EKS Anywhere 集群證書管理器 io 超時

Question

第一次嘗試 EKS Anywhere docker 提供程序部署，如下鏈接https://anywhere.eks.amazonaws.com/docs/getting-started/local-environment/

它卡在“等待證書管理器”。 工作在 CentOS 7. 系統在代理后面。

Installing cert-manager Version="v1.5.3+66e1acc"
Using Override="cert-manager.yaml" Provider="cert-manager" Version="v1.5.3+66e1acc"
Waiting for cert-manager to be available...
Error: timed out waiting for the condition

只有 cert-manager pod 無法拉取鏡像

   NAMESPACE            NAME                                                              READY   STATUS             RESTARTS   AGE
  cert-manager         cert-manager-7988d4fb6c-bjhsv                                     0/1     ImagePullBackOff   0          5m54s
  cert-manager         cert-manager-cainjector-6bc8dcdb64-hvdx5                          0/1     ImagePullBackOff   0          5m55s
  cert-manager         cert-manager-webhook-68979bfb95-q8ttt                             0/1     ImagePullBackOff   0          5m54s
  kube-system          coredns-745c7986c7-2wrx5                                          1/1     Running            0          5m57s
  kube-system          coredns-745c7986c7-kx594                                          1/1     Running            0          5m57s
  kube-system          etcd-dev-cluster-eks-a-cluster-control-plane                      1/1     Running            0          5m52s
  kube-system          kindnet-4jcvt                                                     1/1     Running            0          5m57s
  kube-system          kube-apiserver-dev-cluster-eks-a-cluster-control-plane            1/1     Running            0          5m52s
  kube-system          kube-controller-manager-dev-cluster-eks-a-cluster-control-plane   1/1     Running            0          5m52s
  kube-system          kube-proxy-4dk2r                                                  1/1     Running            0          5m57s
  kube-system          kube-scheduler-dev-cluster-eks-a-cluster-control-plane            1/1     Running            0          5m52s
  local-path-storage   local-path-provisioner-666bfc797f-nkhqf                           1/1     Running            0          5m57s

使用 docker pull 拉取相同的圖像

 public.ecr.aws/eks-anywhere/jetstack/cert-manager-webhook      v1.5.3-eks-a-6                 194bcfda671e   3 months ago    46MB
 public.ecr.aws/eks-anywhere/jetstack/cert-manager-controller   v1.5.3-eks-a-6                 1e6749016508   3 months ago    61.3MB
 public.ecr.aws/eks-anywhere/jetstack/cert-manager-cainjector   v1.5.3-eks-a-6                 45723d794a88   3 months ago    42.4MB

kubectl describe 給出以下（i/o 超時）錯誤以及“服務器行為不當”錯誤

 Failed to pull image "public.ecr.aws/eks-anywhere/jetstack/cert-manager-controller:v1.5.3-eks-a-6": rpc error: code = Unknown desc = failed to pull and unpack image "public.ecr.aws/eks-anywhere/jetstack/cert-manager-controller:v1.5.3-eks-a-6": failed to resolve reference "public.ecr.aws/eks-anywhere/jetstack/cert-manager-controller:v1.5.3-eks-a-6": failed to do request: Head "https://public.ecr.aws/v2/eks-anywhere/jetstack/cert-manager-controller/manifests/v1.5.3-eks-a-6": dial tcp: lookup public.ecr.aws on 172.19.0.1:53: read udp 172.19.0.2:38941->172.19.0.1:53: i/o timeout

Answer 1

這是一個代理相關的問題。 通過在node的docker容器的containerd服務中添加代理配置並重啟containerd服務解決。

docker exec -it <container name> bash

內部容器

cd /etc/systemd/system/
mkdir containerd.service.d
touch http-proxy.conf
cat <<EOF >/etc/systemd/system/containerd.service.d/http-proxy.conf    
[Service]    
Environment="HTTP_PROXY=http://proxy ip:proxy port"    
Environment="HTTPS_PROXY=http://proxy ip:proxy port"    
Environment="NO_PROXY=${NO_PROXY:-localhost},${LOCAL_NETWORK}"    
EOF
systemctl daemon-reload
systemctl restart containerd