kubernetes集群证书更新 以下方案通过第二种方法模拟集群证书过期 准备 Master节点： 先生成集群配置文件 修改时间让集群过期 更新证书 注意同步配置文件： 总结
kubeadm 默认证书为一年，一年过期后，会导致api service不可用，使用过程中会出现：x509: certificate has expired or is not yet valid.
方案一 通过修改kubeadm 调整证书过期时间
修改代码，调整过期时间
方案二 通过自动轮换证书默认开启
准备
本次集群版本1.15
备份集群证书（略)
cd /etc/kubernetes
tar czvf kubernetes.tar.gz kubernetes
Master节点：
[root@k8s-master .kube]# hwclock --show 2020年01月21日 星期二 15时16分34秒 -0.856601 秒 [root@k8s-master .kube]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master Ready master 167d v1.15.0 k8s-node1 Ready node 166d v1.15.0 [root@k8s-master .kube]# kubeadm alpha certs check-expiration CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED admin.conf Jan 20, 2021 07:09 UTC 364d no apiserver Jan 20, 2021 07:09 UTC 364d no apiserver-etcd-client Jan 20, 2021 07:09 UTC 364d no apiserver-kubelet-client Jan 20, 2021 07:09 UTC 364d no controller-manager.conf Jan 20, 2021 07:09 UTC 364d no etcd-healthcheck-client Jan 20, 2021 07:09 UTC 364d no etcd-peer Jan 20, 2021 07:09 UTC 364d no etcd-server Jan 20, 2021 07:09 UTC 364d no front-proxy-client Jan 20, 2021 07:09 UTC 364d no scheduler.conf Jan 20, 2021 07:09 UTC 364d no [root@k8s-master .kube]#
先生成集群配置文件
kubeadm config view > /root/kubeadm.yaml
要提前备份一下集群配置文件,当集群证书过期后 此命令也不能执行了
修改时间让集群过期
[root@k8s-master .kube]# date -s "2021-08-08" 2021年 08月 08日 星期日 00:00:00 CST [root@k8s-master .kube]# date 2021年 08月 08日 星期日 00:00:02 CST [root@k8s-master .kube]# kubectl get nodes Unable to connect to the server: x509: certificate has expired or is not yet valid [root@k8s-master .kube]#
更新证书
[root@k8s-master ~]# kubeadm alpha certs renew all --config=/root/kubeadm.yaml certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healtcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed [root@k8s-master ~]# kubeadm alpha certs check-expiration CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED admin.conf Aug 07, 2022 16:02 UTC 364d no apiserver Aug 07, 2022 16:02 UTC 364d no apiserver-etcd-client Aug 07, 2022 16:02 UTC 364d no apiserver-kubelet-client Aug 07, 2022 16:02 UTC 364d no controller-manager.conf Aug 07, 2022 16:02 UTC 364d no etcd-healthcheck-client Aug 07, 2022 16:02 UTC 364d no etcd-peer Aug 07, 2022 16:02 UTC 364d no etcd-server Aug 07, 2022 16:02 UTC 364d no front-proxy-client Aug 07, 2022 16:02 UTC 364d no scheduler.conf Aug 07, 2022 16:02 UTC 364d no
重启master节点三个容器：
[root@k8s-master .kube]# docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd'|xargs docker restart 98257170f1fb k8s_kube-apiserver_kube-apiserver-k8s-master_kube-system_db9cf46161351d3a7f76537093caa0b8_10 82c07f5d9b6f k8s_etcd_etcd-k8s-master_kube-system_2da345f314df09b06ba8257f5457dbed_6 Error response from daemon: No such container: 201c7a840312 Error response from daemon: No such container: kube-apiserver --ad… Error response from daemon: No such container: 18 Error response from daemon: No such container: months Error response from daemon: No such container: ago Error response from daemon: No such container: Up Error response from daemon: No such container: 18 Error response from daemon: No such container: months Error response from daemon: No such container: 2c4adeb21b4f Error response from daemon: No such container: etcd --advertise-cl… Error response from daemon: No such container: 18 Error response from daemon: No such container: months Error response from daemon: No such container: ago Error response from daemon: No such container: Up Error response from daemon: No such container: 18 Error response from daemon: No such container: months [root@k8s-master .kube]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master Ready master 2y1d v1.15.0 k8s-node1 Ready node 2y1d v1.15.0 [root@k8s-master .kube]# date 2021年 08月 08日 星期日 00:04:33 CST [root@k8s-master .kube]#
注意同步配置文件：
cp /etc/kubernetes/admin.conf /root/.kube/config
删除.kube下的缓存目录
总结
当集群证书过期时操作步骤：
1.提前备份集群配置文件
kubeadm config view > /root/kubeadm.yaml
2.更新集群证书
kubeadm alpha certs renew all --config=/root/kubeadm.yaml
3.同步配置文件，清除.kube下缓存
cp /etc/kubernetes/admin.conf /root/.kube/config