添加openpitrix报错

for-mat

kubesphere-ca证书创建过了，但是pod仍有报错

[root@k8s ssl]# kubectl logs   ks-apiserver-d78644f98-9llbg -n kubesphere-system          
W1204 07:24:17.754168       1 client_config.go:549] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I1204 07:24:17.756855       1 server.go:179] Start cache objects
Error: unable to retrieve the complete list of server APIs: metrics.k8s.io/v1beta1: the server is currently unable to handle the request
Usage:
  ks-apiserver [flags]

for-mat

[root@k8s ssl]# kubectl logs -n kube-system metrics-server-7cb5bdc66d-kh6zz              
I1204 07:30:29.230130       1 serving.go:273] Generated self-signed cert (apiserver.local.config/certificates/apiserver.crt, apiserver.local.config/certificates/apiserver.key)
Error: cluster doesn't provide requestheader-client-ca-file

好像是因为这个

for-mat

解决了，主要是cluster doesn’t provide requestheader-client-ca-file这个报错导致
原因：api-server没有开启聚合配置
解决方法：修改apiserver启动程序
vim /etc/systemd/system/kube-apiserver.service
增加
–requestheader-client-ca-file=/vdb/kubernetes/ssl/ca.pem \
–requestheader-allowed-names=aggregator \
–requestheader-extra-headers-prefix=X-Remote-Extra- \
–requestheader-group-headers=X-Remote-Group \
–requestheader-username-headers=X-Remote-User \
–proxy-client-cert-file=/vdb/kubernetes/ssl/kube-proxy.pem \
–proxy-client-key-file=/vdb/kubernetes/ssl/kube-proxy-key.pem
然后重启
systemctl daemon-reload
systemctl restart kube-apiserver