kubelets 1.20 证书更新

前提

发现 kubelet 故障
排查后发现证书已经过期
本文用于更新 kubelet 服务器证书

故障

kubelet 无法正常工作

# kubectl cluster-info

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
The connection to the server 10.189.20.40:6443 was refused - did you specify the right host or port?

检测容器状态

# docker ps -a | grep api
43c315c4b218        75c7f7112080                                        "kube-apiserver --ad…"   3 minutes ago       Exited (1) 3 minutes ago                       k8s_kube-apiserver_kube-apiserver-ns-yun-020040.vclound.com_kube-system_3065c678a81415e1625697093dd42b9e_42204

检测容器日志

# docker logs f24975da9d74
忽略其他日志
W0623 10:34:31.493540       1 clientconn.go:1223] grpc: addrConn.createTransport failed to connect to {https://127.0.0.1:2379  <nil> 0 <nil>}. Err :connection error: desc = "transport: authentication handshake failed: x509: certificate has expired or is not yet valid: current time 2022-06-23T10:34:31Z is after 2021-12-23T07:30:39Z". Reconnecting...
Error: context deadline exceeded

故障分析

关键字 authentication handshake failed: x509: certificate has expired
怀疑 ssl 证书故障

验证证书

# kubeadm alpha certs check-expiration
Command "check-expiration" is deprecated, please use the same command under "kubeadm certs"
[check-expiration] Reading configuratio