k8s 删除master和etcd节点并重新加入

我会带着你远行 2022-11-12 02:57 758阅读 0赞

目前master集群有3个master节点，其中一个要更换。

# 删除主节点 #

在master1上执行如下命令

# kubectl drain master2 --delete-local-data --force --ignore-daemonsets
    node/master2 already cordoned
    WARNING: ignoring DaemonSet-managed Pods: kube-system/calico-node-xcqp8, kube-system/kube-proxy-spclw, nginx-ingress/nginx-ingress-4g5x7
    node/master2 drained
    # kubectl delete node master2
    node "master2" deleted
    # kubectl get nodes
    NAME      STATUS   ROLES    AGE    VERSION
    master1   Ready    master   203d   v1.18.2
    master3   Ready    master   203d   v1.18.2
    work1     Ready    <none>   203d   v1.18.2
    work2     Ready    <none>   203d   v1.18.2
    work4     Ready    <none>   146d   v1.18.2

# 删除失效的etcd #

先查看etcd节点列表：

# etcdctl --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/peer.crt --key=/etc/kubernetes/pki/etcd/peer.key member list
    ce2375f7f5372dd, started, k8s-03, https://192.168.1.163:2380, https://192.168.1.163:2379, false
    a7ea2df634f83903, started, k8s-01, https://192.168.1.161:2380, https://192.168.1.161:2379, false
    e9bf809f71d89665, started, k8s-02, https://192.168.1.162:2380, https://192.168.1.162:2379, false

删除失效的etcd节点

#etcdctl --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/peer.crt --key=/etc/kubernetes/pki/etcd/peer.key member remove ce2375f7f5372dd
    Member  ce2375f7f5372dd removed from cluster ea8fc1908cb9f1ee

# master2节点重新加入master集群 #

需要在master1上重新生成相关的证书和token

# kubeadm init phase upload-certs --upload-certs
    I1203 20:05:19.588980   10742 version.go:252] remote version is much newer: v1.19.4; falling back to: stable-1.18
    W1203 20:05:20.625646   10742 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
    [upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
    [upload-certs] Using certificate key:
    322175270bfde7b12f18c933ead856c7c7a9a666d596e8d48e7650c1cab20a56
    
    # kubeadm token create --print-join-command
    W1203 20:05:24.335760   10874 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
    kubeadm join apiserver-lb:6443 --token o0d4f9.p7hrqt9nx3pyyfg4     --discovery-token-ca-cert-hash sha256:1f084d1ac878308635f1dbe8676bac33fe3df6d52fa212834787a0bc71f1db6d

> 注意：  
> 每次添加都要重新完整执行上面的命令，不然etcd无法启动。

在master2上执行初始化和加入master集群的命令

# kubeadm join apiserver-lb:6443 --token o0d4f9.p7hrqt9nx3pyyfg4 --discovery-token-ca-cert-hash sha256:1f084d1ac878308635f1dbe8676bac33fe3df6d52fa212834787a0bc71f1db6d --control-plane --certificate-key 322175270bfde7b12f18c933ead856c7c7a9a666d596e8d48e7650c1cab20a56