记录k8s证书过期的证书更新

root@master01:~# kubectl get nodes 
E0828 10:29:54.481489   47445 memcache.go:265] couldn't get current server API group list: Get "https://192.168.91.150:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z
E0828 10:29:54.490936   47445 memcache.go:265] couldn't get current server API group list: Get "https://192.168.91.150:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z
E0828 10:29:54.504782   47445 memcache.go:265] couldn't get current server API group list: Get "https://192.168.91.150:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z
E0828 10:29:54.521207   47445 memcache.go:265] couldn't get current server API group list: Get "https://192.168.91.150:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z
E0828 10:29:54.530188   47445 memcache.go:265] couldn't get current server API group list: Get "https://192.168.91.150:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z
Unable to connect to the server: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z

在master01节点执行kubectl get nodes 指令返回如下信息：

E0828 10:29:54.481489   47445 memcache.go:265] couldn't get current server API group list: Get "https://192.168.91.150:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-08-28T10:29:54+08:00 is after 2024-08-09T06:16:19Z

这段话的意思就是这个错误是因为证书已经过期或者尚未生效。当前时间是 2024 年 8 月 28 日 10:15:16，而证书的有效期截止到 2024 年 8 月 9 日 06:16:19。

查看证书有效期

root@master01:~# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Aug 09, 2024 06:16 UTC   <invalid>       ca                      no      
apiserver                  Aug 09, 2024 06:16 UTC   <invalid>       ca                      no      
apiserver-etcd-client      Aug 09, 2024 06:16 UTC   <invalid>       etcd-ca                 no      
apiserver-kubelet-client   Aug 09, 2024 06:16 UTC   <invalid>       ca                      no      
controller-manager.conf    Aug 09, 2024 06:16 UTC   <invalid>       ca                      no      
etcd-healthcheck-client    Aug 09, 2024 06:16 UTC   <invalid>       etcd-ca                 no      
etcd-peer                  Aug 09, 2024 06:16 UTC   <invalid>       etcd-ca                 no      
etcd-server                Aug 09, 2024 06:16 UTC   <invalid>       etcd-ca                 no      
front-proxy-client         Aug 09, 2024 06:16 UTC   <invalid>       front-proxy-ca          no      
scheduler.conf             Aug 09, 2024 06:16 UTC   <invalid>       ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Aug 07, 2033 06:16 UTC   8y              no      
etcd-ca                 Aug 07, 2033 06:16 UTC   8y              no      
front-proxy-ca          Aug 07, 2033 06:16 UTC   8y              no    

释义：
1.证书列表：列出了 Kubernetes 集群中使用的各种证书，包括管理员证书 (admin.conf)、API 服务器证书 (apiserver)、与 etcd 通信的证书 (apiserver-etcd-client)、kubelet 与 API 服务器通信的证书 (apiserver-kubelet-client) 等。
2.过期时间：每个证书都有一个预计的过期时间。例如，apiserver 证书将在 Aug 09, 2024 06:16 UTC 过期。
3.剩余时间：显示了每个证书的剩余有效期，但这里显示为 ，这可能意味着证书已经过期，或者在检查时遇到了问题。
4.证书颁发机构 (CA)：显示了哪个 CA 签名了该证书。例如，apiserver 证书由 ca 签名。
5.外部管理：指出证书是否由外部系统管理。这里的 no 表示这些证书不是由外部系统管理的。
6.证书颁发机构 (CA) 列表：显示了集群中的 CA 证书，包括主 CA (ca)、etcd 的 CA (etcd-ca) 和前端代理的 CA (front-proxy-ca)，以及它们的过期时间和剩余有效期。
7.错误信息：在检查开始时，有一个错误信息提示无法从集群读取配置，但命令回退到使用默认配置。
8.配置提示：提示如果需要查看或修改集群的 kubeadm 配置，可以使用 kubectl 命令查看或编辑 kube-system 命名空间下的 kubeadm-config 配置映射。
进入维护模式

kubectl cordon
kubectl drain master01 --ignore-daemonsets

更新证书有效期
1.备份证书

cp -r /etc/kubernetes/ /etc/kubernetes.old

2.更新证书

# 自动更新 Kubernetes 集群中所有自签名的证书
kubeadm certs renew all
# 仅更新指定的 组件 证书
kubeadm alpha certs renew apiserver

这里我的证书都过期了，所以全部更新

root@master01:~# kubeadm certs renew all 
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

更新 ~/.kube/config文件
~/.kube/config 文件是 Kubernetes 集群的配置文件，它通常用于存储集群的访问信息，包括 API 服务器地址、使用的上下文（context）、认证信息（如证书）等。这个文件允许用户通过 kubectl 命令行工具与 Kubernetes 集群进行交互。

root@master01:~# mv /root/.kube/config /root/.kube/config.old 
root@master01:~# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
root@master01:~# chown $(id -u):$(id -g) $HOME/.kube/config
root@master01:~# sudo chmod 644 $HOME/.kube/config

重启相关组件

# 如果你的集群使用的是 systemd 管理服务
sudo systemctl restart kubelet
# 对于独立运行的 etcd，使用以下命令
sudo systemctl restart etcd

验证

root@master01:~# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Aug 28, 2025 03:15 UTC   364d            ca                      no      
apiserver                  Aug 28, 2025 03:15 UTC   364d            ca                      no      
apiserver-etcd-client      Aug 28, 2025 03:15 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Aug 28, 2025 03:15 UTC   364d            ca                      no      
controller-manager.conf    Aug 28, 2025 03:15 UTC   364d            ca                      no      
etcd-healthcheck-client    Aug 28, 2025 03:15 UTC   364d            etcd-ca                 no      
etcd-peer                  Aug 28, 2025 03:15 UTC   364d            etcd-ca                 no      
etcd-server                Aug 28, 2025 03:15 UTC   364d            etcd-ca                 no      
front-proxy-client         Aug 28, 2025 03:15 UTC   364d            front-proxy-ca          no      
scheduler.conf             Aug 28, 2025 03:15 UTC   364d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Aug 07, 2033 06:16 UTC   8y              no      
etcd-ca                 Aug 07, 2033 06:16 UTC   8y              no      
front-proxy-ca          Aug 07, 2033 06:16 UTC   8y              no   

root@master01:~# kubectl get nodes
NAME       STATUS   ROLES           AGE    VERSION
master01   Ready    control-plane   383d   v1.27.0
node01     Ready    <none>          383d   v1.27.0
node02     Ready    <none>          383d   v1.27.0
root@master01:~# kubectl get pods --all-namespaces
NAMESPACE              NAME                                         READY   STATUS    RESTARTS   AGE
kube-system            calico-kube-controllers-5585f6d55d-qcpmb     1/1     Running   0          383d
kube-system            calico-node-b65lt                            1/1     Running   0          383d
kube-system            calico-node-c9bmn                            1/1     Running   0          383d
kube-system            calico-node-zzqj2                            1/1     Running   0          383d
kube-system            coredns-65dcc469f7-2pzxw                     1/1     Running   0          383d
kube-system            coredns-65dcc469f7-g8dbx                     1/1     Running   0          383d
kube-system            etcd-master01                                1/1     Running   0          383d
kube-system            kube-apiserver-master01                      1/1     Running   0          383d
kube-system            kube-controller-manager-master01             1/1     Running   0          383d
kube-system            kube-proxy-9z8c2                             1/1     Running   0          383d
kube-system            kube-proxy-l6pfq                             1/1     Running   0          383d
kube-system            kube-proxy-tw46c                             1/1     Running   0          383d
kube-system            kube-scheduler-master01                      1/1     Running   0          383d
kube-system            metrics-server-f4d79949f-4sfdj               1/1     Running   0          383d
kubernetes-dashboard   dashboard-metrics-scraper-7b87d6575b-qmh78   1/1     Running   0          383d
kubernetes-dashboard   kubernetes-dashboard-555d8dbffd-7xsbz        1/1     Running   0          383d

退出维护模式

kubectl uncordon master01