Error when attempting to join minion to master

DariusDaftary

I keep running into the same error on Lab Exercise 2.2 when attempting to join my minion to my cluster.
I have 2 EC2 instances, we'll call them k1 andk2.
I'm able to successfully run the k8sMaster.sh script on k1:

ubuntu@ip-172-31-22-69:~$ kubectl get node
NAME              STATUS   ROLES    AGE     VERSION
ip-172-31-22-69   Ready    master   2m13s   v1.15.1

Next, I follow all the steps in the docs and run k8sSecond.sh on k2. I get the following output and the process seems to hang:

ubuntu@ip-172-31-18-250:~$ sudo kubeadm join 172.31.22.69:6443 --token {mytoken} \

[preflight] Running pre-flight checks [WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/

Here's what I see in /var/log/syslog after making the command above:

Aug 23 18:43:05 ip-172-31-18-250 systemd[1]: kubelet.service: Service hold-off time over, scheduling restart.
Aug 23 18:43:05 ip-172-31-18-250 systemd[1]: Stopped kubelet: The Kubernetes Node Agent.
Aug 23 18:43:05 ip-172-31-18-250 systemd[1]: Started kubelet: The Kubernetes Node Agent.
Aug 23 18:43:05 ip-172-31-18-250 kubelet[31570]: F0823 18:43:05.921062   31570 server.go:198] failed to load Kubelet config file /var/lib/kubelet/config.yaml, error failed to read kubelet config file "/var/lib/kubelet/config.yaml", error: open /var/lib/kubelet/config.yaml: no such file or directory
Aug 23 18:43:05 ip-172-31-18-250 systemd[1]: kubelet.service: Main process exited, code=exited, status=255/n/a
Aug 23 18:43:05 ip-172-31-18-250 systemd[1]: kubelet.service: Unit entered failed state.
Aug 23 18:43:05 ip-172-31-18-250 systemd[1]: kubelet.service: Failed with result 'exit-code'.

I've terminated and rebuilt the instances, tried doing kubeadm reset on both and kubeadm init on k1, and nothing seems to work. Any ideas? I've pretty much exhausted all avenues and am now willing to start pasting random commands into the CLI

serewicz

Hello,

Seeing more of the output of the join command and errors can help with the troubleshooting. There is also a --debug option which can show even more details. I would start looking at two things:
Is your kubeadm join a copy-paste from the master? If not, try to use that join. If the copy-paste works then there is something in the generation of the join statement.

Second, if it is a copy-paste I would look to make sure that there are no firewall rules in place. Did you open up all the ports?

Regards,

DariusDaftary

Thanks @serewicz.
The output I pasted from my join is everything. I will try the debug command later and report back.

The kubeadm join is indeed a copy-paste from master. I am now suspecting an issue with the networking/firewall setup. I set up 2 EC2 instances on AWS but I didn't do anything from a networking perspective to either, so i'm guessing there is a network setting (firewall, iptable, etc) that I need to change in order to get this to work.

Thanks for your help.

DariusDaftary

Just want to update this for future students:
I solved this issue by assigning my EC2 instances to the same Security Group and making sure it allows all inbound/outbound traffic on all ports. Once I did that I was able to get my minion to join the cluster. Thanks to @serewicz for the inspiration.

k8ckad

Hi, thanks for this Darius - have same issue ... Does work as you say when you completely open out the AWS Security Group (SG) but not hugely comfortable with this approach...
@Tim is it plausible/practical to obtain a list of the Port and Protocols to implement finer-grained 'holes' in the SG ? Are the Master-Minion comms primarily SSH and/or TCP ?? Please advise ? Many Thanks ! ...

chrispokorni

Hi @k8ckad ,
Kubernetes agents communicate across the cluster via API calls.
While not necessarily complete (but a good starting point), you could use the port numbers lists below to start creating FW rules and/or SG rules for your Kubernetes nodes:

https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports

Regards,
-Chris