解决k8s安装coredns提示证书错误问题

安装了一个新k8s环境在安装完kube-router网络插件之后发现coredns始终没法启动。经过命令查看发现报错
kubectl describe pod -n kube-system coredns-757569d647-qj8ts
日志：
Failed to create pod sandbox: rpc error: code = Unknown desc = [failed to set up sandbox container "b7ea16c5b21e06069d1418b322e04bd2da482acdf21f863f47c96a80c551eab5" network for pod "coredns-757569d647-qj8ts": networkPlugin cni failed to set up pod "coredns-757569d647-qj8ts_kube-system" network: error getting ClusterInformation: Get https://[10.31.0.1]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"), failed to clean up sandbox container "b7ea16c5b21e06069d1418b322e04bd2da482acdf21f863f47c96a80c551eab5" network for pod "coredns-757569d647-qj8ts": networkPlugin cni failed to teardown pod "coredns-757569d647-qj8ts_kube-system" network: error getting ClusterInformation: Get https://[10.31.0.1]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")]
使用了各类办法对比了coredns生成的密文
kubectl get secrets -n kube-system coredns-token-xc8kc -o yaml
发现和主机上的/etc/kubernetes/admin.conf文件中记录的ca密文是如出一辙。不知为什么就是没法正常访问到kube-apiserver的服务。
使用ipvsadm -Ln命令查看并无发现什么问题。
最后解决的办法是，把admin.conf中的ca密文解密。
certificate-authority-data: 后面的内容复制到一个文本中。
好比ca.txt，而后使用base64 -d ./ca.txt命令还原证书。
而后把证书保存到/etc/pki/ca-trust/source/anchors/kube.pem中。
修改coredns的deploy挂载目录。
添加pki挂载

api

volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
          readOnly: true
        - name: etc-pki
          mountPath: /etc/pki
          readOnly: true
        volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
            - key: Corefile
              path: Corefile
            - key: NodeHosts
              path: NodeHosts
        - hostPath:
            path: /etc/pki
            type: DirectoryOrCreate
          name: etc-pki

保存之后就会发现coredns能够正常使用了。网络

若是你们有更好的解决办法欢迎留言分享，谢谢！！ide