CentOS7 kubernetes Pod作成時のContainerCreating stuckエラー

現象##

CentOS7上のKubernetes環境でPodの作成がContainerCreating状態で止まり失敗する

[root@master ~]# kubectl get pods
NAME           READY     STATUS              RESTARTS   AGE
sample-label   0/1       ContainerCreating   0          2d
sample-pod2    0/1       ContainerCreating   0          2d

原因##

root証明書が存在しない

[root@master ~]# kubectl describe  pods
Name:           sample-label

------- 中略 ------
      Reason:           ContainerCreating
    Ready:              False
    Restart Count:      0
    
  2d            3m              791     {kubelet worker}                       Warning          FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request.  details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)"

解決策##

https://bugs.centos.org/view.php?id=14785
上記の手順を実施

# wget http://mirror.centos.org/centos/7/os/x86_64/Packages/python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm
# rpm2cpio python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm | cpio -iv --to-stdout ./etc/rhsm/ca/redhat-uep.pem | tee /etc/rhsm/ca/redhat-uep.pem

Podの作成が成功

[root@master ~]# kubectl create -f label.yaml
pod "sample-label" created
[root@master ~]# kubectl get pods
NAME           READY     STATUS              RESTARTS   AGE
sample-label   0/1       ContainerCreating   0          3s

[root@master ~]# kubectl get pods
NAME           READY     STATUS    RESTARTS   AGE
sample-label   1/1       Running   0          52s

masterのみでなく、worker側でも必要
※worker側での作業前は、ReplicaSetのworkerでの作成が失敗

[root@master ~]# kubectl get pods -o wide
NAME                 READY     STATUS              RESTARTS   AGE       IP             NODE
sample-externaldns   1/1       Running             0          57m       172.17.0.131   master
sample-label         1/1       Running             1          3h        172.17.0.130   master
sample-rs-5cr60      0/1       ContainerCreating   0          3s        <none>         worker
sample-rs-6w9fp      1/1       Running             0          3s        172.17.0.132   master
sample-rs-r1t7l      0/1       ContainerCreating   0          3s        <none>         worker

workerでの作業後、成功

[root@master ~]# kubectl get pods -o wide
NAME                 READY     STATUS    RESTARTS   AGE       IP             NODE
sample-externaldns   1/1       Running   0          1h        172.17.0.131   master
sample-label         1/1       Running   1          4h        172.17.0.130   master
sample-rs-5cr60      1/1       Running   0          3m        172.17.0.3     worker
sample-rs-6w9fp      1/1       Running   0          3m        172.17.0.132   master
sample-rs-r1t7l      1/1       Running   0          3m        172.17.0.2     worker

※参考
https://qiita.com/kamaboko123/items/80f3161c5d781dfc7700