Cattle-node-agent 证书校验失败

  • Rancher 版本: v2.3.8

  • 离线部署

下游集群信息

  • Kubernetes 版本: 1.17.1
  • 通过rancher提供的自定义方式部署

用户信息 : 集群管理员

主机操作系统:: Centos7.6

问题描述:
服务器断电重启后,下游cattle-agent-node报错
ERROR: Configured cacerts checksum (0f4306bd33470450535678b6b5f338e5fb314a8f9429e2f6eff5b78e6a296dde) does not match given --ca-checksum (1c0fe204b2ba027aa58d1b39478587d1c2d112c32fb790cc971ae5e1b8c2a165)

报错截图:

重现步骤:

结果:

预期结果:

日志

[root@master ~]# docker logs -f 5b109
INFO: Environment: CATTLE_ADDRESS=192.168.0.122 CATTLE_AGENT_CONNECT=true CATTLE_CA_CHECKSUM=1c0fe204b2ba027aa58d1b39478587d1c2d112c32fb790cc971ae5e1b8c2a165 CATTLE_CLUSTER=false CATTLE_INTERNAL_ADDRESS= CATTLE_K8S_MANAGED=true CATTLE_NODE_NAME=master CATTLE_SERVER=https://192.168.0.121:1443
INFO: Using resolv.conf:
INFO: https://192.168.0.121:1443/ping is accessible
INFO: Value from https://192.168.0.121:1443/v3/settings/cacerts is an x509 certificate
ERROR: Configured cacerts checksum (0f4306bd33470450535678b6b5f338e5fb314a8f9429e2f6eff5b78e6a296dde) does not match given --ca-checksum (1c0fe204b2ba027aa58d1b39478587d1c2d112c32fb790cc971ae5e1b8c2a165)
ERROR: Please check if the correct certificate is configured at https://192.168.0.121:1443/v3/settings/cacerts

并且无法使用kubectl控制下游k8s集群
[root@master ~]# kubectl get nodes
Error from server (ServiceUnavailable): the server is currently unable to handle the request

可以检查下 https://192.168.0.121:1443/v3/settings/cacerts 里配置的ca 证书和你安装环境时候配置的证书是否一致

这个是使用rancher提供的自定义方式部署的,该怎么查看


这个是访问这个地址的截图