【kubernetes VPA】记录一次安装 VPA 相关组件的报错解决过程

> 文章作者：云矩阵  ### 1. 问题描述 在执行 ./hack/vpa-up.sh 脚本命令时，提示有报错。名为 vpa-admission-controller 的容器状态一直停留在 ContainerCreating，从该 Pod 详细描述中得知，volume "tls-certs" : secret "vpa-tls-certs" not found，没有找到这两个密钥，无法进行挂载。 ``` [root@k8s-master openssl-1.1.1h]# kubectl get pods -n kube-system |grep vpa vpa-admission-controller-64cb9cfb4b-xvzpf 0/1 ContainerCreating 0 3m30s vpa-recommender-6fdd69df6c-rj725 1/1 Running 0 25m vpa-updater-8567bff646-z28v9 1/1 Running 0 25m [root@k8s-master openssl-1.1.1h]# kubectl describe pod vpa-admission-controller-64cb9cfb4b-xvzpf -n kube-system Name: vpa-admission-controller-64cb9cfb4b-xvzpf Namespace: kube-system Priority: 0 Service Account: vpa-admission-controller Node: k8s-node01/192.168.20.32 Start Time: Fri, 01 Mar 2024 15:54:35 +0800 Labels: app=vpa-admission-controller pod-template-hash=64cb9cfb4b Annotations: <none> Status: Pending IP: IPs: <none> Controlled By: ReplicaSet/vpa-admission-controller-64cb9cfb4b Containers: admission-controller: Container ID: Image: k8s.gcr.io/autoscaling/vpa-admission-controller:0.12.0 Image ID: Ports: 8000/TCP, 8944/TCP Host Ports: 0/TCP, 0/TCP State: Waiting Reason: ContainerCreating Ready: False Restart Count: 0 Limits: cpu: 200m memory: 500Mi Requests: cpu: 50m memory: 200Mi Environment: NAMESPACE: kube-system (v1:metadata.namespace) Mounts: /etc/tls-certs from tls-certs (ro) /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-ncfnk (ro) Conditions: Type Status Initialized True Ready False ContainersReady False PodScheduled True Volumes: tls-certs: Type: Secret (a volume populated by a Secret) SecretName: vpa-tls-certs Optional: false kube-api-access-ncfnk: Type: Projected (a volume that contains injected data from multiple sources) TokenExpirationSeconds: 3607 ConfigMapName: kube-root-ca.crt ConfigMapOptional: <nil> DownwardAPI: true QoS Class: Burstable Node-Selectors: <none> Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s node.kubernetes.io/unreachable:NoExecute op=Exists for 300s Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 3m42s default-scheduler Successfully assigned kube-system/vpa-admission-controller-64cb9cfb4b-xvzpf to k8s-node01 Warning FailedMount 99s kubelet Unable to attach or mount volumes: unmounted volumes=[tls-certs], unattached volumes=[tls-certs kube-api-access-ncfnk]: timed out waiting for the condition Warning FailedMount 95s (x9 over 3m42s) kubelet MountVolume.SetUp failed for volume "tls-certs" : secret "vpa-tls-certs" not found ``` ### 2. 问题原因 openssl 版本低。 ### 3. 解决办法 升级 openssl 版本。 ``` [root@k8s-master openssl-1.1.1h]# openssl version -a OpenSSL 1.0.2k-fips 26 Jan 2017 built on: reproducible build, date unspecified platform: linux-x86_64 options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM OPENSSLDIR: "/etc/pki/tls" engines: rdrand dynamic ``` 下载并解压 openssl-1.1.1h.tar.gz ``` wget https://www.openssl.org/source/openssl-1.1.1h.tar.gz tar zxvf openssl-1.1.1h.tar.gz cd openssl-1.1.1h ./config ``` opessl 编译安装完成 ``` make & make install ``` > 显示如下结果，表示安装完成。  ``` [root@k8s-master openssl-1.1.1h]# mv /usr/bin/openssl /usr/bin/openssl.bak [root@k8s-master openssl-1.1.1h]# ln -s /usr/local/bin/openssl /usr/bin/openssl [root@k8s-master openssl-1.1.1h]# ln -s /usr/local/include/openssl/ /usr/include/openssl [root@k8s-master openssl-1.1.1h]# echo "/usr/local/lib64" >> /etc/ld.so.conf [root@k8s-master openssl-1.1.1h]# ldconfig -v ``` 完成 openssl 版本的升级。 ``` [root@k8s-master openssl-1.1.1h]# openssl version -a OpenSSL 1.1.1h 22 Sep 2020 built on: Fri Mar 1 07:46:58 2024 UTC platform: linux-x86_64 options: bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr) compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG OPENSSLDIR: "/usr/local/ssl" ENGINESDIR: "/usr/local/lib64/engines-1.1" Seeding source: os-specific ``` 重新执行` ./hack/vpa-up.sh`脚本，顺利通过，无报错。 ``` [root@k8s-master vertical-pod-autoscaler]# ./hack/vpa-up.sh customresourcedefinition.apiextensions.k8s.io/verticalpodautoscalercheckpoints.autoscaling.k8s.io created customresourcedefinition.apiextensions.k8s.io/verticalpodautoscalers.autoscaling.k8s.io created clusterrole.rbac.authorization.k8s.io/system:metrics-reader created clusterrole.rbac.authorization.k8s.io/system:vpa-actor created clusterrole.rbac.authorization.k8s.io/system:vpa-checkpoint-actor created clusterrole.rbac.authorization.k8s.io/system:evictioner created clusterrolebinding.rbac.authorization.k8s.io/system:metrics-reader created clusterrolebinding.rbac.authorization.k8s.io/system:vpa-actor created clusterrolebinding.rbac.authorization.k8s.io/system:vpa-checkpoint-actor created clusterrole.rbac.authorization.k8s.io/system:vpa-target-reader created clusterrolebinding.rbac.authorization.k8s.io/system:vpa-target-reader-binding created clusterrolebinding.rbac.authorization.k8s.io/system:vpa-evictionter-binding created serviceaccount/vpa-admission-controller created clusterrole.rbac.authorization.k8s.io/system:vpa-admission-controller created clusterrolebinding.rbac.authorization.k8s.io/system:vpa-admission-controller created clusterrole.rbac.authorization.k8s.io/system:vpa-status-reader created clusterrolebinding.rbac.authorization.k8s.io/system:vpa-status-reader-binding created serviceaccount/vpa-updater created deployment.apps/vpa-updater created serviceaccount/vpa-recommender created deployment.apps/vpa-recommender created Generating certs for the VPA Admission Controller in /tmp/vpa-certs. Generating RSA private key, 2048 bit long modulus (2 primes) .......................................................................+++++ ........................................................................................................+++++ e is 65537 (0x010001) Generating RSA private key, 2048 bit long modulus (2 primes) ................................................................................+++++ .........................................................................................................................................................................................................+++++ e is 65537 (0x010001) Signature ok subject=CN = vpa-webhook.kube-system.svc Getting CA Private Key Uploading certs to the cluster. secret/vpa-tls-certs created Deleting /tmp/vpa-certs. deployment.apps/vpa-admission-controller created service/vpa-webhook created ``` > 最终`vpa-admission-controller`的 Pod 正常运行\~ ``` [root@k8s-master vertical-pod-autoscaler]# kubectl get pods -n kube-system |grep vpa vpa-admission-controller-64cb9cfb4b-m76n5 1/1 Running 0 25m vpa-recommender-6fdd69df6c-q7z7t 1/1 Running 0 25m vpa-updater-8567bff646-5dbk4 1/1 Running 0 25m ```  ### 4. 参考链接 ❤️‍🔥[autoscaler/vertical-pod-autoscaler at master · kubernetes/autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler#install-command?trk=cndc-detail) 🩷[vpa-admission-controller- not created · Issue #2810 · kubernetes/autoscaler](https://github.com/kubernetes/autoscaler/issues/2810?trk=cndc-detail) ❤️[OpenSSL 安装升级_升级 openssl-CSDN 博客](https://blog.csdn.net/tfstone/article/details/109223506?trk=cndc-detail) [](https://summit.amazoncloud.cn/2024/register.html?source=DSJAVfG2GS7gEk2Osm6kYXAa+8HnSEVdbCVjkuit7lE=)