更新 k8s 证书（续签）

下载：

kubeadm-x86 md5: 7951a9348655b4f508b84ced66fcf371

kubeadm-arm md5: b11c4ce93722b07f96c2acdeaaa07e74

cd /etc/kubernetes

cp kubeadm .

mkdir bak

# 备份

cp -a pki/ *.conf bak/

# 更新证书

./kubeadm alpha certs renew apiserver

./kubeadm alpha certs renew apiserver-kubelet-client

./kubeadm alpha certs renew front-proxy-client

# 更新 conf 文件内的证书

./kubeadm alpha certs renew admin.conf

./kubeadm alpha certs renew controller-manager.conf

./kubeadm alpha certs renew scheduler.conf

# 更新 kubeconfig

cp admin.conf ~/.kube/config

# 更新 kubelet 配置, 会报超时，但最后会更新 kubelet.conf

mv kubelet.conf kubelet.conf.old

./kubeadm init phase kubeconfig kubelet

# 重启 apiserver, controller-manager 和 scheduler

kill $(ps -ef | grep -E 'apiserver|controll|schedu' | grep -v grep | awk '{print $2}')

# 检查

openssl x509 -noout -in /etc/kubernetes/pki/apiserver.crt -enddate

openssl s_client -connect 127.0.0.1:6443 -showcerts < /dev/null 2>&1  | openssl x509 -enddate -noout

kubectl get nodes

cp /etc/kubernetes/admin.conf ~/.kube/config

---

# 拷贝 pki 下的证书到其他 master 机器

cd /etc/kubernetes/

tar zcvf pki.tar.gz pki

scp pki.tar.gz ...

# 在其他master机器上，同样先备份

cd /etc/kubernetes/

mkdir bak

cp -a *.conf pki bak

# 更新配置和重启服务即可

# 更新 conf 文件内的证书

./kubeadm alpha certs renew admin.conf

./kubeadm alpha certs renew controller-manager.conf

./kubeadm alpha certs renew scheduler.conf

# 更新 kubeconfig

cp admin.conf ~/.kube/config

# 更新 kubelet 配置, 会报超时，但最后会更新 kubelet.conf

mv kubelet.conf kubelet.conf.old

./kubeadm init phase kubeconfig kubelet

# 重启 apiserver, controller-manager 和 scheduler

openssl s_client -connect 127.0.0.1:6443 -showcerts < /dev/null 2>&1  | openssl x509 -noout -text | head

kill $(ps -ef | grep -E 'apiserver|controll|schedu' | grep -v grep | awk '{print $2}')

# 检查

openssl s_client -connect 127.0.0.1:6443 -showcerts < /dev/null 2>&1  | openssl x509 -enddate -noout

# 更新 kubectl 配置

cp /etc/kubernetes/admin.conf ~/.kube/config