Linux运维笔记|自动化运维攻城狮
出现证书过期提示
certificate has expired or is not yet valid
查看k8s版本旧版本命令会有差异，可根据提示进行操作
[root@k8s-master-001 ~]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.9", GitCommit:"7a576bc3935a6b555e33346fd73ad77c925e9e4a", GitTreeState:"clean", BuildDate:"2021-07-15T21:00:30Z", GoVersion:"go1.15.14", Compiler:"gc", Platform:"linux/amd64"}
查看证书过期时间
[root@k8s-master-001 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Mar 31, 2022 03:32 UTC 364d no
apiserver Mar 31, 2022 03:32 UTC 364d ca no
apiserver-etcd-client Mar 31, 2022 03:32 UTC 364d etcd-ca no
apiserver-kubelet-client Mar 31, 2022 03:32 UTC 364d ca no
controller-manager.conf Mar 31, 2022 03:32 UTC 364d no
etcd-healthcheck-client Mar 31, 2022 03:32 UTC 364d etcd-ca no
etcd-peer Mar 31, 2022 03:32 UTC 364d etcd-ca no
etcd-server Mar 31, 2022 03:32 UTC 364d etcd-ca no
front-proxy-client Mar 31, 2022 03:32 UTC 364d front-proxy-ca no
scheduler.conf Mar 31, 2022 03:32 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Mar 19, 2032 06:19 UTC 9y no
etcd-ca Mar 19, 2032 06:19 UTC 9y no
front-proxy-ca Mar 19, 2032 06:19 UTC 9y no
续订所有证书
[root@k8s-master-001 ~]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
嵌入在kubeconfig文件中，为k8s管理员使用kubeadm命令自身而服务的证书（这就告诉我们了一个道理：如果证书已经过期，本文所记述的命令可能自身都无法使用了）；
Kubernetes API的证书；
apiserver的证书，用来访问etcd；
API server的证书，用来连接kubelet；
嵌入在kubeconfig文件中，用于controller manager的使用；
liveness probes的证书，用来对etcd作health check；
etcd节点的证书，用来互相访问；
前端代理服务的证书；
嵌入在kubeconfig文件中，用于scheduler manager的使用。
重启相关服务
docker ps | grep -v pause | grep -E "etcd|scheduler|controller|apiserver" | awk '{print $1}' | awk '{print "docker","restart",$1}' | bash
查看证书是否获得更新
[root@k8s-master-001 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Mar 31, 2023 03:32 UTC 364d no
apiserver Mar 31, 2023 03:32 UTC 364d ca no
apiserver-etcd-client Mar 31, 2023 03:32 UTC 364d etcd-ca no
apiserver-kubelet-client Mar 31, 2023 03:32 UTC 364d ca no
controller-manager.conf Mar 31, 2023 03:32 UTC 364d no
etcd-healthcheck-client Mar 31, 2023 03:32 UTC 364d etcd-ca no
etcd-peer Mar 31, 2023 03:32 UTC 364d etcd-ca no
etcd-server Mar 31, 2023 03:32 UTC 364d etcd-ca no
front-proxy-client Mar 31, 2023 03:32 UTC 364d front-proxy-ca no
scheduler.conf Mar 31, 2023 03:32 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Mar 19, 2032 06:19 UTC 9y no
etcd-ca Mar 19, 2032 06:19 UTC 9y no
front-proxy-ca Mar 19, 2032 06:19 UTC 9y no