kubernetes 中遇见的一些坑(持续更新)

一、官网镜像无法下载

解决方法：需要FQ

配置dockerFQ机：

cat /usr/lib/systemd/system/docker.service

 

[Service]

Environment="HTTP_PROXY=http://10.53.16.201:1080/"

 

重启docker服务 

二、pause k8s镜像下载失败

pod启动失败，查看pod详情(kubectl describe pods podname)

    Events:
      FirstSeen LastSeen    Count   From            SubobjectPath   Type        Reason      Message
      --------- --------    -----   ----            -------------   --------    ------      -------
      56s       56s     1   {default-scheduler }            Normal      Scheduled   Successfully assigned nfs-rc-fc2w8 to duni-node1
      11s       11s 1 {kubelet duni-node1} Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for gcr.io/google_containers/pause-amd64:3.0, this may be because there are no credentials on this request. details: (Get https://gcr.io/v1/_ping: dial tcp 74.125.203.82:443: i/o timeout)"

解决：

找到FQ机器 下载镜像，上传到自己的私有仓库:xxx.xxxx.xxxx/pause-amd64:3.0

gcr.io/google_containers/pause-amd64:3.0

修改kubelet 配置：

--pod-infra-container-image=xxx.xxxx.xxxx/pause-amd64:3.0 \

扫描二维码关注公众号，回复： 1945130 查看本文章

重启: kubelet

三、权限问题

通过rc配置文件起pod，rc中配置了privileged为true，发现pod状态一直Running不起来，查看pod详情发现

    [root@docker tmp]# kubectl describe pods nfs-rc-acbo1
    Name:       nfs-rc-acbo1
    Namespace:  default
    Node:       duni-node2
    Labels:     role=nfs-server
    Status:     Pending
    IP:     
    Controllers:    ReplicationController/nfs-rc
    Containers:
      nfs-server:
        Image:          192.168.100.90:5000/nfs-data Port: 2049/TCP Volume Mounts: <none> Environment Variables: <none> Conditions: Type Status PodScheduled True No volumes. QoS Class: BestEffort Tolerations: <none> Events: FirstSeen LastSeen Count From SubobjectPath Type Reason Message --------- -------- ----- ---- ------------- -------- ------ ------- 27s 27s 1 {default-scheduler } Normal Scheduled Successfully assigned nfs-rc-acbo1 to duni-node2 27s 27s 1 {kubelet duni-node2} Warning FailedValidation Error validating pod nfs-rc-acbo1.default from api, ignoring: spec.containers[0].securityContext.privileged: Forbidden: disallowed by policy

解决：

修改所有node以及master节点的k8s配置文件 vim /etc/kubernetes/config

$ KUBE_ALLOW_PRIV="--allow-privileged=true"
$ systemctl restart kube-apiserver