K8s服务kube-flannel组件日志报错remote error: tls: internal error

在部署k8s时，发现日志存在以下错误：

[root@localhost ~]# kubectl logs -n kube-system  kube-flannel-nlljz
Error from server: Get "https://192.168.230.180:10250/containerLogs/kube-system/kube-flannel-nlljz/kube-flannel": remote error: tls: internal error
[root@localhost ~]# curl -v https://192.168.230.180:10250/containerLogs/kube-system/kube-flannel-nlljz/kube-flannel
*   Trying 192.168.230.180...
* TCP_NODELAY set
* Connected to 192.168.230.180 (192.168.230.180) port 10250 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, internal error (592):
* error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
* Closing connection 0
curl: (35) error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

问题解决

查看证书

查看当前集群中挂起的证书签名请求（Certificate Signing Request，CSR）

[root@localhost ~]# kubectl get csr
NAME        AGE   SIGNERNAME                                    REQUESTOR           CONDITION
csr-8krhv   12m   kubernetes.io/kubelet-serving                 system:node:node1   Pending
csr-8zhqx   12m   kubernetes.io/kubelet-serving                 system:node:node1   Pending
csr-ktn7t   12m   kubernetes.io/kubelet-serving                 system:node:node1   Pending
csr-mc2dt   12m   kubernetes.io/kube-apiserver-client-kubelet   system:node:node1   Approved,Issued

批准证书签名请求

[root@localhost ~]# for i in $(kubectl get csr | awk '/Pending/ {print $1}');do kubectl certificate approve $i; done
certificatesigningrequest.certificates.k8s.io/csr-8krhv approved
certificatesigningrequest.certificates.k8s.io/csr-8zhqx approved
certificatesigningrequest.certificates.k8s.io/csr-ktn7t approved

验证

[root@localhost ~]# kubectl get csr
NAME        AGE   SIGNERNAME                                    REQUESTOR           CONDITION
csr-8krhv   13m   kubernetes.io/kubelet-serving                 system:node:node1   Approved,Issued
csr-8zhqx   13m   kubernetes.io/kubelet-serving                 system:node:node1   Approved,Issued
csr-ktn7t   13m   kubernetes.io/kubelet-serving                 system:node:node1   Approved,Issued
csr-mc2dt   13m   kubernetes.io/kube-apiserver-client-kubelet   system:node:node1   Approved,Issued
[root@localhost ~]# curl -v https://192.168.230.180:10250/containerLogs/kube-system/kube-flannel-nlljz/kube-flannel
*   Trying 192.168.230.180...
* TCP_NODELAY set
* Connected to 192.168.230.180 (192.168.230.180) port 10250 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

END