K8S证书更新

备份原有文件

cp -rp /etc/kubernetes /etc/kubernetes.bak

查看证书过期时间

kubeadm alpha certs check-expiration

查看各证书过期时间

for item in `find /etc/kubernetes/pki -maxdepth 2 -name "*.crt"`;do openssl x509 -in $item -text -noout| grep Not;echo ======================$item===============;done

master节点执行(生成新证书)

kubeadm certs renew all

重启master上的kube-apiserver,kube-controller,kube-scheduler,etcd这4个容器，使证书生效

docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' |xargs docker restart

master节点上执行kubectl命令错误

error: You must be logged in to the server (Unauthorized)

原因：这个是权限问题，配置身份认证的文件为/etc/kubernetes/admin.conf，颁发证书时/etc/kubernetes/admin.conf文件重新生成，但是$HOME/.kube/config并没有得到替换。

解决

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config