kubeSphere+kubernetes 集群更新证书
模拟问题点
使用kubernetes时错误提示
yang@master:~$ kubectl get nodes
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-10-25T09:04:19+08:00 is after 2022-09-25T08:17:20Z
解决办法：
一、查看证书过期时间
yang@master:~$ sudo kubeadm certs check-expiration [sudo] password for yang: [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' W1027 09:27:32.225497 46147 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.233.0.10]; the provided value is: [169.254.25.10] CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Oct 25, 2023 08:17 UTC 363d ca no apiserver Oct 25, 2023 08:17 UTC 363d ca no apiserver-kubelet-client Oct 25, 2023 08:17 UTC 363d ca no controller-manager.conf Oct 25, 2023 08:17 UTC 363d ca no front-proxy-client Oct 25, 2023 08:17 UTC 363d front-proxy-ca no scheduler.conf Oct 25, 2023 08:17 UTC 363d ca no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Oct 22, 2032 08:17 UTC 9y no front-proxy-ca Oct 22, 2032 08:17 UTC 9y no
二、备份现有证书和重新生成新证书
1.备份现有证书
yang@master:~$ ll /etc/kubernetes/ total 292 drwxr-xr-x 5 kube root 4096 Oct 25 16:18 ./ drwxr-xr-x 101 root root 4096 Oct 26 10:38 ../ drwxrwxr-x 2 kube root 4096 Oct 25 16:18 addons/ -rw------- 1 kube root 5659 Oct 25 16:17 admin.conf -rw------- 1 kube root 5681 Oct 25 16:17 controller-manager.conf -rw-r--r-- 1 kube root 925 Oct 25 16:18 coredns-svc.yaml -rw-r--r-- 1 kube root 2670 Oct 25 16:17 kubeadm-config.yaml -rw------- 1 kube root 1979 Oct 25 16:18 kubelet.conf drwxr-xr-x 2 kube root 4096 Oct 25 16:17 manifests/ -rw-r--r-- 1 kube root 230001 Oct 25 16:18 network-plugin.yaml -rw-r--r-- 1 kube root 1040 Oct 25 16:18 nodelocaldnsConfigmap.yaml -rw-r--r-- 1 kube root 2775 Oct 25 16:18 nodelocaldns.yaml drwxr-xr-x 2 kube root 4096 Oct 25 16:17 pki/ -rw------- 1 kube root 5633 Oct 25 16:17 scheduler.conf yang@master:/home$ sudo mkdir config-back yang@master:/home$ sudo cp -a /etc/kubenetes/ /home/config-back/ yang@master:~$ ll /home/config-back/kubernetes/ total 292 drwxr-xr-x 5 kube root 4096 Oct 25 16:18 ./ drwxr-xr-x 3 root root 4096 Oct 27 09:29 ../ drwxrwxr-x 2 kube root 4096 Oct 25 16:18 addons/ -rw------- 1 kube root 5659 Oct 25 16:17 admin.conf -rw------- 1 kube root 5681 Oct 25 16:17 controller-manager.conf -rw-r--r-- 1 kube root 925 Oct 25 16:18 coredns-svc.yaml -rw-r--r-- 1 kube root 2670 Oct 25 16:17 kubeadm-config.yaml -rw------- 1 kube root 1979 Oct 25 16:18 kubelet.conf drwxr-xr-x 2 kube root 4096 Oct 25 16:17 manifests/ -rw-r--r-- 1 kube root 230001 Oct 25 16:18 network-plugin.yaml -rw-r--r-- 1 kube root 1040 Oct 25 16:18 nodelocaldnsConfigmap.yaml -rw-r--r-- 1 kube root 2775 Oct 25 16:18 nodelocaldns.yaml drwxr-xr-x 2 kube root 4096 Oct 25 16:17 pki/ -rw------- 1 kube root 5633 Oct 25 16:17 scheduler.conf
2.生成新证书
yang@master:~$ sudo kubeadm certs renew all [renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' W1027 09:29:53.913902 49108 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.233.0.10]; the provided value is: [169.254.25.10] certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
三、查看证书有效期
yang@master:~$ sudo kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' W1027 09:31:31.191076 51350 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.233.0.10]; the provided value is: [169.254.25.10] CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Oct 27, 2023 01:29 UTC 364d ca no apiserver Oct 27, 2023 01:29 UTC 364d ca no apiserver-kubelet-client Oct 27, 2023 01:29 UTC 364d ca no controller-manager.conf Oct 27, 2023 01:29 UTC 364d ca no front-proxy-client Oct 27, 2023 01:29 UTC 364d front-proxy-ca no scheduler.conf Oct 27, 2023 01:29 UTC 364d ca no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Oct 22, 2032 08:17 UTC 9y no front-proxy-ca Oct 22, 2032 08:17 UTC 9y no
四、新证书替换老的证书凭证
yang@master:~$ sudo cp -a ~/.kube/config /home/config-back/ yang@master:~$ sudo cp /etc/kubernetes/admin.conf ~/.kube/config
五、查看集群状态
yang@master:~$ kubectl get nodes NAME STATUS ROLES AGE VERSION master Ready control-plane,master,worker 41h v1.22.10 node Ready worker 39h v1.22.10
