# 避免 kubeconfig 干扰,改名下家目录文件 $ mv ~/.kube/config ~/.kube/config.bak $ KUBECONFIG= kubectl --server=https://xxx:6443 \ --certificate-authority=/etc/kubernetes/pki/ca.crt \ --client-certificate=/etc/kubernetes/pki/test1.pem \ --client-key=/etc/kubernetes/pki/test1-key.pem get pod Error from server (Forbidden): pods is forbidden: User "test1" cannot list resource "pods" in API group "" in the namespace "default"
$ mv ~/.kube/config ~/.kube/config.bak $ KUBECONFIG= kubectl --server=https://xxx:6443 \ --certificate-authority=/etc/kubernetes/pki/ca.crt \ --client-certificate=/etc/kubernetes/pki/test1.pem \ --client-key=/etc/kubernetes/pki/test1-key.pem get pod No resources found in default namespace. $ KUBECONFIG= kubectl --server=https://xxx:6443 --certificate-authority=/etc/kubernetes/pki/ca.crt --client-certificate=/etc/kubernetes/pki/test1.pem --client-key=/etc/kubernetes/pki/test1-key.pem get svc Error from server (Forbidden): services is forbidden: User "test1" cannot list resource "services" in API group "" in the namespace "default"
[root@zgz pki]# kubectl --kubeconfig=test1.kubeconfig get pod No resources found in default namespace. [root@zgz pki]# kubectl --kubeconfig=test1.kubeconfig get svc Error from server (Forbidden): services is forbidden: User "test1" cannot list resource "services" in API group "" in the namespace "default"
group test2 一样操作,就是注意 O 字段即可,然后是 clusterrole 和 clusterrolebinding ,自行挑战下。
$ echo '127.0.0.1 santest' >> /etc/hosts $ kubectl --server https://santest:6443 get pod ... Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, node, not santest
$ kubectl --server https://santest:6443 get pod No resources found in default namespace. $ kubectl --server https://santest:6443 get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 1h
故障案例
kubectl 证书过期
1 2
$ kubectl apply -f /tmp/test-svc.yml ... x509: certificate has exprired or is not yet valid: current time 2025-05-20T23:25:51+08:00 is after 2025-01-16T02:16:34Z
$ kubectl -n default describe deploy deployment-example Name: deployment-example Namespace: default CreationTimestamp: Fri, 30 May 2025 15:45:03 +0800 Labels: <none> Annotations: <none> Selector: app=nginx Replicas: 2 desired | 0 updated | 0 total | 0 available | 0 unavailable StrategyType: RollingUpdate MinReadySeconds: 0 RollingUpdateStrategy: 25% max unavailable, 25% max surge Pod Template: Labels: app=nginx Containers: nginx: Image: nginx:1.19-alpine Port: 12343/TCP Host Port: 0/TCP Environment: <none> Mounts: <none> Volumes: <none> Conditions: Type Status Reason ---- ------ ------ Progressing False ReplicaSetCreateError OldReplicaSets: <none> NewReplicaSet: <none> Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning ReplicaSetCreateError 21s (x7 over 21s) deployment-controller Failed to create new replica set "deployment-example-b4f6c7989": Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:06:13+08:00 is after 2024-08-28T14:45:36Z Warning ReplicaSetCreateError 20s (x2 over 20s) deployment-controller Failed to create new replica set "deployment-example-b4f6c7989": Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:06:14+08:00 is after 2024-08-28T14:45:36Z Warning ReplicaSetCreateError 18s deployment-controller Failed to create new replica set "deployment-example-b4f6c7989": Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:06:16+08:00 is after 2024-08-28T14:45:36Z Warning ReplicaSetCreateError 16s deployment-controller Failed to create new replica set "deployment-example-b4f6c7989": Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:06:18+08:00 is after 2024-08-28T14:45:36Z Warning ReplicaSetCreateError 11s deployment-controller Failed to create new replica set "deployment-example-b4f6c7989": Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:06:23+08:00 is after 2024-08-28T14:45:36Z Warning ReplicaSetCreateError 0s deployment-controller Failed to create new replica set "deployment-example-b4f6c7989": Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:06:34+08:00 is after 2024-08-28T14:45:36Z
$ kubectl -n kube-system get lease NAME HOLDER AGE kube-controller-manager ubuntu-Standard-PC-i440FX-PIIX-1996_296a57fb-a219-4301-a0a6-62c3cd09e0f2 639d kube-scheduler ubuntu-Standard-PC-i440FX-PIIX-1996_edd2caff-d647-4633-8bd5-2d9788986e1f 639d
$ journalctl -xe --no-pager -u kube-controller-manager.service -- Logs begin at Fri 2025-05-09 14:24:19 CST, end at Fri 2025-05-30 22:21:03 CST. -- May 22 00:01:48 ubuntu-Standard-PC-i440FX-PIIX-1996 kube-controller-manager[53418]: E0522 00:01:48.204891 53418 leaderelection.go:325] error retrieving resource lock kube-system/kube-controller-manager: etcdserver: leader changed
May 30 22:08:57 ubuntu-Standard-PC-i440FX-PIIX-1996 kube-controller-manager[22314]: E0530 22:08:57.593721 22314 deployment_controller.go:495] Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:08:57+08:00 is after 2024-08-28T14:45:36Z May 30 22:08:57 ubuntu-Standard-PC-i440FX-PIIX-1996 kube-controller-manager[22314]: I0530 22:08:57.593752 22314 deployment_controller.go:496] Dropping deployment "default/deployment-example" out of the queue: Get "https://[::1]:6443/api/v1/namespaces/default/resourcequotas": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:08:57+08:00 is after 2024-08-28T14:45:36Z May 30 22:08:57 ubuntu-Standard-PC-i440FX-PIIX-1996 kube-controller-manager[22314]: I0530 22:08:57.593824 22314 event.go:291] "Event occurred" object="default/deployment-example" kind="Deployment" apiVersion="apps/v1" type="Warning" reason="ReplicaSetCreateError" message="Failed to create new replica set \"deployment-example-b4f6c7989\": Get \"https://[::1]:6443/api/v1/namespaces/default/resourcequotas\": x509: certificate has expired or is not yet valid: current time 2025-05-30T22:08:57+08:00 is after 2024-08-28T14:45:36Z"