【K8s】专题十一：Kubernetes 集群证书过期处理方法

以下内容均来自个人笔记并重新梳理，如有错误欢迎指正！如果对您有帮助，烦请点赞、关注、转发、订阅专栏！欢迎扫码关注个人公众号，不定期推送热点文章！

---

目录

一、背景介绍

二、处理过程

1、备份证书

2、检测证书

3、更新证书

4、更新 Kubeconfig

5、重启服务

6、验证效果

---

一、背景介绍

使用 kubeadm 安装的 Kubernetes 集群，运行一段时间后执行 kubectl 命令突然出现以下报错：

Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2023-09-22T15:05:09+08:00 is after 2023-09-20T04:04:02Z

报错原因是 Kubernetes 集群证书已经过期（默认有效期 365 天），处理方法是对 Kubernetes 集群证书进行更新以重置有效期，本文将介绍具体处理过程。

---

二、处理过程

1、备份证书

cd /etc/kubernetes && mv pki pki-old

2、检测证书

# kubeadm 20 之前的版本使用本命令
kubeadm alpha certs check-expiration

# kubeadm 20 之后的版本使用本命令
kubeadm certs check-expiration

🔔 输出示例如下：
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Aug 02, 2025 07:24 UTC   358d            ca                      no      
apiserver                  Aug 02, 2025 07:24 UTC   358d            ca                      no      
apiserver-etcd-client      Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
apiserver-kubelet-client   Aug 02, 2025 07:24 UTC   358d            ca                      no      
controller-manager.conf    Aug 02, 2025 07:24 UTC   358d            ca                      no      
etcd-healthcheck-client    Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
etcd-peer                  Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
etcd-server                Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
front-proxy-client         Aug 02, 2025 07:24 UTC   358d            front-proxy-ca          no      
scheduler.conf             Aug 02, 2025 07:24 UTC   358d            ca                      no      
super-admin.conf           Aug 02, 2025 07:24 UTC   358d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 31, 2034 07:24 UTC   9y              no      
etcd-ca                 Jul 31, 2034 07:24 UTC   9y              no      
front-proxy-ca          Jul 31, 2034 07:24 UTC   9y              no

3、更新证书

# kubeadm 20 之前的版本使用本命令
kubeadm alpha certs renew all

# kubeadm 20 之后的版本使用本命令
kubeadm certs renew all

🔔 有效期将被重置为 365 天
🔔 输出示例如下：
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
certificate embedded in the kubeconfig file for the super-admin renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

4、更新 Kubeconfig

cd ～/.kube && mv config config-bak
yes | cp /etc/kubernetes/admin.conf config

🔔 若不更新 Kubeconfig，执行 kubectl 命令会出现报错：error: You must be logged in to the server (Unauthorized)

5、重启服务

# 重启 kubelet 服务
systemctl restart kubelet

# 重启 kube-apiserver、kube-controller-manage、kube-scheduler 容器
docker ps | grep kube-apiserver | grep -v pause | awk '{print $1}' | xargs -i docker restart {}
docker ps | grep kube-controller-manage | grep -v pause | awk '{print $1}' | xargs -i docker restart {}
docker ps | grep kube-scheduler | grep -v pause | awk '{print $1}' | xargs -i docker restart {}

🔔 使用 kubeadm 安装的集群，Master 节点的核心组件都是以静态 Pod 的方式运行的，因此重启服务可以采用重启对应容器的方式

6、验证效果

通过执行 kubectl  命令或检测证书，验证集群证书是否更新成功。