环境： centos7.6 主机，calico 3.1.3

kubernetes 部署好 calico 后，发现 calicoctl 部分命令使用出现问题

caclicoctl 配置文件

[root@k8s02 ~]# cat /etc/calico/calicoctl.cfg 
apiVersion: projectcalico.org/v3
kind: CalicoAPIConfig
metadata:
spec:
  datastoreType: "etcdv3"
  etcdEndpoints: "https://k8s01:2379,https://k8s02:2379,https://k8s03:2379"
  etcdKeyFile: "/etc/kubernetes/ssl/etcd-key.pem"
  etcdCertFile: "/etc/kubernetes/ssl/etcd.pem"
  etcdCACertFile: "/etc/kubernetes/ssl/ca.pem"

1、calicoctl node 命令使用没问题

[root@k8s02 ~]# calicoctl node status
Calico process is running.

IPv4 BGP status
+--------------+-------------------+-------+------------+-------------+
| PEER ADDRESS |     PEER TYPE     | STATE |   SINCE    |    INFO     |
+--------------+-------------------+-------+------------+-------------+
| 10.2.7.200   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.202   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.203   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.204   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.205   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.206   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.207   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.208   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.209   | node-to-node mesh | up    | 2020-04-15 | Established |
+--------------+-------------------+-------+------------+-------------+

IPv6 BGP status
No IPv6 peers found

2、caclicoctl get 命令报错

[root@k8s02 ~]# calicoctl get node
Failed to create Calico API client: context deadline exceeded

3、1 2 两步导致排错一脸懵逼，遂使用 docker 部署 calicoctl

[root@k8s02 ~]# docker run -it -v /etc/calico:/etc/calico -v /etc/kubernetes/ssl:/etc/kubernetes/ssl --entrypoint="/bin/sh" --name calicoctl calico/ctl:v3.1.3
~ # calicoctl get node
Failed to create Calico API client: dial tcp: lookup k8s02 on 10.2.2.223:53: no such host

域名解析出错，修改 /etc/calico/calicoctl.cfg 中 etcdEndpoints，用 ip 替换机器名

[root@k8s02 ~]# cat /etc/calico/calicoctl.cfg 
apiVersion: projectcalico.org/v3
kind: CalicoAPIConfig
metadata:
spec:
  datastoreType: etcdv3
  etcdEndpoints: https://10.2.7.200:2379,https://10.2.7.201:2379,https://10.2.7.202:2379 
  etcdKeyFile: /etc/kubernetes/ssl/etcd-key.pem
  etcdCertFile: /etc/kubernetes/ssl/etcd.pem
  etcdCACertFile: /etc/kubernetes/ssl/ca.pem

修改之后，docker 中执行 calicoctl get node 没有问题

~ # calicoctl get node
NAME     
test01   
test02   
test03   
test04   
test05   
test06   
test07   
test08   
test09   
test10

但是执行 calicoctl node status，出现问题

~ # calicoctl node status
Calico process is not running.

怀疑是 calicoctl docker 没有权限访问 calico/node 容器，该容器主要负责 calico-felix 和 bird 服务

所以使用 --pid=host 共享主机 pid

[root@k8s02 ~]# docker run -it -v /etc/calico:/etc/calico -v /etc/kubernetes/ssl:/etc/kubernetes/ssl  -v /var/run/calico:/var/run/calico --pid=host --entrypoint="/bin/sh" --name calicoctl calico/ctl:v3.1.3

~ # calicoctl node status
Calico process is running.

IPv4 BGP status
+--------------+-------------------+-------+------------+-------------+
| PEER ADDRESS |     PEER TYPE     | STATE |   SINCE    |    INFO     |
+--------------+-------------------+-------+------------+-------------+
| 10.2.7.200   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.202   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.203   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.204   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.205   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.206   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.207   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.208   | node-to-node mesh | up    | 2020-04-15 | Established |
| 10.2.7.209   | node-to-node mesh | up    | 2020-04-15 | Established |
+--------------+-------------------+-------+------------+-------------+

IPv6 BGP status
No IPv6 peers found.

4、修改 /etc/calico/calicoctl.cfg 后，宿主机 k8s02 也能使用 calicoctl get node 命令。所以宿主机上 calicoctl get node 命令不能使用，是由于 etcdEndpoints 使用了主机名（感觉是个 bug，应为我在 /etc/hosts 中有添加 k8s02 的解析）

[root@k8s02 ~]#  calicoctl get node
NAME     
test01   
test02   
test03   
test04   
test05   
test06   
test07   
test08   
test09   
test10

参考文章：

calicoctl as a pod: Calico process is not running
Docker run参考(4) – PID设置(–pid)