问题排查：
kubectl describe pods xxx
显示 Error syncing pod, skipping: failed to “StartContainer” for “POD” with ErrImagePull: “image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request. details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)”
ll -h /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt 显示指向 /etc/rhsm/ca/redhat-uep.pem
/etc/rhsm/ca/redhat-uep.pem 不存在导致问题

解决问题：
网上解决方案 yum install python-rhsm-certificates 现在失效了 Package python-rhsm-certificates-1.19.10-1.el7_4.x86_64 is obsoleted by subscription-manager-rhsm-certificates-1.20.11-1.el7.centos.x86_64 which is already installed
需要手动下载和生成pem
wget http://mirror.centos.org/centos/7/os/x86_64/Packages/python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm
rpm2cpio python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm | cpio -iv –to-stdout ./etc/rhsm/ca/redhat-uep.pem | tee /etc/rhsm/ca/redhat-uep.pem