文章目录
- 1. 问题描述
- 2. 问题原因
- 3. 解决办法
- 4. 参考链接
1. 问题描述
在执行 ./hack/vpa-up.sh脚本命令时，提示有报错。名为vpa-admission-controller的容器状态一直停留在ContainerCreating，从该Pod详细描述中得知，volume "tls-certs" : secret "vpa-tls-certs" not found，没有找到这两个密钥，无法进行挂载。
[root@k8s-master openssl-1.1.1h]# kubectl get pods -n kube-system |grep vpa
vpa-admission-controller-64cb9cfb4b-xvzpf 0/1 ContainerCreating 0 3m30s
vpa-recommender-6fdd69df6c-rj725 1/1 Running 0 25m
vpa-updater-8567bff646-z28v9 1/1 Running 0 25m
[root@k8s-master openssl-1.1.1h]# kubectl describe pod vpa-admission-controller-64cb9cfb4b-xvzpf -n kube-system
Name: vpa-admission-controller-64cb9cfb4b-xvzpf
Namespace: kube-system
Priority: 0
Service Account: vpa-admission-controller
Node: k8s-node01/192.168.20.32
Start Time: Fri, 01 Mar 2024 15:54:35 +0800
Labels: app=vpa-admission-controllerpod-template-hash=64cb9cfb4b
Annotations: <none>
Status: Pending
IP:
IPs: <none>
Controlled By: ReplicaSet/vpa-admission-controller-64cb9cfb4b
Containers:admission-controller:Container ID:Image: k8s.gcr.io/autoscaling/vpa-admission-controller:0.12.0Image ID:Ports: 8000/TCP, 8944/TCPHost Ports: 0/TCP, 0/TCPState: WaitingReason: ContainerCreatingReady: FalseRestart Count: 0Limits:cpu: 200mmemory: 500MiRequests:cpu: 50mmemory: 200MiEnvironment:NAMESPACE: kube-system (v1:metadata.namespace)Mounts:/etc/tls-certs from tls-certs (ro)/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-ncfnk (ro)
Conditions:Type StatusInitialized TrueReady FalseContainersReady FalsePodScheduled True
Volumes:tls-certs:Type: Secret (a volume populated by a Secret)SecretName: vpa-tls-certsOptional: falsekube-api-access-ncfnk:Type: Projected (a volume that contains injected data from multiple sources)TokenExpirationSeconds: 3607ConfigMapName: kube-root-ca.crtConfigMapOptional: <nil>DownwardAPI: true
QoS Class: Burstable
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300snode.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:Type Reason Age From Message---- ------ ---- ---- -------Normal Scheduled 3m42s default-scheduler Successfully assigned kube-system/vpa-admission-controller-64cb9cfb4b-xvzpf to k8s-node01Warning FailedMount 99s kubelet Unable to attach or mount volumes: unmounted volumes=[tls-certs], unattached volumes=[tls-certs kube-api-access-ncfnk]: timed out waiting for the conditionWarning FailedMount 95s (x9 over 3m42s) kubelet MountVolume.SetUp failed for volume "tls-certs" : secret "vpa-tls-certs" not found
2. 问题原因
openssl版本低。
3. 解决办法
升级openssl版本。
[root@k8s-master openssl-1.1.1h]# openssl version -a
OpenSSL 1.0.2k-fips 26 Jan 2017
built on: reproducible build, date unspecified
platform: linux-x86_64
options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/etc/pki/tls"
engines: rdrand dynamic
下载并解压openssl-1.1.1h.tar.gz
wget https://www.openssl.org/source/openssl-1.1.1h.tar.gztar zxvf openssl-1.1.1h.tar.gzcd openssl-1.1.1h./config
opessl编译安装完成
make & make install
显示如下结果，表示安装完成。
[root@k8s-master openssl-1.1.1h]# mv /usr/bin/openssl /usr/bin/openssl.bak[root@k8s-master openssl-1.1.1h]# ln -s /usr/local/bin/openssl /usr/bin/openssl
[root@k8s-master openssl-1.1.1h]# ln -s /usr/local/include/openssl/ /usr/include/openssl[root@k8s-master openssl-1.1.1h]# echo "/usr/local/lib64" >> /etc/ld.so.conf
[root@k8s-master openssl-1.1.1h]# ldconfig -v
完成openssl版本的升级。
[root@k8s-master openssl-1.1.1h]# openssl version -a
OpenSSL 1.1.1h 22 Sep 2020
built on: Fri Mar 1 07:46:58 2024 UTC
platform: linux-x86_64
options: bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
OPENSSLDIR: "/usr/local/ssl"
ENGINESDIR: "/usr/local/lib64/engines-1.1"
Seeding source: os-specific
重新执行 ./hack/vpa-up.sh脚本，顺利通过，无报错。
[root@k8s-master vertical-pod-autoscaler]# ./hack/vpa-up.sh
customresourcedefinition.apiextensions.k8s.io/verticalpodautoscalercheckpoints.autoscaling.k8s.io created
customresourcedefinition.apiextensions.k8s.io/verticalpodautoscalers.autoscaling.k8s.io created
clusterrole.rbac.authorization.k8s.io/system:metrics-reader created
clusterrole.rbac.authorization.k8s.io/system:vpa-actor created
clusterrole.rbac.authorization.k8s.io/system:vpa-checkpoint-actor created
clusterrole.rbac.authorization.k8s.io/system:evictioner created
clusterrolebinding.rbac.authorization.k8s.io/system:metrics-reader created
clusterrolebinding.rbac.authorization.k8s.io/system:vpa-actor created
clusterrolebinding.rbac.authorization.k8s.io/system:vpa-checkpoint-actor created
clusterrole.rbac.authorization.k8s.io/system:vpa-target-reader created
clusterrolebinding.rbac.authorization.k8s.io/system:vpa-target-reader-binding created
clusterrolebinding.rbac.authorization.k8s.io/system:vpa-evictionter-binding created
serviceaccount/vpa-admission-controller created
clusterrole.rbac.authorization.k8s.io/system:vpa-admission-controller created
clusterrolebinding.rbac.authorization.k8s.io/system:vpa-admission-controller created
clusterrole.rbac.authorization.k8s.io/system:vpa-status-reader created
clusterrolebinding.rbac.authorization.k8s.io/system:vpa-status-reader-binding created
serviceaccount/vpa-updater created
deployment.apps/vpa-updater created
serviceaccount/vpa-recommender created
deployment.apps/vpa-recommender created
Generating certs for the VPA Admission Controller in /tmp/vpa-certs.
Generating RSA private key, 2048 bit long modulus (2 primes)
.......................................................................+++++
........................................................................................................+++++
e is 65537 (0x010001)
Generating RSA private key, 2048 bit long modulus (2 primes)
................................................................................+++++
.........................................................................................................................................................................................................+++++
e is 65537 (0x010001)
Signature ok
subject=CN = vpa-webhook.kube-system.svc
Getting CA Private Key
Uploading certs to the cluster.
secret/vpa-tls-certs created
Deleting /tmp/vpa-certs.
deployment.apps/vpa-admission-controller created
service/vpa-webhook created
最终
vpa-admission-controller的Pod正常运行~
[root@k8s-master vertical-pod-autoscaler]# kubectl get pods -n kube-system |grep vpa
vpa-admission-controller-64cb9cfb4b-m76n5 1/1 Running 0 25m
vpa-recommender-6fdd69df6c-q7z7t 1/1 Running 0 25m
vpa-updater-8567bff646-5dbk4 1/1 Running 0 25m
4. 参考链接
❤️🔥autoscaler/vertical-pod-autoscaler at master · kubernetes/autoscaler
🩷vpa-admission-controller- not created · Issue #2810 · kubernetes/autoscaler
❤️OpenSSL安装升级_升级openssl-CSDN博客
