《Kubernetes证书篇：kubernetes1.14.3证书时间过期》

青旅半醒 2023-01-14 01:43 170阅读 0赞

### 文章目录 ###

*  前言
 *  一、报错信息
 *  二、查看证书过期时间
 *  三、备份证书
 *  四、更新证书
 *   *  4.1、场景一：证书还未过期更新
     *  4.1、场景二：证书已经过期更新
 *  五、重启服务
 *  六、查看证书过期时间
 *  总结：整理不易，如果对你有帮助，可否点赞关注一下？

--------------------

# 前言 #

**说明：kubernetes证书过期处理流程适用于单master或多master的kubeadm安装部署方式。**

--------------------

# 一、报错信息 #

**如下图所示：**  
![在这里插入图片描述][20210419155525760.png]  
**说明：如上图报错则表明kubernetes证书过期了，需要重新续签证书。**

--------------------

# 二、查看证书过期时间 #

find /etc/kubernetes/pki -name "*.crt"|xargs -I{ } openssl x509 -in { } -noout -dates|grep notAfter

**如下图所示：**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3ODE0MTEy_size_16_color_FFFFFF_t_70]

--------------------

# 三、备份证书 #

cp -r /etc/kubernetes /etc/kubernetes.bak

--------------------

# 四、更新证书 #

## 4.1、场景一：证书还未过期更新 ##

**说明：由于做了kubernetes证书监控，证书还有10天过期，这个时候可以在kubernetes集群出现问题之前手动更新证书。**

# 1、生产配置文件
    kubeadm config view  > kubeadm-config.yaml
    
    # 2、更新证书
    kubeadm alpha certs renew all --config kubeadm-config.yaml
    kubeadm alpha kubeconfig user --client-name=admin
    kubeadm alpha kubeconfig user --org system:masters --client-name kubernetes-admin  > /etc/kubernetes/admin.conf
    kubeadm alpha kubeconfig user --client-name system:kube-controller-manager > /etc/kubernetes/controller-manager.conf
    kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) > /etc/kubernetes/kubelet.conf
    kubeadm alpha kubeconfig user --client-name system:kube-scheduler > /etc/kubernetes/scheduler.conf 
    
    # 3、复制证书
    mv ~/.kube ~/.kube.bak
    mkdir ~/.kube
    cp /etc/kubernetes/admin.conf ~/.kube/config

--------------------

## 4.1、场景二：证书已经过期更新 ##

**说明：由于未做kubernetes证书监控或者做了kubernetes证书监控未及时处理，导致集群不可用。**

# 1、配置文件
    找到kubeadm-config.yaml文件所在文件，这里路径为 /data/pkgs/kubernete-tools/install-kubernetes
    
    # 2、更新证书
    kubeadm alpha certs renew all --config /data/pkgs/kubernete-tools/install-kubernetes/kubeadm-config.yaml
    kubeadm alpha kubeconfig user --client-name=admin
    kubeadm alpha kubeconfig user --org system:masters --client-name kubernetes-admin  > /etc/kubernetes/admin.conf
    kubeadm alpha kubeconfig user --client-name system:kube-controller-manager > /etc/kubernetes/controller-manager.conf
    kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) > /etc/kubernetes/kubelet.conf
    kubeadm alpha kubeconfig user --client-name system:kube-scheduler > /etc/kubernetes/scheduler.conf 
    
    # 2、复制证书
    mv ~/.kube ~/.kube.bak
    mkdir ~/.kube
    cp /etc/kubernetes/admin.conf ~/.kube/config

--------------------

# 五、重启服务 #

docker restart $(docker ps | grep kube-apiserver | grep pause |awk '{print $1}')
    docker restart $(docker ps | grep kube-apiserver | grep -v pause |awk '{print $1}')
    systemctl restart kubelet.service

--------------------

# 六、查看证书过期时间 #

find /etc/kubernetes/pki -name "*.crt"|xargs -I{ } openssl x509 -in { } -noout -dates|grep notAfter

**如下图所示：**  
![在这里插入图片描述][20210420093030123.png]  
**说明：上图中表明证书已经更新完成，如果有多台master，需要执行上述操作。**

**下一章将介绍：[《Kubernets证书篇：kubernetes1.17.4证书时间过期》][Kubernets_kubernetes1.17.4]**

--------------------

# 总结：整理不易，如果对你有帮助，可否点赞关注一下？ #

更多详细内容请参考：[企业级K8s集群运维实战][K8s]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3ODE0MTEy_size_16_color_FFFFFF_t_70 1]

[20210419155525760.png]: /images/20221022/09dd8567eefc419b9e2111f7478c2f07.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3ODE0MTEy_size_16_color_FFFFFF_t_70]: /images/20221022/d468cc669f2d4071a7718eea8e5a916f.png
[20210420093030123.png]: /images/20221022/6e663cb8b66c4668ad3b5988e4045cc7.png
[Kubernets_kubernetes1.17.4]: https://blog.csdn.net/m0_37814112/article/details/115866690?spm=1001.2014.3001.5501
[K8s]: https://blog.csdn.net/m0_37814112/category_10856504.html?spm=1001.2014.3001.5482
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3ODE0MTEy_size_16_color_FFFFFF_t_70 1]: /images/20221022/89cc9a5d6318489c8050d91e98aaff61.png