Kubernetes：无法验证 API 服务器的身份：tcp 拨号：连接：协议不可用

Question

After setting up the master node, worker node couldn't able to join the master. I get the error message -

couldn't validate the identity of the API Server: Get "https://{apiserver-ip}/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s": dial tcp {kubeapi-ip}:6443: connect: protocol not available

I am using VMs

master - 2cpu, 2 GB memory

worker - 1 cpu, 1 GB memory

Kubeadm init command:

sudo kubeadm init --pod-network-cidr 10.244.0.0/16 --apiserver-advertise-address=192.168.56.2 

Joing command that i used:

sudo kubeadm join 192.168.56.2:6443 --token xt3jug.8sfbnzqb4cnd7wbn \
        --discovery-token-ca-cert-hash sha256:3514a9d85abcfd9d00230beffa7731cebbd51b20e5fa66f10247e0bd473027c8

And i used flannel with pod id cidr same as i used while using kubeadm init

kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

Kubernetes Verion: 1.25.0

Using Virtual machine provision via Vagrant

Using Ubuntu linux

I tried pinging combination and permutation among nodes as well as host and guest. Everything is good so connection is not a problem.

I researched heavily on internet regarding Protocol not found error, but seems like none has ever faced such issue. I am more concerned if this issue ever happen in production how to handle it.

Moreover, kubeapi server is working fine when queried via kubectl inside the master node, but outside master node (worker node, host machine) giving such issue when trying to access the same kubeapi server. Which in theory should not, as kubeapiserver is accessed by all (considering cerficates and keys are properly in placed).

Please look into this issue. Atleast if someone could give an idea, what might be the root issue which caused such error to occur, would be grateful. Or where to look for? I am new to such level of networking.

Answer 1

I guess i figured it out. Seems like there is some kind security mechanism built inside kubernetes or kubeadm i dont know. But here what i did.

Initial state of K8 : not able to make curl or telnet to master node at 192.168.56.2:6443 from host

• ssh into masternode and made curl or https to host machine (even if its unsuccessful)

Changed state of K8 : kubernetes seems like it now know who could make a curl or telnet request to it from previous operation.

• went back to host machine and made same curl or https to master node no more "Protocol not available" issue

I tested it several time with other worker and it follows the pattern. Seems like masternode or kube-apiserver locks itself up (excluding the ssh means of connecting to it)

I hope this will help any person in future facing same kind of error and help save hours to figure it out.

At this point, I am not able to provide any explanation. The only things I can say is that its the pre-behaviour of K8, when master-node is ready and workers node have not joined yet.

I would really appreciate if somebody find time and provide any explanation for this behavior.