• 首页 首页 icon
  • 工具库 工具库 icon
    • IP查询 IP查询 icon
  • 内容库 内容库 icon
    • 快讯库 快讯库 icon
    • 精品库 精品库 icon
    • 问答库 问答库 icon
  • 更多 更多 icon
    • 服务条款 服务条款 icon

Azure K8S修复因AKS密钥过期而导致创建服务不成功的问题(The provided client secret keys for app ****** are expired)

武飞扬头像
lulight
帮助2

问题描述

学新通

在Azure Kubernetes 服务中,创建一个Internal Load Balancer服务,使用以下yaml内容:

internallb.yaml

apiVersion: v1
kind: Service
metadata:
  name: ilb-myapp
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: myapp

apply yaml

kubectl apply -f internallb.yaml

查看service状态,一直保持pending

kubectl get service

## 输出结果:
NAME               TYPE           CLUSTER-IP    EXTERNAL-IP   PORT(S)        AGE
ilb-myapp   LoadBalancer   10.0.32.246   <pending>     80:30198/TCP   92m
kubernetes         ClusterIP      10.0.0.1      <none>        443/TCP        13h

查看service日志

"error_description":"AADSTS7000222: The provided client secret keys for app '********-****-****-****-************' are expired

kubectl describe service  ilb-myapp 

##输出结果:
Events:
  Type     Reason                    Age                  From                  Message
  ----     ------                    ----                 ----                  -------
  Warning  UpdateLoadBalancerFailed  45m (x26 over 82m)   service-controller    (combined from similar events): Error updating load balancer with new hosts map[aks-vmss000002:{} aks-vmss000003:{} aks-vmss000006:{} aks-vmss000007:{}]: shouldUpdateLoadBalancer: failed to list managed load balancers: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 401, RawError: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to http://localhost:7788/*****: StatusCode=401 -- Original Error: adal: Refresh request failed. Status Code = '401'. Response body: {"error":"invalid_client","error_description":"AADSTS7000222: The provided client secret keys for app '********-****-****-****-************' are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.\r\nTrace ID: fa5035d2-1a6e-4b5a-85d0-910862a12501\r\nCorrelation ID: a184c126-96cb-42a9-8c4b-92869210e295\r\nTimestamp: 2023-05-31 02:33:46Z","error_codes":[7000222],"timestamp":"2023-05-31 02:33:46Z","trace_id":"fa5035d2-1a6e-4b5a-85d0-910862a12501","correlation_id":"a184c126-96cb-42a9-8c4b-92869210e295","error_uri":"https://login.chinacloudapi.cn/error?code=7000222"} 
  Normal   EnsuringLoadBalancer      37s (x25 over 95m)   service-controller    Ensuring load balancer
  Warning  ListLoadBalancers         37s (x152 over 91m)  azure-cloud-provider  (combined from similar events): Retriable: false, RetryAfter: 0s, HTTPStatusCode: 401, RawError: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to http://localhost:7788/*****: StatusCode=401 -- Original Error: adal: Refresh request failed. Status Code = '401'. Response body: {"error":"invalid_client","error_description":"AADSTS7000222: The provided client secret keys for app '********-****-****-****-************' are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.\r\nTrace ID: 277e6d9c-d663-4415-bff9-ef6610dc4f01\r\nCorrelation ID: 383589a0-2dd7-4c8e-a1a3-23a48ae8bd6d\r\nTimestamp: 2023-05-31 03:19:01Z","error_codes":[7000222],"timestamp":"2023-05-31 03:19:01Z","trace_id":"277e6d9c-d663-4415-bff9-ef6610dc4f01","correlation_id":"383589a0-2dd7-4c8e-a1a3-23a48ae8bd6d","error_uri":"https://login.chinacloudapi.cn/error?code=7000222"}

问题解答

根据错误消息,已经得知是 app client secret 已经过期。那么要修复这个问题,就是更换新的 secret。操作步骤有两步:

第一步 :根据错误消息中的Application ID,在Azure AD中查找到对应的注册应用

在注册应用中,重新生成新的Client Secret,复制保存新的Secret(用于第二步中)

学新通

第二步 : 使用 az aks update-credentials 命令,更新AKS集群中的密钥值(Secret Value)

az aks update-credentials --resource-group <resource group name>  --name <AKS Cluster name>  --reset-service-principal --service-principal <App Application ID>    --client-secret  <第一步中的Secret Value>

命令参考文档:https://docs.azure.cn/zh-cn/aks/update-credentials#update-aks-cluster-with-service-principal-credentials

当命令执行完成后,在此检查 Service 状态,不在是Pending。而是分配了正确的IP地址

学新通

参考资料

故障排查https://docs.azure.cn/zh-cn/aks/kubernetes-service-principal?tabs=azure-cli#troubleshoot

使用服务主体凭据更新 AKS 群集 :https://docs.azure.cn/zh-cn/aks/update-credentials#update-aks-cluster-with-service-principal-credentials

这篇好文章是转载于:学新通技术网

  • 版权申明: 本站部分内容来自互联网,仅供学习及演示用,请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系,请提供相关证据及您的身份证明,我们将在收到邮件后48小时内删除。
  • 本站站名: 学新通技术网
  • 本文地址: /boutique/detail/tanhhkchha
系列文章
更多 icon
同类精品
更多 icon
继续加载