k8s报错

1.执行kubectl delete删除后，pod一直处于Terminating状态，journalctl -u kubelet查看日志报错：

Sep 17 13:12:34 k8s-node1 kubelet[691867]: E0917 13:12:34.364333  691867 pod_workers.go:1298] "Error syncing pod, skipping" err="failed to \"KillPodSandbox\" for \"7c83a5c5-4ec0-4c31-bc69-83e4c9ca0ff7\" with KillPodSandboxError: \"rpc error: code = Unknown desc = failed to destroy network for sandbox \\\"c869360d50a9f5725e309d1bb039186f18f73b8d4326393f3226ffe19262034f\\\": plugin type=\\\"calico\\\" failed (delete): error getting ClusterInformation: connection is unauthorized: Unauthorized\"" pod="default/mysql-0" podUID="7c83a5c5-4ec0-4c31-bc69-83e4c9ca0ff7"

原因：Calico 组件的短暂故障或状态不一致会导致认证问题，重启可以解决这类临时性问题
解决方法：重新部署 Calico Pod：

kubectl rollout restart daemonset calico-node -n kube-system

 

2.kubelet服务报错无法拉取registry.k8s.io/pause:3.6镜像，网络不通导致，即使配置了/etc/containerd/config.toml镜像加速也无法拉取，查询k8s集群状态报错：

E0925 13:12:10.759783    3011 memcache.go:265] couldn't get current server API group list: Get "https://172.25.0.130:6443/api?timeout=32s": dial tcp 172.25.0.130:6443: connect: connection refused

解决方法：

cat /etc/containerd/config.toml | grep -A 10 -B 5 "registry.k8s.io"
sandbox_image = "registry.k8s.io/pause:3.6"
替换registry.k8s.io/pause:3.6镜像为registry.aliyuncs.com/google_containers/pause:3.6
重启containerd服务后解决

 

3.jenkins跑k8s任务报错：Caused by: java.net.ProtocolException: Expected HTTP 101 response but was '403 Forbidden'
原因：k8s的ServiceAccount缺少必要权限
# 示例：创建一个允许 pods/exec 的 ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: jenkins-agent-exec
rules:
- apiGroups: [""]
resources: ["pods", "pods/exec", "pods/log"]
verbs: ["get", "list", "watch", "create", "delete"]

# 示例：将 ClusterRole 绑定到您的 ServiceAccount

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: jenkins-agent-exec-binding
subjects:
- kind: ServiceAccount
name: jenkins-agent
namespace: default
roleRef:
kind: ClusterRole
name: jenkins-agent-exec
apiGroup: rbac.authorization.k8s.io

验证权限​：应用 RBAC 更改后，验证权限是否生效：

kubectl auth can-i create pods/exec --as=system:serviceaccount:default:jenkins-agent.