helmrelease sync Unauthorized about clusternet HOT 20 CLOSED

I0627 11:07:41.208943       1 helmrelease.go:240] start processing HelmRelease "dev-186/dipper-dipper-helm-dipper-dipper"
I0627 11:07:41.208976       1 helm.go:424] handle HelmRelease dev-186/dipper-dipper-helm-dipper-dipper
I0627 11:07:41.209033       1 deployer.go:126] handle HelmRelease dev-186/dipper-dipper-helm-dipper-dipper
I0627 11:07:41.380423       1 chart.go:114] chart locates at: /root/.cache/helm/repository/dipper-v0.0.0-377d7fb0.tgz
I0627 11:07:41.420510       1 round_trippers.go:463] GET https://10.43.0.1:443/apis/proxies.clusternet.io/v1alpha1/sockets/f421c5a9-3c57-48ba-97bd-aca828017643/proxy/direct/api/v1/namespaces/dipper/secrets?labelSelector=name%3Ddipper%2Cowner%3Dhelm
I0627 11:07:41.420530       1 round_trippers.go:469] Request Headers:
I0627 11:07:41.420539       1 round_trippers.go:473]     Accept: application/json, */*
I0627 11:07:41.420546       1 round_trippers.go:473]     Impersonate-User: clusternet
I0627 11:07:41.420552       1 round_trippers.go:473]     Impersonate-Extra-Clusternet-Token: xxxx
I0627 11:07:41.420561       1 round_trippers.go:473]     Authorization: Basic <masked>
I0627 11:07:41.420568       1 round_trippers.go:473]     User-Agent: clusternet-controller-manager/v0.16.0 (linux/amd64) kubernetes/3085492
I0627 11:07:41.421548       1 round_trippers.go:574] Response Status: 401 Unauthorized in 0 milliseconds
I0627 11:07:41.421563       1 round_trippers.go:577] Response Headers:
I0627 11:07:41.421570       1 round_trippers.go:580]     Audit-Id: 71fbecfa-07ac-4a25-a7e3-b814968288ab
I0627 11:07:41.421577       1 round_trippers.go:580]     Cache-Control: no-cache, private
I0627 11:07:41.421584       1 round_trippers.go:580]     Content-Type: application/json
I0627 11:07:41.421591       1 round_trippers.go:580]     Content-Length: 129
I0627 11:07:41.421599       1 round_trippers.go:580]     Date: Tue, 27 Jun 2023 11:07:41 GMT
I0627 11:07:41.421623       1 request.go:1171] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
E0627 11:07:41.422255       1 helmrelease.go:218] error syncing 'dev-186/dipper-dipper-helm-dipper-dipper': query: failed to query with labels: Unauthorized, requeuing
I0627 11:07:41.422745       1 request.go:1171] Request Body: {"count":14,"lastTimestamp":"2023-06-27T11:07:41Z","message":"query: failed to query with labels: Unauthorized"}
I0627 11:07:41.422825       1 round_trippers.go:463] PATCH https://10.43.0.1:443/api/v1/namespaces/dev-186/events/dipper-dipper-helm-dipper-dipper.176c7f617a29a2d9
I0627 11:07:41.422873       1 round_trippers.go:469] Request Headers:
I0627 11:07:41.422904       1 round_trippers.go:473]     User-Agent: clusternet-controller-manager/v0.16.0 (linux/amd64) kubernetes/3085492/clusternet-controller-manager-kube-client
I0627 11:07:41.422954       1 round_trippers.go:473]     Content-Type: application/strategic-merge-patch+json
I0627 11:07:41.422993       1 round_trippers.go:473]     Accept: application/json, */*
I0627 11:07:41.423032       1 round_trippers.go:473]     Authorization: Bearer <masked>
I0627 11:07:41.427977       1 round_trippers.go:574] Response Status: 200 OK in 4 milliseconds
I0627 11:07:41.427993       1 round_trippers.go:577] Response Headers:
I0627 11:07:41.428016       1 round_trippers.go:580]     Content-Length: 1097
I0627 11:07:41.428036       1 round_trippers.go:580]     Date: Tue, 27 Jun 2023 11:07:41 GMT
I0627 11:07:41.428044       1 round_trippers.go:580]     Audit-Id: 97822bc2-362e-4eec-b2da-cbf6654ec391
I0627 11:07:41.428051       1 round_trippers.go:580]     Cache-Control: no-cache, private
I0627 11:07:41.428057       1 round_trippers.go:580]     Content-Type: application/json
I0627 11:07:41.428063       1 round_trippers.go:580]     X-Kubernetes-Pf-Flowschema-Uid: 4fa00540-6a9a-43d9-ac03-9b104269db34
I0627 11:07:41.428070       1 round_trippers.go:580]     X-Kubernetes-Pf-Prioritylevel-Uid: 6b4c0877-6a26-4d0f-b22a-8ecce246ef01
I0627 11:07:41.428093       1 request.go:1171] Response Body: {"kind":"Event","apiVersion":"v1","metadata":{"name":"dipper-dipper-helm-dipper-dipper.176c7f617a29a2d9","namespace":"dev-186","uid":"4fd92fd9-6a68-47f0-bc7b-b1da4b2fb63b","resourceVersion":"111751920","creationTimestamp":"2023-06-27T11:06:57Z","managedFields":[{"manager":"clusternet-controller-manager","operation":"Update","apiVersion":"v1","time":"2023-06-27T11:07:41Z","fieldsType":"FieldsV1","fieldsV1":{"f:count":{},"f:firstTimestamp":{},"f:involvedObject":{},"f:lastTimestamp":{},"f:message":{},"f:reason":{},"f:source":{"f:component":{}},"f:type":{}}}]},"involvedObject":{"kind":"HelmRelease","namespace":"dev-186","name":"dipper-dipper-helm-dipper-dipper","uid":"8405f718-6d37-4780-a176-57a56a89a8a5","apiVersion":"apps.clusternet.io/v1alpha1","resourceVersion":"111004021"},"reason":"FailedSynced","message":"query: failed to query with labels: Unauthorized","source":{"component":"clusternet-controller-manager"},"firstTimestamp":"2023-06-27T11:06:56Z","lastTimestamp":"2023-06-27T11:07:41Z","count":14,"type":"W [truncated 73 chars]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    meta.helm.sh/release-name: clusternet-agent
    meta.helm.sh/release-namespace: clusternet-system
  creationTimestamp: "2023-06-29T14:19:53Z"
  labels:
    app.kubernetes.io/instance: clusternet-agent
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: clusternet-agent
    helm.sh/chart: clusternet-agent-0.13.0
  name: clusternet:app:deployer:admin
  resourceVersion: "312"
  uid: 67369a84-5fea-4a44-89e9-bfbb29c1c983
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: clusternet-app-deployer
  namespace: clusternet-system

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2023-06-29T14:19:42Z"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
  resourceVersion: "71"
  uid: 01cf7117-7f12-48a5-aa8d-2e18b17ef4b6
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'

kubectl get secret -n clusternet-zb7dt child-cluster-deployer -o=jsonpath='{.data.token}' | base64 --decode; echo

kubectl delete secret -n clusternet-system clusternet-app-deployer
kubectl scale deploy clusternet-agent -n clusternet-system --replicas=0
kubectl scale deploy clusternet-agent -n clusternet-system --replicas=3

E0704 02:56:10.100100       1 wait.go:190] failed to get Secret clusternet-system/clusternet-app-deployer: secrets "clusternet-app-deployer" not found
E0704 02:56:17.008467       1 wait.go:190] failed to get Secret clusternet-system/clusternet-app-deployer: secrets "clusternet-app-deployer" not found
E0704 02:56:23.360710       1 wait.go:190] failed to get Secret clusternet-system/clusternet-app-deployer: secrets "clusternet-app-deployer" not found
W0704 02:56:25.622592       1 clusterstatus_controller.go:151] failed to discover service CIDR: can't get ServiceIPRange

Warning  FailedSynced  2m57s (x13 over 3m20s)  clusternet-controller-manager  query: failed to query with labels: Unauthorized
  Warning  FailedSynced  2m36s (x3 over 2m42s)   clusternet-controller-manager  Kubernetes cluster unreachable: the server has asked for the client to provide credentials

    export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
    helm repo add clusternet ${HELM_REPO} 
    helm repo update
    helm install clusternet-hub -n clusternet-system clusternet/clusternet-hub  \
        --create-namespace \
        --set replicaCount=1 \
        --set resources.limits.cpu=1000m \
        --set anonymousAuthSupported=false

    helm install clusternet-scheduler  -n clusternet-system clusternet/clusternet-scheduler \
        --create-namespace \
        --set replicaCount=1

    helm install clusternet-controller-manager  -n clusternet-system clusternet/clusternet-controller-manager \
        --create-namespace \
        --set replicaCount=1

    kubectl apply -f https://raw.githubusercontent.com/clusternet/clusternet/main/manifests/samples/cluster_serviceaccount_token.yaml
    echo "clusternet join token:"
    kubectl get secret -n clusternet-system -o=jsonpath='{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="cluster-bootstrap-use")].data.token}' | base64 --decode; echo

k3s_config

    curl -sfL https://rancher-mirror.oss-cn-beijing.aliyuncs.com/k3s/k3s-install.sh | INSTALL_K3S_VERSION=${K3S_VERSION} INSTALL_K3S_MIRROR=cn sh -s - \
        --data-dir  /data/k3s \
        --disable-network-policy \
        --disable-helm-controller \
        --disable servicelb,traefik,local-storage,metrics-server

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
    helm repo add clusternet ${HELM_REPO} || true
    helm repo update

    #helm 渲染的时候会把逗号转义,多个 label 之间需要转义
    helm install clusternet-agent -n clusternet-system --create-namespace --wait --version ${CLUSTERNET_CHART_VERSION} \
        --set parentURL=${PARENT_HOST} \
        --set registrationToken=${TOKEN} \
        --set replicaCount=1 \
        --set extraArgs.cluster-reg-name=$(hostname) \
        --set extraArgs.cluster-reg-namespace=$(hostname) \
        --set priorityClassName=system-cluster-critical \
        clusternet/clusternet-agent