如何加入我的gcp集群中的工作节点

Question

出于培训目的，我正在尝试创建自己的k8s集群。我已经安装了kubernetes和kubedam，我的主节点已经准备好了：

NAME       STATUS   ROLES    AGE   VERSION
master-1   Ready    master   54s   v1.19.4

现在，我尝试使用kubeadm init末尾给出的令牌使用join命令连接我的worker实例，但在执行该命令时出现以下错误：

sudo kubeadm join my-master-node-ip-here:6443 --token xxxx.xxxxxxxxxxxx \
    --discovery-token-ca-cert-hash sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

错误：

[preflight] Running pre-flight checks
        [WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
        [WARNING SystemVerification]: missing optional cgroups: hugetlb
error execution phase preflight: couldn't validate the identity of the API Server: Get "https://my-master-node-ip-here:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s": net/http: request canceled
 while waiting for connection (Client.Timeout exceeded while awaiting headers)
To see the stack trace of this error execute with --v=5 or higher

我已经对pod网络使用了Weave。

kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"

使用Terraform时，这两个实例位于同一个名为k8s-node的VPC中

network.tf

resource "google_compute_network" "vpc_network" {
  name = "k8s-node"
}

# We create a public IP address for our google compute instance to utilize
resource "google_compute_address" "static" {
  name = "vm-public-address"
}

instance.tf

resource "google_compute_instance" "default" {
    name = var.vm_name
    machine_type = "e2-standard-2"
    zone = "europe-west1-b"

    boot_disk {
        initialize_params {
            image = "debian-cloud/debian-9"
        }
    }

    network_interface {
        network = var.network
        access_config {
            // Include this section to give the VM an external IP address
        }
    }

    metadata_startup_script = file("./scripts/bootstrap.sh")

    tags = ["node"]
}

worker似乎无法连接到主实例，是不是我的配置中遗漏了什么？

Answer 1

为了解决这个问题，我添加了一个teraform格式的防火墙规则，并开放了端口6443

resource "google_compute_network" "vpc_network" {
  name = "k8s-node"
}

resource "google_compute_firewall" "default" {
  name    = "k8s-firewall"
  network = google_compute_network.vpc_network.name

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
    ports    = ["80", "6443"]
  }

  source_tags = ["node"]
}