跳到主要内容

Kubernetes FAQs

crictl images 命令执行失败​

  • 适用版本： Kubernetes 1.35.3，内核版本 < 4.11

  • 错误信息：

    FATA[0000] validate service connection: validate CRI v1 image API for endpoint "unix:///run/containerd/containerd.sock": rpc error: code = Unimplemented desc = unknown service runtime.v1.ImageService

  • 解决方案：

    关闭 containerd 中的 enable_unprivileged_ports 和 enable_unprivileged_icmp 配置：

    # 检查当前配置项
    grep -nE 'unprivileged_(icmp|port)' /etc/containerd/config.toml

    # 将两项配置改为 false
    sed -i \
        -e 's/^\(\s*enable_unprivileged_ports\s*=\s*\)true/\1false/' \
        -e 's/^\(\s*enable_unprivileged_icmp\s*=\s*\)true/\1false/' \
    /etc/containerd/config.toml

    # 验证修改结果
    grep -nE 'unprivileged_(icmp|port)' /etc/containerd/config.toml

    systemctl restart containerd

    • 重启后执行以下命令验证插件状态，所有插件均为 ok 代表正常：

      ctr plugin ls | grep -E 'cri|io.containerd.grpc.v1.cri'
      预期输出示例
      io.containerd.cri.v1                      images                   -              ok        
      io.containerd.cri.v1                      runtime                  linux/amd64    ok        
      io.containerd.grpc.v1                     cri                      -              ok

安装 Calico 失败​

  • 适用版本： Kubernetes 1.35.3

  • 错误信息：

    kubectl -n kube-system logs calico-node-xxx -c upgrade-ipam

    This program can only be run on AMD64 processors with v2 microarchitecture support.

  • 原因： CPU 不支持 x86-64-v2 架构。Calico v3.31.1 起仅支持 x86-64-v2 及以上架构。参考：Calico GitHub Issue #11352

  • 解决方案： 改用 Calico 3.30.7 版本

    1. 下载并解压安装包，导入镜像

      wget https://pdpublic.mingdao.com/private-deployment/offline/common/kubernetes-1.35.3/calico-3.30.7-yaml-images-amd64.tar.gz

      tar xzvf calico-3.30.7-yaml-images-amd64.tar.gz
      cd calico-3.30.7-yaml-images-amd64
      gunzip -d calico-3.30.7-images-amd64.tar.gz
      ctr -n k8s.io image import calico-3.30.7-images-amd64.tar

    2. 将 calico.yaml 移至安装目录

      需在安装包目录 calico-3.30.7-yaml-images-amd64 下执行

      mv calico.yaml /usr/local/kubernetes/

    3. 修改配置文件

      • 替换镜像仓库地址

        sed -ri 's|image: docker.io/calico|image: 127.0.0.1:5000|g' /usr/local/kubernetes/calico.yaml

        grep image: /usr/local/kubernetes/calico.yaml
        输出结果示例
            image: 127.0.0.1:5000/cni:v3.30.7
            image: 127.0.0.1:5000/cni:v3.30.7
            image: 127.0.0.1:5000/node:v3.30.7
            image: 127.0.0.1:5000/node:v3.30.7
            image: 127.0.0.1:5000/kube-controllers:v3.30.7

      • 配置 Pod 网段

        sed -ri '/# - name: CALICO_IPV4POOL_CIDR/,/#   value: ".*"/ {
          s/# - name: CALICO_IPV4POOL_CIDR/- name: CALICO_IPV4POOL_CIDR/
          s/#   value: ".*"/  value: "10.244.0.0\/16"/
        }' /usr/local/kubernetes/calico.yaml

        grep -C 2 CALICO_IPV4POOL_CIDR /usr/local/kubernetes/calico.yaml
        输出结果示例
              # chosen from this range. Changing this value after installation will have
              # no effect. This should fall within `--cluster-cidr`.
              - name: CALICO_IPV4POOL_CIDR
                value: "10.244.0.0/16"
              # Disable file logging so `kubectl logs` works.

      • 配置 CNI 二进制路径

        sed -i '/- name: cni-bin-dir/,/type:/s|path: .*|path: /usr/local/kubernetes/cni/bin|' /usr/local/kubernetes/calico.yaml

        grep -C 2 cni-bin-dir /usr/local/kubernetes/calico.yaml
        输出结果示例
                name: host-local-net-dir
              - mountPath: /host/opt/cni/bin
                name: cni-bin-dir
            securityContext:
              privileged: true
        --
            volumeMounts:
              - mountPath: /host/opt/cni/bin
                name: cni-bin-dir
              - mountPath: /host/etc/cni/net.d
                name: cni-net-dir
        --
              path: /proc
          # Used to install CNI.
          - name: cni-bin-dir
            hostPath:
              path: /usr/local/kubernetes/cni/bin

    4. 部署 Calico

      kubectl apply -f /usr/local/kubernetes/calico.yaml

calico-node Pod 健康检查失败​

  • 适用版本： Kubernetes 1.35.3

  • 错误信息：

    Warning  Unhealthy  115s  kubelet  Readiness probe errored and resulted in unknown state: rpc error: code = Unknown desc = failed to exec in container: failed to start exec "...": OCI runtime exec failed: exec failed: unable to start container process: error adding pid 23804 to cgroups: Unknown method 'AttachProcessesToUnit' or interface 'org.freedesktop.systemd1.Manager'

  • 原因： 系统不支持 systemd cgroup 驱动，containerd 与 kubelet 的 cgroup 驱动不兼容。

  • 解决方案：

    将 containerd 的 cgroup 驱动从 systemd 改为 cgroupfs，并重新初始化集群：

    1. 修改 containerd 配置

      sed -i 's/SystemdCgroup = true/SystemdCgroup = false/g' /etc/containerd/config.toml

      grep -n "SystemdCgroup" /etc/containerd/config.toml
      systemctl restart containerd

    2. 在 kubeadm-config.yaml 中追加 kubelet cgroup 配置，然后重新执行 kubeadm init 初始化

      cd /usr/local/kubernetes/
      cat >> kubeadm-config.yaml <<'EOF'

      ---
      apiVersion: kubelet.config.k8s.io/v1beta1
      kind: KubeletConfiguration
      cgroupDriver: cgroupfs
      EOF

安装 Kubernetes 1.35.3 时 cgroups v1 不兼容​

  • 适用场景： 在安装 Kubernetes 1.35.3 时，宿主机仍启用 cgroup v1，kubeadm init 预检失败。

  • 错误信息：

    [WARNING SystemVerification]: kernel release 3.10.0-1160.el7.x86_64 is unsupported. Supported LTS versions from the 5.x series are 5.4, 5.10 and 5.15. Any 6.x version is also supported. For cgroups v2 support, the recommended version is 5.10 or newer
    [WARNING Hostname]: hostname "k8s-master-01" could not be reached
    [WARNING Hostname]: hostname "k8s-master-01": lookup k8s-master-01 on 172.17.30.241:53: server misbehaving
    [preflight] Some fatal errors occurred:
            [ERROR SystemVerification]: cgroups v1 support is deprecated and will be removed in a future release. Please migrate to cgroups v2.
    error: error execution phase preflight: preflight checks failed

  • 原因：

    • 安装 Kubernetes 1.35.3 时，预检阶段对 cgroup v1 的兼容性已受限
    • 宿主机当前启用的是 cgroup v1
    • 如果当前环境无法切换到 cgroup v2，需要切换到 Kubernetes 1.25.4 再重新安装

  • 解决方案：

    如果当前环境必须保留 cgroup v1，请重置 Kubernetes 集群环境后，将安装版本从 1.35.3 切换到 1.25.4 再安装。

    如果后续需要继续安装 Kubernetes 1.35.3 或更高版本，请先将宿主机切换到 cgroup v2，再重新执行初始化。

  • 如何确认：

    根据当前系统的 cgroup 版本切换查看。

    1. 查看当前是否启用了 cgroup v2 或 cgroup v1

      if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
        echo "cgroup v2"
      else
        echo "cgroup v1"
      fi

      输出示例：

      cgroup v2

    2. 查看当前文件系统类型

      stat -fc %T /sys/fs/cgroup

      输出示例：

      cgroup2fs

    3. 可选确认当前进程的 cgroup 信息

      cat /proc/1/cgroup

      输出示例：

      0::/init.scope