csr请求重复的问题

[ghost]

环境

版本和配置信息

• kubernetes版本：1.12.1
• docker版本：18.06.1-ce
• 网络插件：flannel
• 存储类型：无

kubectl get csr出现许多csr请求

使用kubectl get nodes可以看到node已经是ready

master的三个组件也是健康的 下面是apiserver的配置：

OPTIONS="--advertise-address=0.0.0.0 
--external-hostname=master.pengjinyi.com
--bind-address=0.0.0.0
 --tls-cert-file=/etc/kubernetes/pki/kube-apiserver.pem
--tls-private-key-file=/etc/kubernetes/pki/kube-apiserver-key.pem
 --enable-swagger-ui
 --client-ca-file=/etc/kubernetes/pki/ca.pem
  --service-account-key-file=/etc/kubernetes/pki/service.key 
-authorization-mode=RBAC,Node  
--enable-admission-plugins=Initializers,NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
 --allow-privileged=true 
--kubelet-certificate-authority=/etc/kubernetes/pki/ca.pem 
--kubelet-client-certificate=/etc/kubernetes/pki/kube-apiserver-kubelet-client.pem 
--kubelet-client-key=/etc/kubernetes/pki/kube-apiserver-kubelet-client-key.pem 
 --service-cluster-ip-range=10.0.0.0/16 
--insecure-port=0 
--token-auth-file=/etc/kubernetes/token.csv"
ETCD_SERVERS="--etcd-servers=\"https://172.18.1.91:2379,https://172.18.1.92:2379,https://172.18.1.93:2379\""
ETCD_CERT="--etcd-cafile=/etc/kubernetes/pki/etcd/ca.pem --etcd-certfile=/etc/kubernetes/pki/etcd/etcd-client.pem 
--etcd-keyfile=/etc/kubernetes/pki/etcd/etcd-client-key.pem"

kube-controller-manager的配置：

OPTIONS="--v=4 --use-service-account-credentials  
--cluster-name=default-cluster 
--controllers=*,bootstrapsigner,tokencleaner 
--client-ca-file=/etc/kubernetes/pki/ca.pem
--cluster-signing-cert-file=/etc/kubernetes/pki/ca.pem 
--cluster-signing-key-file=/etc/kubernetes/pki/ca-key.pem
 --service-account-private-key-file=/etc/kubernetes/pki/service.key 
--kubeconfig=/etc/kubernetes/controller-manager.kube 
--leader-elect=false"

kubelet的配置:

OPTIONS="--bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig 
--cert-dir=/var/lib/kubelet/pki 
--client-ca-file=/etc/kubernetes/pki/ca.pem 
--cluster-dns=10.0.0.2
 --cluster-domain=cluster.local 
--kubeconfig=/etc/kubernetes/schedule.kube --logtostderr
 --rotate-certificates
 --rotate-server-certificates 
--v=4 
--pod-infra-container-image=k8s.gcr.io/pause:3.1"

三台节点的时间服务chronyd也启动了

[ghost]

昨天也使用ntpdate手动同步过时间

[ghost]

kube-controller-manager服务不能开机启动

[ghost]

但是使用systemctl start kube-controller-manager是没有问题的，日志也没有报错

[ghost]

我把新生成的csr请求approve后，知道现在也没有生成csr请求，但是第二天早上看又会出现

[llussy]

我也遇到了同样的问题，请问您的是怎么解决的？