重置csr
注意：下面操作仅在刚安装k8s后24小时内有效
分析：kubelet启动后会生成如下文件。kubelet.conf文件决定了csr的存在，如果要想重新获取csr,可以停掉kubelet，删除kubelet.conf文件，重启kubelet就可以获得csr
ls -l /etc/kubernetes/kubelet.conf
ls -l /etc/kubernetes/pki/kubelet*
[root@test2 ~]# ls -l /etc/kubernetes/kubelet.conf
-rw------- 1 root root 2295 Jan 22 10:07 /etc/kubernetes/kubelet.conf
[root@test2 ~]# ls -l /etc/kubernetes/pki/kubelet*
-rw------- 1 root root 1273 Jan 22 10:07 /etc/kubernetes/pki/kubelet-client-2019-01-22-10-07-06.pem
lrwxrwxrwx 1 root root 58 Jan 22 10:07 /etc/kubernetes/pki/kubelet-client-current.pem -> /etc/kubernetes/pki/kubelet-client-2019-01-22-10-07-06.pem
-rw-r--r-- 1 root root 2181 Jan 22 02:10 /etc/kubernetes/pki/kubelet.crt
-rw------- 1 root root 1675 Jan 22 02:10 /etc/kubernetes/pki/kubelet.key
查看目前所有csr
[root@test1 ~]# kubectl get csr
NAME AGE REQUESTOR CONDITION
node-csr-462w6AWPUkqlTnmKUT1gs6orq6WqBWaTO1XndyRA5co 55m kubelet-bootstrap Approved,Issued
node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY 28m kubelet-bootstrap Approved,Issued
删除node1节点csr
[root@test1 ~]# kubectl delete csr node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY
certificatesigningrequest.certificates.k8s.io "node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY" deleted
[root@test1 ~]# kubectl get csr
NAME AGE REQUESTOR CONDITION
node-csr-462w6AWPUkqlTnmKUT1gs6orq6WqBWaTO1XndyRA5co 57m kubelet-bootstrap Approved,Issued
停掉该节点的kubelet
[root@lab3 ~]# systemctl stop kubelet
删除该节点的kubelet.conf文件
[root@lab1 ~]# rm -rf /etc/kubernetes/kubelet.conf
重启该节点的kubelet
[root@lab1 ~]# systemctl restart kubelet
查看csr
[root@test1 kubernetes]# kubectl get csr
NAME AGE REQUESTOR CONDITION
node-csr-462w6AWPUkqlTnmKUT1gs6orq6WqBWaTO1XndyRA5co 1h kubelet-bootstrap Approved,Issued
node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY 25s kubelet-bootstrap Pending
参照文档：
https://my.oschina.net/u/3390908/blog/1649764
