kubernetes实战(十七)：k8s证书过期处理

1、说明

 ???一般正常安装k8s集群，集群证书的有效期是一年，包括以下证书： ???- apiserver ???- apiserver-kubelet-client ???- apiserver-etcd-client ???- front-proxy-client ???- etcd/server ???- etcd/peer ???- etcd/healthcheck-client

2、证书过期问题解决办法

对于手动生成的证书

 ???手动安装过程中，只需指定证书的过期时间为N天即可

对于kubeadm

 ???方式一：升级K8S集群，自动更新证书 ???方式二：修改kubeadm并重新编译 ???方式三：重新生成证书

3、过期处理

报错信息

 ???[root@k8s-master03 ~]# kubectl get po ???Unable to connect to the server: x509: certificate has expired or is not yet valid

日志信息

 ???The currently active client certificate has expired, but the server is not responsive. A restart may be necessary to retrieve new initial credentials.

证书备份

 ???cp -rp /etc/kubernetes /etc/kubernetes.bak

apiserver证书

 ???[root@k8s-master03 ~]# rm -f /etc/kubernetes/pki/apiserver*

front-proxy-client证书

 ???[root@k8s-master03 ~]# rm -f /etc/kubernetes/pki/front-proxy-client.*

etcd证书

 ???rm -rf /etc/kubernetes/pki/etcd/healthcheck-client.* ???rm -rf /etc/kubernetes/pki/etcd/server.* ???rm -rf /etc/kubernetes/pki/etcd/peer.*

重新生成证书

[root@k8s-master02 ~]# /opt/kubeadm alpha phase certs all --config kubeadm-config.yaml [certificates] Generated apiserver-kubelet-client certificate and key.[certificates] Generated apiserver certificate and key.[certificates] apiserver serving cert is signed for DNS names [k8s-master02 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local k8s-master01 k8s-master02 k8s-master03 k8s-master-lb] and IPs [10.96.0.1 192.168.20.21 192.168.20.10 192.168.20.20 192.168.20.21 192.168.20.22 192.168.20.10][certificates] Generated front-proxy-client certificate and key.[certificates] Generated etcd/healthcheck-client certificate and key.[certificates] Generated apiserver-etcd-client certificate and key.[certificates] Generated etcd/server certificate and key.[certificates] etcd/server serving cert is signed for DNS names [k8s-master02 localhost k8s-master02] and IPs [127.0.0.1 ::1 192.168.20.21][certificates] Generated etcd/peer certificate and key.[certificates] etcd/peer serving cert is signed for DNS names [k8s-master02 localhost k8s-master02] and IPs [192.168.20.21 127.0.0.1 ::1 192.168.20.21][certificates] valid certificates and keys now exist in "/etc/kubernetes/pki"[certificates] Using the existing sa key.

重新生成配置文件

[root@k8s-master02 ~]# mv /etc/kubernetes/admin.conf ??????????????kubelet.conf ????????????pki/ ????????????????????scheduler.confcontroller-manager.conf ?manifests/ ??????????????pki.bak/ ????????????????tmp/[root@k8s-master02 ~]# mv /etc/kubernetes/*.conf /tmp/[root@k8s-master02 ~]# /opt/kubeadm alpha phase kubeconfig all --config kubeadm-config.yaml [endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"

重启kubelet

 ???[root@k8s-master01 ~]# systemctl restart kubelet

4、集群确认

证书过期时间确认

 ???# 注意：cfssl需要自行安装 ???[root@k8s-master01 ~]# cfssl-certinfo -cert /etc/kubernetes/pki/etcd/server.crt | grep not ?????"not_before": "2018-11-30T07:45:08Z", ?????"not_after": "2117-11-16T06:07:00Z",

集群状态确认

 ???[root@k8s-master01 ~]# kubectl get no ???NAME ??????????STATUS ??ROLES ???AGE ????VERSION ???k8s-master01 ??Ready ???master ??6d22h ??v1.12.3 ???k8s-master02 ??Ready ???master ??6d22h ??v1.12.3 ???k8s-master03 ??Ready ???master ??6d22h ??v1.12.3 ???k8s-node01 ????Ready ???<none> ??6d21h ??v1.12.3 ???k8s-node02 ????Ready ???<none> ??6d21h ??v1.12.3

kubernetes实战(十七)：k8s证书过期处理

原文地址：https://www.cnblogs.com/dukuan/p/10081804.html