k8s手动续签证书

Aug 5, 2026 // 大蚊子

背景 kubectl命令就无法访问集群了——错误大概为：“certificate has expired or is not yet valid”。原因是k8s证书过期了 k8s版本1.23.4 以下操作均在master节点操作查看证书过期时间 kubeadm certs check-expiration gemfield@master:~$ sudo kubeadm certs check-expiration [sudo] password for gemfield: [check-expiration] Reading configuration from the cluster… [check-expiration] FYI: You can look at this config file with ‘kubectl -n kube-system get cm kubeadm-config -oyaml’ CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Jun 21, 2022 03:16 UTC 364d no apiserver Jun 21, 2022 03:16 UTC 364d ca no apiserver-etcd-client Jun 21, 2022 03:16 UTC 364d etcd-ca no apiserver-kubelet-client Jun 21, 2022 03:16 UTC 364d ca no controller-manager.conf Jun 21, 2022 03:16 UTC 364d no etcd-healthcheck-client Jun 21, 2022 03:16 UTC 364d etcd-ca no etcd-peer Jun 21, 2022 03:16 UTC 364d etcd-ca no etcd-server Jun 21, 2022 03:16 UTC 364d etcd-ca no front-proxy-client Jun 21, 2022 03:16 UTC 364d front-proxy-ca no scheduler.conf Jun 21, 2022 03:16 UTC 364d no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca May 04, 2030 12:14 UTC 8y no etcd-ca May 04, 2030 12:14 UTC 8y no front-proxy-ca May 04, 2030 12:14 UTC 8y no

备份所有证书及文件 cp -r /etc/kubernetes /etc/kubernetes_2022_old cp $HOME/.kube/config $HOME/.kube/config_bak_2022 续订所有证书登录k8s主节点使用kubeadm certs renew all命令： gemfield@master:~$ sudo kubeadm certs renew all [renew] Reading configuration from the cluster… [renew] FYI: You can look at this config file with ‘kubectl -n kube-system get cm kubeadm-config -oyaml’ certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed 这寥寥数行日志告诉我们，以下服务的证书获得了更新：嵌入在kubeconfig文件中，为k8s管理员使用kubeadm命令自身而服务的证书（这就告诉我们了一个道理：如果证书已经过期，本文所记述的命令可能自身都无法使用了）； Kubernetes API的证书； apiserver的证书，用来访问etcd； API server的证书，用来连接kubelet；嵌入在kubeconfig文件中，用于controller manager的使用； liveness probes的证书，用来对etcd作health check； etcd节点的证书，用来互相访问；

前端代理服务的证书；嵌入在kubeconfig文件中，用于scheduler manager的使用。查看证书是否获得更新还是使用kubeadm alpha certs check-expiration来查看证书过期时间是否更新： gemfield@master:~$ sudo kubeadm alpha certs check-expiration [check-expiration] Reading configuration from the cluster… [check-expiration] FYI: You can look at this config file with ‘kubectl -n kube-system get cm kubeadm-config -oyaml’ CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Jun 21, 2022 07:51 UTC 364d no apiserver Jun 21, 2022 07:51 UTC 364d ca no apiserver-etcd-client Jun 21, 2022 07:51 UTC 364d etcd-ca no apiserver-kubelet-client Jun 21, 2022 07:51 UTC 364d ca no controller-manager.conf Jun 21, 2022 07:51 UTC 364d no etcd-healthcheck-client Jun 21, 2022 07:51 UTC 364d etcd-ca no etcd-peer Jun 21, 2022 07:51 UTC 364d etcd-ca no etcd-server Jun 21, 2022 07:51 UTC 364d etcd-ca no front-proxy-client Jun 21, 2022 07:51 UTC 364d front-proxy-ca no scheduler.conf Jun 21, 2022 07:51 UTC 364d no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca May 04, 2030 12:14 UTC 8y no etcd-ca May 04, 2030 12:14 UTC 8y no front-proxy-ca May 04, 2030 12:14 UTC 8y no 重新生成配置文件此时可以重启kubelet查看是否可以使用，如果不可以则重新生成配置文件

#重新生成所有配置 kubeadm init phase kubeconfig all mv ~/.kube/config ~/.kube/config_bak cp /etc/kubernetes/admin.conf ~/.kube/config systemctl restart kubelet systemctl status kubelet // 重新生成 admin 配置文件 kubeadm init phase kubeconfig admin // 重新生成 kubelet 配置文件 kubeadm init phase kubeconfig kubelet kubectl get pod -A node节点处理将nodes节点上的/etc/kubernetes/kubelet.conf 替换成master节点上的 kubelet.conf 之后重启kubelet服务。 systemctl restart docker.service && systemctl restart kubelet.service 或者 node节点删除再加入