注:前期一定要查看所有日志,rancher报错日志、客户端的rancher-agent、kubectl。。。。。
rancher2.5.9 突然报错,所有的集群无法使用
查看agent日志报错如下
Server certificate is not valid, please check if the host has the correct time configured and if the server certificate has a notAfter date and time in the future. Certificate information is displayed above. error: Get “https://39.1xxxxxxxxxx”: x509: certificate has expired or is not yet valid: current time 2022-09-15T09:38:47Z is after 2022-09-12T11:42:06Z"
怀疑是证书问题
按照网站教程,master时间和nodes时间 均调整为2022-9-12 11:00:00
登录rancher 点击 更新证书后,测试无效,
进入 local-----system中查看密文–证书列表
发现域名、cattle-webhook-tls、serving-cert 证书均过期
想方法更新,
参照rancher官方2.4+版本手动更新命令执行
链接:https://docs.rancher.cn/docs/rancher2/trending-topics/certificate-rotation/_index/
a\ exec 到 rancher server
kubectl --insecure-skip-tls-verify -n kube-system delete secrets k3s-serving
kubectl --insecure-skip-tls-verify delete secret serving-cert -n cattle-system
rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json
重启 rancher-server
执行以下命令刷新参数
curl --insecure -sfL https://server-url/v3
重启 Rancher Server 容器
docker restart <rancher_server_id>
===========================
重启后发现还是报错,再次登录rancher----system查看,发现cattle-webhook-tls 还是过期,
点击后面的手动删除此证书,然后重启rancher服务,稍等两分钟后,服务变更为正常