k8s 证书更换

运行命令行：

# kubectl get deployments -o wide

报错：

The connection to the server 192.168.1.9:6443 was refused - did you specify the right host or port?

#运行journalctl -xefu kubelet 命令查看systemd日志才发现，真正的错误是：

unable to load bootstrap kubeconfig: stat /etc/kubernetes/bootstrap-kubelet.conf: no such file or directory

原因是，证书到期了。

查看证书到期时间：

#cd /etc/kubernetes/pki

#for i in $(ls *.crt); do echo "===== $i ====="; openssl x509 -in $i -text -noout | grep -A 3 'Validity' ; done

执行更新证书命令

#kubeadm certs renew all

命令执行完后，发现kubelet服务还是启动不了，一样的错误。

原因是/etc/kubernetes/kubelet.conf 内容未变更。

手动修改/etc/kubernetes/kubelet.conf属性字段client-certificate 改为文件/etc/kubernetes/admin.conf属性字段client-certificate-data

手动修改/etc/kubernetes/kubelet.conf属性字段client-key 改为文件/etc/kubernetes/admin.conf属性字段client-key-data

如下：

重启服务

systemctl restart kubelet

#kubectl get deployments -o wide

error: You must be logged in to the server (Unauthorized)

解决：

#echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile

#source ~/.bash_profile

参考：

kubelet 证书轮换失败的解决方案 - 知乎

error: You must be logged in to the server (Unauthorized)报错解决_程少亭的博客-CSDN博客