.4 錯(cuò)誤解決（...timed out waiting for the condition）

[root@knode3 ~]# kubeadm reset

再次重復(fù)2.4.3

3 查看追加后的集群

[root@kmaster ~]# kubectl get node
NAME      STATUS     ROLES                  AGE   VERSION
kmaster   Ready      control-plane,master   12d   v1.20.1
knode1    Ready      <none>                 12d   v1.20.1
knode2    NotReady   <none>                 12d   v1.20.1
knode3    Ready      <none>                 55s   v1.20.1