rancher控制台的https证书有效期一年,到期后需要手动更新证书。
当rancher证书过期后,会导致rancher控制台无法访问的问题。
查看rancher日志
通过rancher容器的日志,判断是否证书过期问题
docker logs -f --tail=100 b8724e61a9b8(rancher容器id)
更换rancher证书
rancher版本为2.3.x
docker restart c8d5
docker exec -it c8d5 rm -fr /var/lib/rancher/k3s/server/tls
###c8d5为rancher的容器id
(注意:括号中的操作和上面删除证书目录操作选择其一执行即可。如果证书已经过期,rancher容器已经停止,无法进入容器删除证书目录,可以将映射到主机上面的证书目录重命名备份,路径一般在:/opt/rancher/k3s/server/tls
执行命令:mv /opt/rancher/k3s/server/tls /opt/rancher/k3s/server/tls_bak,然后执行下面重启操作更新证书,证书和目录会自动生成)
docker restart c8d5
sleep 10
docker restart c8d5
rancher版本为2.2.x
主机执行:
rancher_server_id=xxx
docker exec -ti ${rancher_server_id} mv /var/lib/rancher/management-state/tls/localhost.crt /var/lib/rancher/management-state/tls/localhost.crt-bak
docker exec -ti ${rancher_server_id} mv /var/lib/rancher/management-state/tls/localhost.key /var/lib/rancher/management-state/tls/localhost.key-bak
docker restart ${rancher_server_id}
rancher版本为2.4.x
容器内执行:
kubectl --insecure-skip-tls-verify -n kube-system delete secrets k3s-serving
kubectl --insecure-skip-tls-verify delete secret serving-cert -n cattle-system
rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json
主机上执行:
docker restart ${rancher_server_id}
curl --insecure -sfL https://${server-url}/v3
docker restart ${rancher_server_id}