kube - apisserver无法从添加到ApiServer POD清单的自定义卷中读取

Question

我想将准入控制器配置和审计策略yaml添加到kube api服务器。我将这两个文件保存在/etc/kubernetes/configs下的一个文件夹中，并将其作为卷/volumount添加到POD中。

pods从该位置获取配置文件失败，尽管没有得到任何错误。我做错了什么?

错误:初始化准入失败:读取插件配置失败:无法从/etc/kubernetes/configs/admission-controller.yaml&quot读取准入控制配置;[/etc/kubernetes/configs/admission-controller开放。Yaml:没有这样的文件或目录]

kube-apiserver.yaml

apiVersion: v1
kind: Pod
metadata:
annotations:
kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 192.168.1.45:6443
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
- kube-apiserver
- --service-account-lookup=true
- --request-timeout=300s
#- --audit-log-maxsize=100
#- --audit-log-maxbackup=10
#- --audit-log-maxage=30
#- --audit-policy-file=/etc/kubernetes/pki/audit-policy.yaml
#- --audit-log-path=/var/log/audit/audit.log
- --profiling=false
- --admission-control-config-file=/etc/kubernetes/configs/admission-controller.yaml
- --kubelet-certificate-authority=/etc/kubernetes/pki/ca.crt 
- --kubelet-https=true
- --anonymous-auth=false
- --advertise-address=192.168.1.45
- --allow-privileged=true
- --authorization-mode=Node,RBAC
- --client-ca-file=/etc/kubernetes/pki/ca.crt
- --enable-admission-plugins=NodeRestriction,EventRateLimit,AlwaysPullImages,PodSecurityPolicy
- --enable-bootstrap-token-auth=true
- --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
- --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
- --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
- --etcd-servers=https://127.0.0.1:2379
- --insecure-port=0
- --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
- --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
- --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
- --requestheader-allowed-names=front-proxy-client
- --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
- --requestheader-extra-headers-prefix=X-Remote-Extra-
- --requestheader-group-headers=X-Remote-Group
- --requestheader-username-headers=X-Remote-User
- --secure-port=6443
- --service-account-issuer=https://kubernetes.default.svc.cluster.local
- --service-account-key-file=/etc/kubernetes/pki/sa.pub
- --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
- --service-cluster-ip-range=10.96.0.0/12
- --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
- --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
image: k8s.gcr.io/kube-apiserver:v1.21.4
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 8
httpGet:
host: 192.168.1.45
path: /livez
port: 6443
scheme: HTTPS
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 15
name: kube-apiserver
readinessProbe:
failureThreshold: 3
httpGet:
host: 192.168.1.45
path: /readyz
port: 6443
scheme: HTTPS
periodSeconds: 1
timeoutSeconds: 15
resources:
requests:
cpu: 250m
startupProbe:
failureThreshold: 24
httpGet:
host: 192.168.1.45
path: /livez
port: 6443
scheme: HTTPS
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 15
volumeMounts:
- name: configfiles
mountPath: /etc/kubernetes/configs
readOnly: false
- name: auditlog
mountPath: /var/log/audit
readOnly: false
- mountPath: /etc/ssl/certs
name: ca-certs
readOnly: true
- mountPath: /etc/pki
name: etc-pki
readOnly: true
- mountPath: /etc/kubernetes/pki
name: k8s-certs
readOnly: true
hostNetwork: true
priorityClassName: system-node-critical
volumes:
- name: auditlog
hostpath:
path: /var/log/kubernetes
type: DirectoryOrCreate
- name: configfiles
hostpath:
path: /etc/kubernetes/configs
type: DirectoryOrCreate
- hostPath:
path: /etc/ssl/certs
type: DirectoryOrCreate
name: ca-certs
- hostPath:
path: /etc/pki
type: DirectoryOrCreate
name: etc-pki
- hostPath:
path: /etc/kubernetes/pki
type: DirectoryOrCreate
name: k8s-certs
status: {}

[root@controlplane ~]# ls -lrt /etc/kubernetes/configs
total 16
-rw------- 1 root root  175 Aug 21 09:36 eventconfig.yaml
-rw------- 1 root root  125 Aug 21 09:36 admission-controller.yaml
-rw------- 1 root root 2219 Aug 21 16:15 audit-policy.yaml_back
-rw------- 1 root root 2219 Aug 21 16:39 audit-policy.yaml
[root@controlplane ~]#

Answer 1

这个错误是由于hostPath不是驼峰的情况，改变它来解决这个问题。

- name: auditlog
hostPath:
path: /var/log/kubernetes
type: DirectoryOrCreate
- name: configfiles
hostPath:
path: /etc/kubernetes/configs
type: DirectoryOrCreate