[K8S]error execution phase preflight: couldn‘t validate the identity of the API Server

用kubeadm工具，k8s使用kubeadm join将工作节点加入到主控节点的时候遇到如下问题，执行命令卡顿很久后报错

[root@k8s2 ~]# kubeadm join 192.168.0.180:6443 --token uyylx2.7z02nonw8xgprh5y --discovery-token-ca-cert-hash sha256:0c81e2684c99b6af608f6cdc77c0a81a2d5284d72bcf3353d25fa37bd46839e2 --ignore-preflight-errors=SystemVerification
[preflight] Running pre-flight checks
[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 20.10.6. Latest validated version: 19.03

error execution phase preflight: couldn't validate the identity of the API Server: could not find a JWS signature in the cluster-info ConfigMap for token ID "uyylx2"
To see the stack trace of this error execute with --v=5 or higher

问题原因 kubeadm主控节点安装好后，token有效期24小时，如果超过了24小时，工作节点加入到主控节点就会报错，需要重新刷新主控节点的token

解决：

1、在主控节点执行如下命令得到结果如下

[root@k8s1 ~]# kubeadm token create --print-join-command
kubeadm join 192.168.0.180:6443 --token ftuwlv.41r1rbvk17f2mb0w --discovery-token-ca-cert-hash sha256:0c81e2684c99b6af608f6cdc77c0a81a2d5284d72bcf3353d25fa37bd46839e2

2、复制上面的结果在工作节点执行即可文章来源地址https://www.toymoban.com/news/detail-447019.html

[root@k8s2 ~]# kubeadm join 192.168.0.180:6443 --token ftuwlv.41r1rbvk17f2mb0w --discovery-token-ca-cert-hash sha256:0c81e2684c99b6af608f6cdc77c0a81a2d5284d72bcf3353d25fa37bd46839e2
[preflight] Running pre-flight checks
[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 20.10.6. Latest validated version: 19.03
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.