k8s高可用 更换master

比如已经成下以下情况

1 任意进入一个etcd容器删除故障的etcd

# kubectl exec -it -n kube-system etcd-node171 -- bash
# 172.18.1.177 节点需要更换
# 查看节点
# etcdctl --endpoints 127.0.0.1:2379 --cacert /etc/kubernetes/pki/etcd/ca.crt --cert /etc/kubernetes/pki/etcd/server.crt --key /etc/kubernetes/pki/etcd/server.key member list

1023fbb26ad475b, started, node177, https://172.18.1.177:2380, https://172.18.1.177:2379, false
22f4ebaf8c1cf8bf, started, node171, https://172.18.1.171:2380, https://172.18.1.171:2379, false
7a1c617163553621, started, node174, https://172.18.1.174:2380, https://172.18.1.174:2379, false

删除故障的etcd

# etcdctl --endpoints 127.0.0.1:2379 --cacert /etc/kubernetes/pki/etcd/ca.crt --cert /etc/kubernetes/pki/etcd/server.crt --key /etc/kubernetes/pki/etcd/server.key member remove 1023fbb26ad475b

# 查看
# etcdctl --endpoints 127.0.0.1:2379 --cacert /etc/kubernetes/pki/etcd/ca.crt --cert /etc/kubernetes/pki/etcd/server.crt --key /etc/kubernetes/pki/etcd/server.key member list
22f4ebaf8c1cf8bf, started, node171, https://172.18.1.171:2380, https://172.18.1.171:2379, false
7a1c617163553621, started, node174, https://172.18.1.174:2380, https://172.18.1.174:2379, false

#删除完退出即可

2.生成命令,先执行添加node节点的命令

# kubeadm token create --print-join-command

kubeadm join 172.18.1.181:6443 --token abcdef.0123456789abcdef --discovery-token-ca-cert-hash sha256:2aaf9fa88f07dc8f9c3eff413d0c18fdb28a6819ed5925fc665297837fc56350

3. 再生成Key

# kubeadm init phase upload-certs --upload-certs

I0701 16:36:21.421234   47740 version.go:255] remote version is much newer: v1.24.2; falling back to: stable-1.23
[upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
[upload-certs] Using certificate key:
6328cd4b38743dd01610ee8eb3bf25de9554fe20de93a813b8be5afef5e1007a

4 再用 --control-plane --certificate-key 把前面那条命令跟key证书连接起来获得master 的join命令，结果如下

# kubeadm join 172.18.1.181:6443 --token abcdef.0123456789abcdef --discovery-token-ca-cert-hash sha256:2aaf9fa88f07dc8f9c3eff413d0c18fdb28a6819ed5925fc665297837fc56350 --control-plane --certificate-key 6328cd4b38743dd01610ee8eb3bf25de9554fe20de93a813b8be5afef5e1007a

5 .查看etcd