Pod在集群上未启动(集群关闭)

Question

我的集群当前已关闭，无法在其上启动新的pod。我尝试使用kops从1.9.1升级到1.9.3，并添加了pvc resize admissionControl。当滚动升级发生时，我注意到新的节点没有正确地联机(即使rollingupgrade认为它们是)。我中止了滚动升级。我发现pod在抱怨：

open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

kube api服务器显示：

I0524 14:27:43.871432       1 rbac.go:116] RBAC DENY: user "system:kube-proxy" groups ["system:authenticated"] cannot "get" resource "nodes" named "ip-10-23-2-5.ec2.internal" cluster-wide
I0524 14:27:43.873562       1 rbac.go:116] RBAC DENY: user "kubelet" groups ["system:nodes" "system:authenticated"] cannot "list" resource "nodes" cluster-wide
I0524 14:27:43.873783       1 rbac.go:116] RBAC DENY: user "kubelet" groups ["system:nodes" "system:authenticated"] cannot "list" resource "services" cluster-wide
I0524 14:27:43.887303       1 rbac.go:116] RBAC DENY: user "system:kube-scheduler" groups ["system:authenticated"] cannot "list" resource "replicasets.extensions" cluster-wide
I0524 14:27:43.887569       1 rbac.go:116] RBAC DENY: user "system:kube-scheduler" groups ["system:authenticated"] cannot "list" resource "persistentvolumeclaims" cluster-wide
I0524 14:27:43.949818       1 rbac.go:116] RBAC DENY: user "kubelet" groups ["system:nodes" "system:authenticated"] cannot "list" resource "pods" cluster-wide
I0524 14:27:43.956233       1 rbac.go:116] RBAC DENY: user "system:kube-scheduler" groups ["system:authenticated"] cannot "list" resource "statefulsets.apps" cluster-wide
I0524 14:27:43.958076       1 rbac.go:116] RBAC DENY: user "system:kube-scheduler" groups ["system:authenticated"] cannot "list" resource "services" cluster-wide
I0524 14:27:43.958564       1 rbac.go:116] RBAC DENY: user "system:kube-scheduler" groups ["system:authenticated"] cannot "list" resource "nodes" cluster-wide
I0524 14:27:43.972226       1 rbac.go:116] RBAC DENY: user "kubelet" groups ["system:nodes" "system:authenticated"] cannot "create" resource "nodes" cluster-wide

请帮帮忙

Answer 1

最终解决了这个问题。api日志中的错误具有误导性并持续存在，原因是没有与某些pods关联的具有适当权限的服务帐户。

根本的问题是，滚动升级只留下一个主服务器“就绪”，而apiserver在没有ServiceAccount admissionControl的情况下仍在运行。因此，新的豆荚被路由到那里，但没有出现。已通过更正所有主机上的admissionControl解决此问题。