在 aws eks 安装v4.1.3 后主集群显示未就绪

flyforfun

创建部署问题时，请参考下面模板，你提供的信息越多，越容易及时获得解答。如果未按模板创建问题，管理员有权关闭问题。
确保帖子格式清晰易读，用 markdown code block 语法格式化代码块。
你只花一分钟创建的问题，不能指望别人花上半个小时给你解答。

操作系统信息
例如：AWS EC2 4核8G*2 Linux

Kubernetes版本信息
1.32

容器运行时
containerd://1.7.26+bottlerocket

KubeSphere版本信息
v4.1.3

问题是什么

执行完

helm upgrade --install -n kubesphere-system \
--set global.imageRegistry=swr.cn-southwest-2.myhuaweicloud.com/ks \
--set extension.imageRegistry=swr.cn-southwest-2.myhuaweicloud.com/ks \
--create-namespace ks-core https://charts.kubesphere.com.cn/main/ks-core-1.1.4.tgz --debug --wai

集群状态

未就绪

状态: False

原因: Ready

消息: the server is currently unable to handle the request (get services http:ks-apiserver:80)

k logs ks-apiserver-85d7c8888f-9zqqp -n kubesphere-system

I0403 12:42:27.319912 1 filters.go:96] 172.31.68.147 - “GET /apis/kubesphere.io/v1alpha1/extensions HTTP/1.1” 403 322 0ms

I0403 12:42:27.325355 1 filters.go:96] 172.31.68.147 - “GET /apis/extensions.kubesphere.io/v1alpha1/extensionentries HTTP/1.1” 403 373 0ms

I0403 12:42:27.326001 1 filters.go:96] 172.31.68.147 - “GET /apis/extensions.kubesphere.io/v1alpha1/jsbundles HTTP/1.1” 403 352 0ms

I0403 12:42:27.345211 1 filters.go:96] 172.31.68.147 - “GET /apis/kubesphere.io/v1alpha1/extensions HTTP/1.1” 403 322 0ms

I0403 12:42:27.350472 1 filters.go:96] 172.31.68.147 - “GET /apis/extensions.kubesphere.io/v1alpha1/extensionentries HTTP/1.1” 403 373 0ms

I0403 12:42:27.351137 1 filters.go:96] 172.31.68.147 - “GET /apis/extensions.kubesphere.io/v1alpha1/jsbundles HTTP/1.1” 403 352 0ms

k logs ks-controller-manager-69d79cfc5d-lfw6b -n kubesphere-system

E0403 12:40:58.303967 1 controller.go:316] “Reconciler error” err="Operation cannot be fulfilled on roles.iam.kubesphere.io \“operator\”: the object has been modified; please apply your changes to the latest version and try again" controller=“role” controllerGroup=“iam.kubesphere.io” controllerKind=“Role” Role=“kubesphere-controls-system/operator” namespace=“kubesphere-controls-system” name=“operator” reconcileID=“b0a02040-bfb5-408a-bdf7-31f75d772c44”

E0403 12:40:58.323635 1 controller.go:316] “Reconciler error” err="Operation cannot be fulfilled on roles.iam.kubesphere.io \“operator\”: the object has been modified; please apply your changes to the latest version and try again" controller=“role” controllerGroup=“iam.kubesphere.io” controllerKind=“Role” Role=“kubesphere-controls-system/operator” namespace=“kubesphere-controls-system” name=“operator” reconcileID=“c251b2d5-9082-4491-be1d-3032d673cda4”

E0403 12:40:58.358805 1 controller.go:316] “Reconciler error” err="Operation cannot be fulfilled on roles.iam.kubesphere.io \“operator\”: the object has been modified; please apply your changes to the latest version and try again" controller=“roletemplate” controllerGroup=“iam.kubesphere.io” controllerKind=“RoleTemplate” RoleTemplate=“namespace-create-app-releases” namespace="" name=“namespace-create-app-releases” reconcileID=“a3e6d45f-1df5-407c-a5d0-51d579b96f27”

k get events

13m Normal Synced workspacerole/system-workspace-viewer Aggregating roleTemplates successfully

13m Warning SyncFailed workspacerole/system-workspace-viewer cluster not ready: host

13m Warning SyncFailed workspacetemplate/system-workspace cluster not ready: host

13m Normal Synced workspacetemplate/system-workspace Synced successfully

13m Normal Synced role/viewer Aggregating roleTemplates

Jerry_L

flyforfun 老哥可以加个联系方式吗，看看你怎么解决的。我的邮箱是 devops20242025@gmail.com 感谢！

Jerry_L

遇到了一样的问题，楼主是怎么解决的，求助，sos

redscholar

日志显示是ks-apiserver服务未就绪。
你提供的ks-apiserver没有错误日志，看有没有更多的日志信息。
也看看ks-apiserver容器对应的事件。

Jerry_L

redscholar kubectl logs -n kubesphere-system -l app=ks-apiserver

E0418 08:21:03.915657 1 authentication.go:64] Request authentication failed: jwt: token is expired by 3m50.915644833s

W0418 08:21:03.915660 1 jwt.go:47] jwt: token is expired by 3m50.91565589s

I0418 08:21:03.915662 1 filters.go:96] undefined - “GET /api/v1/nodes HTTP/1.1” 401 157 0ms

W0418 08:21:03.915571 1 jwt.go:47] jwt: token is expired by 3m50.915568721s

I0418 08:21:03.915675 1 filters.go:96] undefined - “GET /apis/extensions.kubesphere.io/v1alpha1/jsbundles HTTP/1.1” 401 156 0ms

E0418 08:21:03.915668 1 authentication.go:64] Request authentication failed: jwt: token is expired by 3m50.91565589s

I0418 08:21:03.915692 1 filters.go:96] undefined - “GET /kapis/tenant.kubesphere.io/v1beta1/clusters HTTP/1.1” 401 157 0ms

E0418 08:21:03.915677 1 authentication.go:64] Request authentication failed: jwt: token is expired by 3m50.915568721s

I0418 08:21:03.915709 1 filters.go:96] undefined - “GET /apis/extensions.kubesphere.io/v1alpha1/extensionentries HTTP/1.1” 401 156 0ms

I0418 08:21:03.915722 1 filters.go:96] undefined - “GET /kapis/version HTTP/1.1” 401 157 0ms

Jerry_L

redscholar 可以拉个会议看一下么？

superwhys

+1，这要怎么解决啊，，，

redscholar

检查集群就绪的访问链路为：ks-controller-manager → kube-apiserver → ks-apiserver。

在该链路中，任一节点之间的网络连接若受到限制，均可能导致该问题的出现。常见原因包括：防火墙规则或云平台安全组配置阻止了某一段链路上的通信（例如，从 ks-controller-manager 到 kube-apiserver，或从 kube-apiserver 到 ks-apiserver 的流量被拦截）。

flyforfun

我新建个 eks 集群就好了，之前 eks 的创建通过 terraform 创建的

frezes

@superwhys @flyforfun @Jerry_L 之前是新建的集群么？还是升级上来的？