kubelete 证书报错 cannot create certificate signing request: Post https://xx.xx.xx.xx:6443/apis/certificates.k8s.io/v1beta1/certificatesign

failed to run Kubelet: cannot create certificate signing request: Po
Nov 18 17:24:11 fp-web-15 systemd[1]: kubelet.service holdoff time over, scheduling restart
cannot create certificate signing request: Post https://xx.xx.xx.xx:6443/apis/certificates.k8s.io/v1beta1/certificatesigningr
uling restart.
failed to run Kubelet: cannot create certificate signing request: P
Nov 23 20:03:05 fp-web-15 systemd[1]: kubelet.service holdoff time over, scheduling restart.
failed to run Kubelet: cannot create certificate signing request: Post https://xx.xx.xx.xx:6443/apis/certificates.k8s.io/v1beta1/certificatesign
x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority

解决方法：

kubectl create clusterrolebinding kubelet-bootstrap \
  --clusterrole=system:node-bootstrapper \
  --user=kubelet-bootstrap