Join Log in
Score:0
avatar Server

kubeadm not creating controller-manager.conf when using external CA

cn flag
Lethargos

I'm trying to initialise a kubernetes cluster using kubeadm, unfortunately this isn't working as expected. This is the kubeadm config file:

apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
kubernetesVersion: "v1.19.16"
networking:
  podSubnet: "10.230.0.0/16"
  dnsDomain: "company.internal"
etcd:
  external:
    endpoints:
      - https://kube-etcd-1:2379
      - https://kube-etcd-2:2379
      - https://kube-etcd-3:2379

Unfortunately I keep getting this error when trying to initialise it using kubeadm init --config /root/.config/new-config.yaml:

the controller-manager.conf file does not exists or it is not valid: stat /etc/kubernetes/controller-manager.conf: no such file or directory

kubeadm automatically identifies the fact that the certificates have already been generated and can be found under /etc/kubernetes/pki, and only in this context am I getting this error. If I remove the certificates, it will generate everything by itself, including controller-manager.conf. Any ideas on how I can solve this issue?

Using --v=5 doesn't offer any insights other than basically just that, that it cannot find controll-manager.conf:

kube-controlplane-1:/etc/kubernetes/pki# kubeadm init --config /root/.config/new-config.yaml --v=6
I1221 00:15:05.160594    1964 initconfiguration.go:200] loading configuration from "/root/.config/new-config.yaml"
I1221 00:15:05.164578    1964 initconfiguration.go:103] detected and using CRI socket: /run/containerd/containerd.sock
I1221 00:15:05.165098    1964 interface.go:400] Looking for default routes with IPv4 addresses
I1221 00:15:05.165142    1964 interface.go:405] Default route transits interface "ens192"
I1221 00:15:05.165518    1964 interface.go:208] Interface ens192 is up
I1221 00:15:05.165730    1964 interface.go:256] Interface "ens192" has 2 addresses :[10.88.88.225/24 fe80::250:56ff:febe:79f5/64].
I1221 00:15:05.165856    1964 interface.go:223] Checking addr  10.88.88.225/24.
I1221 00:15:05.165901    1964 interface.go:230] IP found 10.88.88.225
I1221 00:15:05.165937    1964 interface.go:262] Found valid IPv4 address 10.88.88.225 for interface "ens192".
I1221 00:15:05.165969    1964 interface.go:411] Found active IP 10.88.88.225
W1221 00:15:05.180639    1964 configset.go:348] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
stat /etc/kubernetes/controller-manager.conf: no such file or directory
the controller-manager.conf file does not exists or it is not valid
k8s.io/kubernetes/cmd/kubeadm/app/phases/kubeconfig.ValidateKubeconfigsForExternalCA
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go:372
k8s.io/kubernetes/cmd/kubeadm/app/cmd.newInitData
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/init.go:386
k8s.io/kubernetes/cmd/kubeadm/app/cmd.NewCmdInit.func3
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/init.go:193
k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow.(*Runner).InitData
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow/runner.go:183
k8s.io/kubernetes/cmd/kubeadm/app/cmd.NewCmdInit.func1
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/init.go:141
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).execute
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:842
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).ExecuteC
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:950
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).Execute
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:887
k8s.io/kubernetes/cmd/kubeadm/app.Run
    /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/kubeadm.go:50
main.main
    _output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/kubeadm.go:25
runtime.main
    /usr/local/go/src/runtime/proc.go:204
runtime.goexit
    /usr/local/go/src/runtime/asm_amd64.s:1374

Any ideas on how to debug this are welcome!

Thanks!

Later edit: kubeadm version: 1.19.16

139
1 + 5
in flag
mdaniel
You didn't ask, but installing v1.19 is asking for trouble as it's **incredibly** out of date for kubernetes
0
Reply
cn flag
Lethargos
Indeed, I didn't.
0
Reply
cn flag
Lethargos
For me the question has actually become rather irrelevant in the meantime. Just to offer more context: the version needs to be older, because I'm upgrading an even older version of kubernetes and this is a sort of transition version which is still compatible with both the older and the newer syntax (such as nginx controller, various resources etc.) I was trying to use vault and terraform to issue all the necessary certificates, but the terraform module doesn't support colons in the CN, and some of the certificates contain that, so it's impossible to continue in this direct.
0
Reply
cn flag
Lethargos
Therefore I will leave kubeadm to create the certificates for the cluster itself, while the certificates for etcd will be issued by vault. Despite its being not exactly symmetrical, it's not bad, because I can inject the etcd certificates in the cloudinit config files of the controlplane nodes without first having to extract that information from the etcd nodes.
0
Reply
cn flag
Lethargos
@mdaniel And by the way, before jumping on the 'please upgrade' bandwagon, I should let you know that 1.19.16 has only been EOL for around 1 year. It's far from being 'incredibly out of the date'.
0
Reply
Score:-1
avatar Server
in flag
mdaniel

Well, without the version of kubeadm we're left to guess, but the general idea is that in external CA mode (which you are in due to the ca.crt existing but the key not) that method expects you are deploying in an "already configured" mode, and thus both controller-manager.conf and scheduler.conf should already exist

The short version would be to ensure you understand what's going on with the contents of the /etc/kubernetes directory, and next time post the relevant versions of what you're using

+ 1
cn flag
Lethargos
The problem with your answer is basically that you're using the so-called lack of information (which is true, although you could easily have inferred that from the kubeconfig version - but yes, the versions don't necessarily need to be identical) to basically mirror the error and providing yourself no further information at all, other than, yes, I need 'controller-manager.conf' to exist! That's less than helpful, I have to say. Moreover, the logic of the certificates most probably hasn't changed in many years. So now that you know the version, you'd probably be able to give an *exact* answer!
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.