kubeSphere【ks-controller-manager-webhook-cert】证书 20260814

2026-08-14T12:46:01.494280123+08:00 helm.go:92: 2026-08-14 04:46:01.480163584 +0000 UTC m=+13.508250699 [debug] 2 errors occurred:
2026-08-14T12:46:01.494388232+08:00 * Internal error occurred: failed calling webhook "jsbundles.extensions.kubesphere.io": failed to call webhook: Post "https://ks-controller-manager.kubesphere-system.svc:443/validate-extensions-kubesphere-io-v1alpha1-jsbundle?timeout=30s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "self-signed-ca")
2026-08-14T12:46:01.494398464+08:00 * Internal error occurred: failed calling webhook "reverseproxies.extensions.kubesphere.io": failed to call webhook: Post "https://ks-controller-manager.kubesphere-system.svc:443/validate-extensions-kubesphere-io-v1alpha1-reverseproxy?timeout=30s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "self-signed-ca")
2026-08-14T12:46:01.494638504+08:00

kubesphere安装组件老是这个错误

 

 

 

#####

一键修复方案（直接复制整条执行）
bash
# 1. 删除旧webhook配置
kubectl delete validatingwebhookconfigurations extensions.kubesphere.io
# 2. 删除旧证书密钥
kubectl -n kubesphere-system delete secret ks-controller-manager-webhook-cert
# 3. 重启控制器，自动生成全新证书+重建webhook并注入正确CA
kubectl -n kubesphere-system rollout restart deployment ks-controller-manager
# 等待pod就绪
kubectl -n kubesphere-system get pods -w | grep ks-controller-manager

 

 

 

校验 webhook 是否自动重建
kubectl get validatingwebhookconfigurations extensions.kubesphere.io

 

 

日志持续报错：Secret "ks-controller-manager-webhook-cert" not found

 手动删除了 webhook 证书密钥，ks-controller-manager 启动后无法自动重建证书 secret，控制器陷入死循环报错。

1. 创建临时目录存放证书
mkdir -p ~/ks-webhook-certs && cd ~/ks-webhook-certs
2. 使用 openssl 生成自签 CA、服务证书（适配 KubeSphere webhook 域名）
# 1. 生成CA私钥与根证书
openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 3650 -subj "/CN=ks-webhook-ca"

# 2. 生成服务私钥+证书请求
openssl req -newkey rsa:2048 -nodes -keyout tls.key -out tls.csr -subj "/CN=ks-controller-manager.kubesphere-system.svc"

# 3. 用CA签发服务证书
openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out tls.crt -days 3650
3. 把证书打包创建 Secret（KubeSphere 固定名称）
kubectl create secret generic ks-controller-manager-webhook-cert \
-n kubesphere-system \
--from-file=ca.crt \
--from-file=tls.crt \
--from-file=tls.key
4. 验证 secret 创建成功
kubectl get secret ks-controller-manager-webhook-cert -n kubesphere-system
5. 重启控制器加载证书

kubectl rollout restart deployment ks-controller-manager -n kubesphere-system
6. 等待 Pod 就绪，查看日志不再报 NotFound
kubectl logs -f deployment/ks-controller-manager -n kubesphere-system

 

 

证书建好之后，恢复 extensions.kubesphere.io webhook
提取 caBundle
kubectl get secret ks-controller-manager-webhook-cert -n kubesphere-system -o jsonpath='{.data.ca\.crt}'

 

 

复制输出字符串，填入下方 yaml：
yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: extensions.kubesphere.io
labels:
app: ks-controller-manager
tier: control-plane
webhooks:
- name: extensions.kubesphere.io
clientConfig:
service:
namespace: kubesphere-system
name: ks-controller-manager
path: /validate-extensions
port: 443
caBundle: "此处粘贴上面获取的base64字符串"
rules:
- apiGroups:
- extensions.kubesphere.io
apiVersions: ["*"]
operations: [CREATE, UPDATE, DELETE]
resources: ["*"]
scope: Namespaced
admissionReviewVersions: [v1, v1beta1]
sideEffects: None
timeoutSeconds: 30
failurePolicy: Ignore
执行部署：
kubectl apply -f ext-webhook.yaml
最终校验
kubectl get validatingwebhookconfigurations extensions.kubesphere.io