如何处理 Kubeadm 搭建的集群证书过期问题 |
您所在的位置：网站首页 › kubeadmin 安装k8s 证书问题 › 如何处理 Kubeadm 搭建的集群证书过期问题 |
|
推荐阅读
Helm3（K8S 资源对象管理工具）视频教程：https://edu.csdn.net/course/detail/32506
Helm3（K8S 资源对象管理工具）博客专栏：https://blog.csdn.net/xzk9381/category_10895812.html
本文原文链接：https://blog.csdn.net/xzk9381/article/details/109535894，转载请注明出处。如有发现文章中的任何问题，欢迎评论区留言。 Kubeadm 证书过期处理以下内容参考了如下链接：https://www.cnblogs.com/skymyyang/p/11093686.html 一、处理证书已过期的集群使用 kubeadm 搭建的集群，默认证书有效期是 1 年。如果没有在证书过期前续期，那么集群会无法运行，使用的过程中会报如下错误： x509: certificate has expired or is not yet valid. 查看当前 kubeadm 搭建的集群证书有效期信息，命令如下： [@master74-53 ~]# for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done /etc/kubernetes/pki/apiserver.crt Not Before: Oct 24 03:10:01 2019 GMT Not After : Oct 23 03:10:01 2020 GMT ----------- /etc/kubernetes/pki/apiserver-etcd-client.crt Not Before: Oct 24 03:10:03 2019 GMT Not After : Oct 23 03:10:04 2020 GMT ----------- /etc/kubernetes/pki/apiserver-kubelet-client.crt Not Before: Oct 24 03:10:01 2019 GMT Not After : Oct 23 03:10:02 2020 GMT ----------- /etc/kubernetes/pki/ca.crt Not Before: Oct 24 03:10:01 2019 GMT Not After : Oct 21 03:10:01 2029 GMT ----------- /etc/kubernetes/pki/front-proxy-ca.crt Not Before: Oct 24 03:10:02 2019 GMT Not After : Oct 21 03:10:02 2029 GMT ----------- /etc/kubernetes/pki/front-proxy-client.crt Not Before: Oct 24 03:10:02 2019 GMT Not After : Oct 23 03:10:03 2020 GMT -----------可以看到证书的有效期是截止到 2020 年 10 月份，在证书过期后，使用如下步骤进行处理。 1. 针对 kubeadm 1.13.x 及以上版本首先在服务器上创建一个 kubeadm.yaml 的文件，内容如下： apiVersion: kubeadm.k8s.io/v1beta1 kind: ClusterConfiguration kubernetesVersion: v1.16.2 # 这里修改成集群对应的版本 imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers #这里使用国内的镜像仓库，否则在重新签发的时候会报错：could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt"将 /etc/kubernetes/pki 中的证书文件进行备份，然后使用如下命令重新生成证书： [@master74-53 /opt]# kubeadm alpha certs renew all --config=/opt/kubeadm.yaml certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed运行命令后后重新生成如下证书文件： #-- /etc/kubernetes/pki/apiserver.key #-- /etc/kubernetes/pki/apiserver.crt #-- /etc/kubernetes/pki/apiserver-etcd-client.key #-- /etc/kubernetes/pki/apiserver-etcd-client.crt #-- /etc/kubernetes/pki/apiserver-kubelet-client.key #-- /etc/kubernetes/pki/apiserver-kubelet-client.crt #-- /etc/kubernetes/pki/front-proxy-client.key #-- /etc/kubernetes/pki/front-proxy-client.crt #-- /etc/kubernetes/pki/etcd/healthcheck-client.key #-- /etc/kubernetes/pki/etcd/healthcheck-client.crt #-- /etc/kubernetes/pki/etcd/peer.key #-- /etc/kubernetes/pki/etcd/peer.crt #-- /etc/kubernetes/pki/etcd/server.key #-- /etc/kubernetes/pki/etcd/server.crt查看新生成的证书有效期： [@master74-53 /opt]# for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done /etc/kubernetes/pki/apiserver.crt Not Before: Oct 24 03:10:01 2019 GMT Not After : Oct 26 06:41:43 2021 GMT ----------- /etc/kubernetes/pki/apiserver-etcd-client.crt Not Before: Oct 24 03:10:03 2019 GMT Not After : Oct 26 06:41:44 2021 GMT ----------- /etc/kubernetes/pki/apiserver-kubelet-client.crt Not Before: Oct 24 03:10:01 2019 GMT Not After : Oct 26 06:41:44 2021 GMT ----------- /etc/kubernetes/pki/ca.crt Not Before: Oct 24 03:10:01 2019 GMT Not After : Oct 21 03:10:01 2029 GMT ----------- /etc/kubernetes/pki/front-proxy-ca.crt Not Before: Oct 24 03:10:02 2019 GMT Not After : Oct 21 03:10:02 2029 GMT ----------- /etc/kubernetes/pki/front-proxy-client.crt Not Before: Oct 24 03:10:02 2019 GMT Not After : Oct 26 06:41:46 2021 GMT -----------使用如下命令重新生成 kubeconfig 文件，否则 kubectl 将无法使用： kubeadm init phase kubeconfig all然后将新生成的文件拷贝到 ${HOME}/.kube 目录下并重命名为 config： cp -pr /etc/kubernetes/admin.conf /root/.kube/config重启 apiserver、kube-controller、kube-scheduler、etcd 容器即可。 本文原文链接：https://blog.csdn.net/xzk9381/article/details/109535894，转载请注明出处。如有发现文章中的任何问题，欢迎评论区留言。 |
今日新闻 |
推荐新闻 |
| CopyRight 2018-2019 办公设备维修网 版权所有 豫ICP备15022753号-3 |