TechContainerKubernetes

【容器化】Kubernetes证书过期问题处理

, ,
Views: 1000000
Words: 385 Read time: 2 mins.

问题描述

Kubernetes稳定运行了一年，突然Kubesphere中任何和K8S资源相关的操作都失效了，而且发现kubectl命令也出错了，报错如下：

1
2
Unable to connect to the server: x509: certificate has expired or is not yet valid
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '

原因是Kubernetes的证书默认过期有效期为1年，查看证书有效期命令如下

1
kubeadm alpha certs check-expiration

查看结果例子：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 08, 2022 01:40 UTC   364d                                    no      
apiserver                  Jul 08, 2022 01:40 UTC   364d            ca                      no      
apiserver-etcd-client      Jul 08, 2022 01:40 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Jul 08, 2022 01:40 UTC   364d            ca                      no      
controller-manager.conf    Jul 08, 2022 01:40 UTC   364d                                    no      
etcd-healthcheck-client    Jul 08, 2022 01:40 UTC   364d            etcd-ca                 no      
etcd-peer                  Jul 08, 2022 01:40 UTC   364d            etcd-ca                 no      
etcd-server                Jul 08, 2022 01:40 UTC   364d            etcd-ca                 no      
front-proxy-client         Jul 08, 2022 01:40 UTC   364d            front-proxy-ca          no      
scheduler.conf             Jul 08, 2022 01:40 UTC   364d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 05, 2030 08:16 UTC   8y              no      
etcd-ca                 Jul 05, 2030 08:16 UTC   8y              no      
front-proxy-ca          Jul 05, 2030 08:16 UTC   8y              no

解决方案（更新证书有效期）

1. 备份证书

1
cp -rp /etc/kubernetes /etc/kubernetes.bak.[date]

2. 更新所有证书

1
kubeadm alpha certs renew all

3. 复制admin.conf到~/.kube/config，kubectl需要用到该文件

1
2
cp -rp ~/.kube ~/.kube.bak.[date]
cp /etc/kubernetes/admin.conf ~/.kube/config

4. 重启kube-apiserver、kube-controller-manager、kube-scheduler和etcd服务或直接重启docker

1
systemctl restart docker

(•̀ᴗ•́)و ̑̑

Share