kubeadm join fails in slave node

[maheshraghunandanan86]

Is this a request for help?

Somehow selinux was enabled in my slave nodes (3 node cluster). I disabled and rebooted the slave nodes. After that when I did a kubectl get pods --all-namespaces, it didn't list anything instead mentioned unable to connect to 8080, perhaps using wrong port
SO, I did a kubeadm reset, restarted kubelet service and then ran kubeadm join --token=masternodetoken masterip, it fails as mentioned below:

$ sudo kubeadm join --token=8f06e2.5c574bc920b43da6 master-ip
[kubeadm] WARNING: kubeadm is in alpha, please do not use it for production clusters.
[preflight] Running pre-flight checks
[tokens] Validating provided token
[discovery] Created cluster info discovery client, requesting info from "http://master-ip:9898/cluster-info/v1/?token-id=8f06e2"
[discovery] Cluster info object received, verifying signature using given token
[discovery] Cluster info signature and contents are valid, will use API endpoints [https://master-ip:6443]
[bootstrap] Trying to connect to endpoint https://master-ip:6443
[bootstrap] Detected server version: v1.6.0
[bootstrap] Successfully established connection with endpoint "https://masterip:6443"
[csr] Created API client to obtain unique certificate for this node, generating keys and certificate signing request
failed to request signed certificate from the API server [cannot create certificate signing request: the server could not find the requested resource]
[centos@ip-master-ip ~]$ kubectl get serviceAccounts
The connection to the server localhost:8080 was refused - did you specify the right host or port?

So, it halts and says " failed to request signed certificate from the API server [cannot create certificate signing request: the server could not find the requested resource]"

What keywords did you search in kubeadm issues before filing this one?

I searched for this issue in kubeadm issues, but not available.

Versions

kubeadm version (use kubeadm version): ~]$ kubeadm version
kubeadm version: version.Info{Major:"1", Minor:"6+", GitVersion:"v1.6.0-alpha.0.2074+a092d8e0f95f52", GitCommit:"a092d8e0f95f5200f7ae2cba45c75ab42da36537", GitTreeState:"clean", BuildDate:"2016-12-13T17:03:18Z", GoVersion:"go1.7.4", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Kubernetes version (use kubectl version):
  ~]$ kubectl version
  Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.4", GitCommit:"7243c69eb523aa4377bce883e7c0dd76b84709a1", GitTreeState:"clean", BuildDate:"2017-03-07T23:53:09Z", GoVersion:"go1.7.4", Compiler:"gc", Platform:"linux/amd64"}

• Cloud provider or hardware configuration: AWS Cloud environment

• OS (e.g. from /etc/os-release):
  ~]$ cat /etc/os-release
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:centos:centos:7"
  HOME_URL="https://www.centos.org/"
  BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

• Kernel (e.g. uname -a):
  ~]$ uname -a
  Linux ip-172-32-102-22.ec2.internal 3.10.0-327.10.1.el7.x86_64 kubeadm join on slave node fails preflight checks #1 SMP Tue Feb 16 17:03:50 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
• Others:

[itling]

+1

[xeor]

I got the same error in kubeadm 1.6.0-alpha, upgrading to the one in the unstable channel (1.6.1-beta) fixed this error for me. Example on ubuntu, use deb http://apt.kubernetes.io/ kubernetes-xenial-unstable main

[timothysc]

Could you re-try with the latest 1.6.4 versions. It looks from you command line output that you had a mismatch on tool versions a mix of 1.5 and 1.6.

[luxas]

Yes, the problem here was that you used v1.5 for kubeadm join and tried to join a v1.6 master.
That's not supported as highlighted in the release notes.

Please use v1.6.x consistently

[3792274]

-- Unit kubelet.service has begun starting up.
9月 05 13:51:55 m1 kubelet[2836]: Flag --api-servers has been deprecated, Use --kubeconfig instead. Will be removed in a future version.
9月 05 13:51:55 m1 kubelet[2836]: I0905 13:51:55.154786    2836 feature_gate.go:144] feature gates: map[]
9月 05 13:51:55 m1 kubelet[2836]: error: failed to run Kubelet: cannot create certificate signing request: User "system:anonymous" cannot create certificatesigningrequests.certificates.k8s.io at the cluster scope. (
9月 05 13:51:55 m1 systemd[1]: kubelet.service: main process exited, code=exited, status=1/FAILURE
9月 05 13:51:55 m1 systemd[1]: Unit kubelet.service entered failed state.
9月 05 13:51:55 m1 systemd[1]: kubelet.service failed.
9月 05 13:51:55 m1 systemd[1]: kubelet.service holdoff time over, scheduling restart.
9月 05 13:51:55 m1 systemd[1]: Started Kubernetes Kubelet Server.
-- Subject: Unit kubelet.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit kubelet.service has finished starting up.
-- 
-- The start-up result is done.
9月 05 13:51:55 m1 systemd[1]: Starting Kubernetes Kubelet Server...
-- Subject: Unit kubelet.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit kubelet.service has begun starting up.
9月 05 13:51:55 m1 kubelet[2842]: Flag --api-servers has been deprecated, Use --kubeconfig instead. Will be removed in a future version.
9月 05 13:51:55 m1 kubelet[2842]: I0905 13:51:55.398127    2842 feature_gate.go:144] feature gates: map[]
9月 05 13:51:55 m1 kubelet[2842]: error: failed to run Kubelet: cannot create certificate signing request: User "system:anonymous" cannot create certificatesigningrequests.certificates.k8s.io at the cluster scope. (
9月 05 13:51:55 m1 systemd[1]: kubelet.service: main process exited, code=exited, status=1/FAILURE
9月 05 13:51:55 m1 systemd[1]: Unit kubelet.service entered failed state.
9月 05 13:51:55 m1 systemd[1]: kubelet.service failed.
9月 05 13:51:55 m1 systemd[1]: kubelet.service holdoff time over, scheduling restart.
9月 05 13:51:55 m1 systemd[1]: start request repeated too quickly for kubelet.service
9月 05 13:51:55 m1 systemd[1]: Failed to start Kubernetes Kubelet Server.
-- Subject: Unit kubelet.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit kubelet.service has failed.
-- 
-- The result is failed.
9月 05 13:51:55 m1 systemd[1]: Unit kubelet.service entered failed state.
9月 05 13:51:55 m1 systemd[1]: kubelet.service failed.

error: failed to run Kubelet: cannot create certificate signing request: User "system:anonymous" cannot create certificatesigningrequests.certificates.k8s.io at the cluster scope.