- Transport: Error while dialing failed to WebSocket dial
- ValidationError(Deployment.metadata)
- Error while dialing failed to WebSocket dial: failed to send handshake request
- Decompressor is not installed for grpc-encoding
- Certificate signed by unknown authority
- Project not found
- Failed to perform vulnerability scan on workload: jobs.batch already exists
对适用于 Kubernetes 的极狐GitLab 代理进行故障排除
当您使用适用于 Kubernetes 的极狐GitLab 代理时,您可能会遇到需要进行故障排除的问题。
您可以从查看服务日志开始:
kubectl logs -f -l=app=gitlab-agent -n gitlab-agent
如果您是极狐GitLab 管理员,您还可以查看极狐GitLab 代理服务器日志。
Transport: Error while dialing failed to WebSocket dial
{
"level": "warn",
"time": "2020-11-04T10:14:39.368Z",
"msg": "GetConfiguration failed",
"error": "rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing failed to WebSocket dial: failed to send handshake request: Get \\\"https://gitlab-kas:443/-/kubernetes-agent\\\": dial tcp: lookup gitlab-kas on 10.60.0.10:53: no such host\""
}
当 kas-address
和您的代理 pod 之间存在连接问题时,会发生此错误。要解决此问题,请确保 kas-address
是准确的。
{
"level": "error",
"time": "2021-06-25T21:15:45.335Z",
"msg": "Reverse tunnel",
"mod_name": "reverse_tunnel",
"error": "Connect(): rpc error: code = Unavailable desc = connection error: desc= \"transport: Error while dialing failed to WebSocket dial: expected handshake response status code 101 but got 301\""
}
当 kas-address
不包含尾部斜杠时会发生此错误。要解决此问题,请确保 wss
或 ws
URL 以斜杠结尾,例如 wss://GitLab.host.tld:443/-/kubernetes-agent/
或 ws:// GitLab.host.tld:80/-/kubernetes-agent/
。
ValidationError(Deployment.metadata)
{
"level": "info",
"time": "2020-10-30T08:56:54.329Z",
"msg": "Synced",
"project_id": "root/kas-manifest001",
"resource_key": "apps/Deployment/kas-test001/nginx-deployment",
"sync_result": "error validating data: [ValidationError(Deployment.metadata): unknown field \"replicas\" in io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta, ValidationError(Deployment.metadata): unknown field \"selector\" in io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta, ValidationError(Deployment.metadata): unknown field \"template\" in io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta]"
}
当清单文件格式错误并且 Kubernetes 无法创建指定的对象时,会发生此错误。确保您的清单文件有效。
如需其他故障排除,请尝试使用清单文件直接在 Kubernetes 中创建对象。
Error while dialing failed to WebSocket dial: failed to send handshake request
{
"level": "warn",
"time": "2020-10-30T09:50:51.173Z",
"msg": "GetConfiguration failed",
"error": "rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing failed to WebSocket dial: failed to send handshake request: Get \\\"https://GitLabhost.tld:443/-/kubernetes-agent\\\": net/http: HTTP/1.x transport connection broken: malformed HTTP response \\\"\\\\x00\\\\x00\\\\x06\\\\x04\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x05\\\\x00\\\\x00@\\\\x00\\\"\""
}
当您在代理端将 wss
配置为 kas-address
时会发生此错误,但代理服务器在 wss
不可用。要解决此问题,请确保双方都配置了相同的方案。
Decompressor is not installed for grpc-encoding
{
"level": "warn",
"time": "2020-11-05T05:25:46.916Z",
"msg": "GetConfiguration.Recv failed",
"error": "rpc error: code = Unimplemented desc = grpc: Decompressor is not installed for grpc-encoding \"gzip\""
}
当代理的版本比代理服务器 (KAS) 的版本新时,会发生此错误。
要修复它,请确保 agentk
和代理服务器版本相同。
Certificate signed by unknown authority
{
"level": "error",
"time": "2021-02-25T07:22:37.158Z",
"msg": "Reverse tunnel",
"mod_name": "reverse_tunnel",
"error": "Connect(): rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing failed to WebSocket dial: failed to send handshake request: Get \\\"https://GitLabhost.tld:443/-/kubernetes-agent/\\\": x509: certificate signed by unknown authority\""
}
当您的实例使用由代理未知的内部证书颁发机构签名的证书时,会发生此错误。
要解决此问题,您可以使用 Kubernetes configmap
将 CA 证书文件提供给代理,并将该文件安装在代理 /etc/ssl/certs
目录中,该文件将自动从该目录中获取。
例如,如果您的内部 CA 证书是 myCA.pem
:
kubectl -n gitlab-agent create configmap ca-pemstore --from-file=myCA.pem
然后在 resources.yml
中:
spec:
serviceAccountName: gitlab-agent
containers:
- name: agent
image: "registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:<version>"
args:
- --token-file=/config/token
- --kas-address
- wss://kas.host.tld:443 # replace this line with the line below if using Omnibus GitLab or GitLab.com.
# - wss://gitlab.host.tld:443/-/kubernetes-agent/
# - wss://kas.gitlab.com # for GitLab.com users, use this KAS.
# - grpc://host.docker.internal:8150 # use this attribute when connecting from Docker.
volumeMounts:
- name: token-volume
mountPath: /config
- name: ca-pemstore-volume
mountPath: /etc/ssl/certs/myCA.pem
subPath: myCA.pem
volumes:
- name: token-volume
secret:
secretName: gitlab-agent-token
- name: ca-pemstore-volume
configMap:
name: ca-pemstore
items:
- key: myCA.pem
path: myCA.pem
或者,您可以将证书文件安装在不同的位置,并为 --ca-cert-file
代理参数指定它:
containers:
- name: agent
image: "registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:<version>"
args:
- --ca-cert-file=/tmp/myCA.pem
- --token-file=/config/token
- --kas-address
- wss://kas.host.tld:443 # replace this line with the line below if using Omnibus GitLab or GitLab.com.
# - wss://gitlab.host.tld:443/-/kubernetes-agent/
# - wss://kas.gitlab.com # for GitLab.com users, use this KAS.
# - grpc://host.docker.internal:8150 # use this attribute when connecting from Docker.
volumeMounts:
- name: token-volume
mountPath: /config
- name: ca-pemstore-volume
mountPath: /tmp/myCA.pem
subPath: myCA.pem
Project not found
{
"level ":"error ",
"time ":"2022-01-05T15:18:11.331Z",
"msg ":"GetObjectsToSynchronize.Recv failed ",
"mod_name ":"gitops ",
"error ":"rpc error: code = NotFound desc = project not found ",
}
当您保存清单的项目不公开时,会发生此错误。要修复它,请确保您的项目是公开的,或者您的清单文件存储在配置代理的仓库中。
Failed to perform vulnerability scan on workload: jobs.batch already exists
{
"level": "error",
"time": "2022-06-22T21:03:04.769Z",
"msg": "Failed to perform vulnerability scan on workload",
"mod_name": "starboard_vulnerability",
"error": "running scan job: creating job: jobs.batch \"scan-vulnerabilityreport-b8d497769\" already exists"
}
极狐GitLab 代理通过创建作业来扫描每个工作负载来执行漏洞扫描。如果扫描中断,这些作业可能会被遗留下来,需要在运行更多作业之前进行清理。您可以通过运行以下命令清理这些作业:
kubectl delete jobs -l app.kubernetes.io/managed-by=starboard -n gitlab-agent