安装了一个新k8s环境在安装完kube-router网络插件以后发现coredns始终无法启动。通过命令查看发现报错
kubectl describe pod -n kube-system coredns-757569d647-qj8ts
日志：
Failed to create pod sandbox: rpc error: code = Unknown desc = [failed to set up sandbox container "b7ea16c5b21e06069d1418b322e04bd2da482acdf21f863f47c96a80c551eab5" network for pod "coredns-757569d647-qj8ts": networkPlugin cni failed to set up pod "coredns-757569d647-qj8ts_kube-system" network: error getting ClusterInformation: Get https://[10.31.0.1]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"), failed to clean up sandbox container "b7ea16c5b21e06069d1418b322e04bd2da482acdf21f863f47c96a80c551eab5" network for pod "coredns-757569d647-qj8ts": networkPlugin cni failed to teardown pod "coredns-757569d647-qj8ts_kube-system" network: error getting ClusterInformation: Get https://[10.31.0.1]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")]
使用了各种办法对比了coredns生成的密文
kubectl get secrets -n kube-system coredns-token-xc8kc -o yaml
发现和主机上的/etc/kubernetes/admin.conf文件中记录的ca密文是一模一样。不知为何就是无法正常访问到kube-apiserver的服务。
使用ipvsadm -Ln命令查看并没有发现什么问题。
最后解决的办法是，把admin.conf中的ca密文解密。
certificate-authority-data: 后面的内容复制到一个文本中。
比如ca.txt，然后使用base64 -d ./ca.txt命令还原证书。
然后把证书保存到/etc/pki/ca-trust/source/anchors/kube.pem中。
修改coredns的deploy挂载目录。
添加pki挂载

        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
          readOnly: true
        - name: etc-pki
          mountPath: /etc/pki
          readOnly: true
        volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
            - key: Corefile
              path: Corefile
            - key: NodeHosts
              path: NodeHosts
        - hostPath:
            path: /etc/pki
            type: DirectoryOrCreate
          name: etc-pki

保存以后就会发现coredns可以正常使用了。

如果大家有更好的解决办法欢迎留言分享，谢谢！！