kubernetes 1.15版本之后，官方文檔有證書過期方式
但是1.14版本及以前的劫乱，更新證書經(jīng)常出現(xiàn)問題，現(xiàn)在整理一下
1 查看證書過期時(shí)間
find /etc/kubernetes/pki -name "*.crt"|xargs -I{} openssl x509 -in {} -noout -dates|grep notAfter
2 備份證書
cp -r /etc/kubernetes /etc/kubernetes.bak
3 更新證書
3.1 更新證書
kubeadm config view > cluster.yaml
kubeadm alpha certs renew all --config cluster.yaml
kubeadm alpha kubeconfig user --client-name=admin
kubeadm alpha kubeconfig user --org system:masters --client-name kubernetes-admin > /etc/kubernetes/admin.conf
kubeadm alpha kubeconfig user --client-name system:kube-controller-manager > /etc/kubernetes/controller-manager.conf
kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) > /etc/kubernetes/kubelet.conf
kubeadm alpha kubeconfig user --client-name system:kube-scheduler > /etc/kubernetes/scheduler.conf
3.2 copy證書
mv ~/.kube ~/.kube.bak
mkdir ~/.kube
cp /etc/kubernetes/admin.conf ~/.kube/config
3.3 重啟apiserver容器
docker restart $(docker ps | grep kube-apiserver | grep pause |awk '{print $1}')
docker restart $(docker ps | grep kube-apiserver | grep -v pause |awk '{print $1}')
systemctl restart kubelet.service
證書更新成功
4 如果是多臺master
需要在每個(gè)master上面執(zhí)行上面的步驟
