Kubelet service fail to start

General Discussions
1

Asking for help? Comment out what you need so we can get more information to help you!

Cluster information:

Kubernetes version: 1.10.2
Cloud being used: AWS-EC2
Installation method: Kubernetes the Hard Way
Host OS: Ubuntu 22.04
CNI and version: cni-plugins-linux-amd64 1.1.0
CRI and version: containerd 1.6.19

You can format your yaml by highlighting it and pressing Ctrl-Shift-C, it will make your output easier to read.

While following Kelsey Hightower’s Kubernetes the Hard Way , I am getting the following error starting the kubelet service after bootstrapping worker nodes-

kubelet.service - Kubernetes Kubelet
Loaded: loaded (/etc/systemd/system/kubelet.service; enabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Sun 2024-01-14 23:54:24 UTC; 4s ago
Docs: GitHub - kubernetes/kubernetes: Production-Grade Container Scheduling and Management
Process: 12027 ExecStart=/usr/local/bin/kubelet --config=/var/lib/kubelet/kubelet-config.yaml --container-runtime=remote --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock --image-pull-progress-deadlin
e=2m --kubeconfig=/var/lib/kubelet/kubeconfig --network-plugin=cni --register-node=true --v=2 --hostname-override=CKATRAINWK2 --allow-privileged=true (code=exited, status=1/FAILURE)
Main PID: 12027 (code=exited, status=1/FAILURE)
CPU: 152ms

Jan 14 23:54:24 CKATRAINWK2 kubelet[12027]: Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS
_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet’s --config flag. See https://kubernete>

2

Hi,
Try to configure cyphers using proposed method: Set Kubelet Parameters Via A Configuration File | Kubernetes

3

Could you be more specific? Maybe provide an example. I have read that particular article you linked to several times. Still need assistance.
kubelet-config.yaml
kind: KubeletConfiguration$
apiVersion: kubelet.config.k8s.io/v1beta1$
authentication:$
anonymous:$
enabled: false$
webhook:$
enabled: true$
x509:$
clientCAFile: “/var/lib/kubernetes/ca.pem”$
authorization:$
mode: Webhook$
cgroupDriver: systemd$
clusterDomain: “cluster.local”$
clusterDNS:$

  • “10.32.0.10”$
    runtimeRequestTimeout: “15m”$
    tlsCertFile: “/var/lib/kubelet/CKATRAINWK2.pem”$
    tlsPrivateKeyFile: “/var/lib/kubelet/CKATRAINWK2-key.pem”$
    tlsCipherSuites:$
  • TLS_ECDHE_ECDSA_WITH_CHACHA200_POLY1305$
  • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305$
  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256$
  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256$
  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384$
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384$
  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256$
  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256$
  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA$
  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA$
  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA$
  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA$
  • TLS_RSA_WITH_AES_128_GCM_SHA256$
  • TLS_RSA_WITH_AES_256_GCM_SHA384$
  • TLS_RSA_WITH_AES_128_CBC_SHA$
  • TLS_RSA_WITH_AES_256_CBC_SHA$