failed to run Kubelet: unable to load bootstrap kubeconfig: stat /etc/kubernetes/bootstrap-kubelet.

【现象】

k8s的mster-01 一直显示NotReady

【报错】

[root@DoM01 kubernetes]# journalctl -u kubelet.service  -f
-- Logs begin at 二 2022-10-18 17:57:42 CST. --
10月 25 15:53:15 DoM01 kubelet[142829]: Flag --cgroup-driver has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.
10月 25 15:53:15 DoM01 kubelet[142829]: Flag --cgroup-driver has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.
10月 25 15:53:15 DoM01 kubelet[142829]: I1025 15:53:15.663176  142829 server.go:425] Version: v1.15.2
10月 25 15:53:15 DoM01 kubelet[142829]: I1025 15:53:15.663355  142829 plugins.go:103] No cloud provider specified.
10月 25 15:53:15 DoM01 kubelet[142829]: I1025 15:53:15.663375  142829 server.go:791] Client rotation is on, will bootstrap in background
10月 25 15:53:15 DoM01 kubelet[142829]: E1025 15:53:15.664913  142829 bootstrap.go:263] Part of the existing bootstrap client certificate is expired: 2021-12-16 09:30:45 +0000 UTC
10月 25 15:53:15 DoM01 kubelet[142829]: F1025 15:53:15.664953  142829 server.go:273] failed to run Kubelet: unable to load bootstrap kubeconfig: stat /etc/kubernetes/bootstrap-kubelet.conf: no such file or directory
10月 25 15:53:15 DoM01 systemd[1]: kubelet.service: main process exited, code=exited, status=255/n/a
10月 25 15:53:15 DoM01 systemd[1]: Unit kubelet.service entered failed state.
10月 25 15:53:15 DoM01 systemd[1]: kubelet.service failed.
10月 25 15:53:25 DoM01 systemd[1]: kubelet.service holdoff time over, scheduling restart.
10月 25 15:53:25 DoM01 systemd[1]: Stopped kubelet: The Kubernetes Node Agent.
10月 25 15:53:25 DoM01 systemd[1]: Started kubelet: The Kubernetes Node Agent.
。。。。。。。。。。。。。。。。。。。。。。。
-- Logs begin at 日 2022-10-16 21:16:02 CST, end at 二 2022-10-25 15:25:57 CST. --
10月 16 21:16:09 DoM01 kubelet[846]: E1016 21:16:09.888847     846 summary_sys_containers.go:47] Failed to get system container stats for "/system.slice/docker.service": failed to get cgroup stats for
10月 16 21:16:19 DoM01 kubelet[846]: E1016 21:16:19.906510     846 summary_sys_containers.go:47] Failed to get system container stats for "/system.slice/docker.service": failed to get cgroup stats for
10月 16 21:16:29 DoM01 kubelet[846]: E1016 21:16:29.917958     846 summary_sys_containers.go:47] Failed to get system container stats for "/system.slice/docker.service": failed to get cgroup stats for
10月 16 21:16:31 DoM01 kubelet[846]: E1016 21:16:31.064395     846 certificate_manager.go:400] Failed while requesting a signed certificate from the master: cannot create certificate signing request:
10月 16 21:16:39 DoM01 kubelet[846]: E1016 21:16:39.929463     846 summary_sys_containers.go:47] Failed to get system container stats for "/system.slice/docker.service": failed to get cgroup stats for
10月 16 21:16:41 DoM01 kubelet[846]: W1016 21:16:41.695524     846 reflector.go:302] object-"kube-system"/"coredns": watch of *v1.ConfigMap ended with: too old resource version: 315530539 (315532575)
10月 16 21:16:49 DoM01 kubelet[846]: E1016 21:16:49.952378     846 summary_sys_containers.go:47] Failed to get system container stats for "/system.slice/docker.service": failed to get cgroup stats for
10月 16 21:16:59 DoM01 kubelet[846]: E1016 21:16:59.963203     846 summary_sys_containers.go:47] Failed to get system container stats for "/system.slice/docker.service": failed to get cgroup stats for
……
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

【分析】

• unable to load bootstrap kubeconfig: stat /etc/kubernetes/bootstrap-kubelet.conf: no such file or directory

在前边我们就可以看到这个报错，如果你对k8s的认证比较了解的话，就会知道bootstrap-kubelet.conf是k8s API的引导令牌(Bootstrap Tokens)认证相关的文件。该机制会根据证书生成token，然后将信息写在这个文件里边。

这里我们可以定位到证书问题。

如果你不知道也没有关系，继续往下看，下边会循环报这个错：

• Failed while requesting a signed certificate from the master: cannot create certificate signing request
  "请求签名证书时失败：无法创建证书签名请求。"已经说的很清楚了。

【解决】

• 备份并重新生成证书

# cd /etc/kubernetes/pki/
# mkdir backup
# mv  apiserver.crt apiserver-etcd-client.key apiserver-kubelet-client.crt front-proxy-ca.crt front-proxy-client.crt front-proxy-client.key front-proxy-ca.key apiserver-kubelet-client.key apiserver.key apiserver-etcd-client.crt backup
# kubeadm init phase certs all
1
2
3
4

• 备份并重新生成配置文件

# cd /etc/kubernetes/
# mkdir backup
# mv admin.conf controller-manager.conf kubelet.conf,scheduler.conf  backup
# kubeadm init phase kubeconfig all
1
2
3
4

• 拷贝用户权限文件（一般不用）

一般不用，除非你的kubectl令出错了

# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
1

---