K8S 证书过期的解决方法

fatman64

已于 2022-10-12 13:14:45 修改

阅读量1.4k

点赞数 2

分类专栏： K8S 文章标签： kubernetes docker 容器

于 2022-10-12 12:59:30 首次发布

本文链接：https://blog.csdn.net/paul_ham/article/details/127280438

版权

本文介绍了当Kubernetes集群证书过期时的诊断、查看及解决方法。包括检查日志确定问题、查看证书过期时间、了解证书位置、手动和自动续订证书的步骤。针对主节点和从节点，提供了证书的重新生成、配置文件更新以及节点状态验证的过程，以恢复集群正常运行。注意，对于生产环境，建议参照官方文档谨慎操作。

摘要由CSDN通过智能技术生成

K8S 证书过期的解决方法

2年前用虚拟机做K8S集群学习。最近打开当时的虚拟机，发现K8S无法启动。

The connection to the server xxxx:6443 was refused - did you specify the right host or port?

1.诊断

查看日志 sudo journalctl -xefu kubelet，发现报错“bootstrap-kubelet.conf: no such file or directory”，并提示证书过期。

Oct 11 23:55:51 master.k8s systemd[1]: kubelet.service failed.
Oct 11 23:56:01 master.k8s systemd[1]: kubelet.service holdoff time over, scheduling restart.
Oct 11 23:56:01 master.k8s systemd[1]: Stopped kubelet: The Kubernetes Node Agent.
-- Subject: Unit kubelet.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit kubelet.service has finished shutting down.
Oct 11 23:56:01 master.k8s systemd[1]: Started kubelet: The Kubernetes Node Agent.
-- Subject: Unit kubelet.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit kubelet.service has finished starting up.
-- 
-- The start-up result is done.
Oct 11 23:56:01 master.k8s kubelet[2931]: I1011 23:56:01.532681    2931 server.go:411] Version: v1.19.4
Oct 11 23:56:01 master.k8s kubelet[2931]: I1011 23:56:01.533162    2931 server.go:831] Client rotation is on, will bootstrap in background
Oct 11 23:56:01 master.k8s kubelet[2931]: E1011 23:56:01.534673    2931 bootstrap.go:265] part of the existing bootstrap client certificate is expired: 2021-12-06 17:48:28 +0000 UTC
Oct 11 23:56:01 master.k8s kubelet[2931]: F1011 23:56:01.534777    2931 server.go:265] failed to run Kubelet: unable to load bootstrap kubeconfig: stat /etc/kubernetes/bootstrap-kubelet.conf: no such file or directory

查看状态 systemctl status kubelet.service

[root@master kubernetes]# systemctl status kubelet.service 
â— kubelet.service - kubelet: The Kubernetes Node Agent
   Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; vendor preset: disabled)
  Drop-In: /usr/lib/systemd/system/kubelet.service.d
           â””â”€10-kubeadm.conf
   Active: activating (auto-restart) (Result: exit-code) since Wed 2022-10-12 00:26:38 CST; 7s ago
     Docs: https://kubernetes.io/docs/
  Process: 6437 ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS (code=exited, status=255)
 Main PID: 6437 (code=exited, status=255)

Oct 12 00:26:38 master.k8s kubelet[6437]: k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.Forever(...f200)
Oct 12 00:26:38 master.k8s systemd[1]: kubelet.service failed.
Hint: Some lines were el