CKA 예제 리마인더 - 21. View Certificate Details

openssl x509 -in [crt파일경로] -text -noout

• x509
  • X.509 형식 인증서를 처리하겠다는 의미입니다.
  • X.509는 SSL/TLS 인증서에 사용되는 표준 형식입니다.
• -in [crt파일경로]
  • 분석할 인증서 파일의 경로를 지정합니다.
  • 파일은 일반적으로 .crt, .cer, .pem 확장자를 가집니다.
• -text
  • 인증서의 상세 내용을 사람이 읽을 수 있는 텍스트 형식으로 출력합니다.
  • 예: 주체 정보, 발급자 정보, 유효 기간, 사용되는 암호화 알고리즘 등.
• -noout
  • 인증서의 원본(Base64 인코딩된 PEM 형식 내용)을 출력하지 않고, 필요한 정보만 출력합니다.
  • 이 옵션이 없으면 인증서 데이터 전체가 출력됩니다.

 

 

 

kubectl 명령어가 작동하지 않는 현상을 픽스하세요


crictl ps -a 명령어로 kube-apiserver 및 etcd 컨테이너 상태 확인, 컨테이너 ID 확인

etcd 컨테이너가 Exited 상태인 것을 확인하고 로그 확인

crictl logs [컨테이너ID]

에러 로그 확인

{"level":"fatal","ts":"2024-12-02T02:06:11.789907Z","caller":"etcdmain/etcd.go:219","msg":"listener failed","error":"open /etc/kubernetes/pki/etcd/server-certificate.crt: no such file or directory","stacktrace":"go.etcd.io/etcd/server/v3/etcdmain.startEtcdOrProxyV2\n\tgo.etcd.io/etcd/server/v3/etcdmain/etcd.go:219\ngo.etcd.io/etcd/server/v3/etcdmain.Main\n\tgo.etcd.io/etcd/server/v3/etcdmain/main.go:40\nmain.main\n\tgo.etcd.io/etcd/server/v3/main.go:31\nruntime.main\n\truntime/proc.go:267"}


"error":"open /etc/kubernetes/pki/etcd/server-certificate.crt: no such file or directory" 가 주요한 원인

cd /etc/kubernetes/pki/etcd/

확인 후 crt 파일이 server-certificate.crt가 아닌 server.crt 인 것을 확인


vim /etc/kubernetes/manifests/etcd.yaml


spec.containers.command 아래의 crt 파일 경로 수정

- --cert-file=/etc/kubernetes/pki/etcd/server-certificate.crt에서 - --cert-file=/etc/kubernetes/pki/etcd/server.crt

수정이후 crctl ps -a 로 컨테이너 상태 확인

etcd 컨테이너는 running 상태가 되었지만 kube-apiserver는 여전히 Exited 상태

crictl logs 명령어로 로그를 확인해봤더니 여전히 etcd 포트인 2379포트에서 연결 오류가 발생

crictl -h 명령어로 컨테이너 삭제 명령어 확인

crictl rm 명령어로 exited 상태인 kube-apiserver 컨테이너 삭제 후 컨테이너가 재실행되며 running 상태로 돌아온 것을 확인

kubectl get po -A 명령어로 kubectl 명령어 정상동작 확인



kubectl 명령어가 작동하지 않는 현상을 픽스하세요 -2

circtl ps -a 로 컨테이너 상태 확인
controlplane /etc/kubernetes/manifests ➜  crictl ps -a
CONTAINER           IMAGE               CREATED             STATE               NAME                      ATTEMPT             POD ID              POD
46d368c6e4cd2       604f5db92eaa8       34 seconds ago      Exited              kube-apiserver            2                   bc23bc4fec8f9       kube-apiserver-controlplane
d6f4ed9e6e89b       045733566833c       2 minutes ago       Running             kube-controller-manager   2                   95ec3a7291c39       kube-controller-manager-controlplane
5023e5f0d6f4d       1766f54c897f0       2 minutes ago       Running             kube-scheduler            2                   1e1612c2c3548       kube-scheduler-controlplane
3a06c0fad9aec       2e96e5913fc06       10 minutes ago      Running             etcd                      0                   7270d048f0d7b       etcd-controlplane
677120118d2aa       1766f54c897f0       31 minutes ago      Exited              kube-scheduler            1                   1e1612c2c3548       kube-scheduler-controlplane
c291c4d5063f7       045733566833c       31 minutes ago      Exited              kube-controller-manager   1                   95ec3a7291c39       kube-controller-manager-controlplane
308a88b95ac90       ead0a4a53df89       51 minutes ago      Running             coredns                   0                   d4066d0b44a77       coredns-77d6fd4654-rrj9h
59384a1a09c36       ead0a4a53df89       51 minutes ago      Running             coredns                   0                   b2975c64c451f       coredns-77d6fd4654-f6lhz
a9662810630ba       01cdfa8dd262f       51 minutes ago      Running             kube-flannel              0                   a61e9bbe667ee       kube-flannel-ds-bt44q
c3fb25e0f22c5       01cdfa8dd262f       51 minutes ago      Exited              install-cni               0                   a61e9bbe667ee       kube-flannel-ds-bt44q
80a943f13260a       a55d1bad692b7       51 minutes ago      Exited              install-cni-plugin        0                   a61e9bbe667ee       kube-flannel-ds-bt44q
b790bf101e4f0       ad83b2ca7b09e       51 minutes ago      Running             kube-proxy                0                   f9f031c204dca       kube-proxy-8pnhx

crictl logs 46d368c6e4cd2 로그 확인

W1202 02:22:08.574106       1 logging.go:55] [core] [Channel #5 SubChannel #6]grpc: addrConn.createTransport failed to connect to {Addr: "127.0.0.1:2379", ServerName: "127.0.0.1:2379", }. Err: connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority"

etcd 포트인 2379 포트에서 crt 파일 에러 발생

vim /etc/kubernetes/manifests/etcd.yaml

etcd 컨테이너는 running으로 정상 작동중이기에 kube-apiserver 의 manifest 확인




cat /etc/kubernetes/manifests/kube-apiserver.yaml

spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=192.168.233.132
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-issuer=https://kubernetes.default.svc.cluster.local
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
    - --service-cluster-ip-range=172.20.0.0/16
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key

확인해보니 etcd crt 파일 경로가 잘못됨

controlplane kubernetes/pki/etcd ➜  ls
ca.crt  ca.key  healthcheck-client.crt  healthcheck-client.key  peer.crt  peer.key  server.crt  server.key

    - --etcd-cafile=/etc/kubernetes/pki/ca.crt 를     - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt

 

kube-apiserver 컨테이너 running  상태 확인 후 kubectl 명령어 정상 작동 확인