证书延期（非ca）

• https://www.jianshu.com/p/16d285aad0a8
• https://blog.csdn.net/kozazyh/article/details/94593538
• https://www.jianshu.com/p/220f78a6e2f1
• https://code.bonc.com.cn/confluence/pages/viewpage.action?pageId=26282389

版本：kubernetes1.14.3
http外部集成的etcd
老版本创建证书的命令可能和这版本的有些不一样，新版本也有可能不同

查看证书过期时间

openssl x509 -enddate -in /etc/kubernetes/pki/ca.crt -noout

一、延期master节点

1. 备份证书
   复制代码cd /etc/kubernetes/pki/ mkdir bak cp apiserver* front-proxy-c* bak

   1
   2
   3
   4
   cd /etc/kubernetes/pki/
   mkdir bak
   cp apiserver* front-proxy-c* bak
   

2. 更新证书(这个只修改证书时间，init命令可以生成新的证书)
   复制代码kubeadm alpha certs renew apiserver --config /opt/config.yaml kubeadm alpha certs renew apiserver-kubelet-client --config /opt/config.yaml kubeadm alpha certs renew front-proxy-client --config /opt/config.yaml

   1
   2
   3
   4
   kubeadm alpha certs renew apiserver --config /opt/config.yaml
   kubeadm alpha certs renew apiserver-kubelet-client --config /opt/config.yaml
   kubeadm alpha certs renew front-proxy-client --config /opt/config.yaml
   

3. 备份kubeconfig文件
   复制代码cd /etc/kubernetes/ mkdir bak mv admin.conf controller-manager.conf kubelet.conf scheduler.conf bak/ ​```i7

   1
   2
   3
   4
   5
   cd /etc/kubernetes/
   mkdir bak
   mv admin.conf controller-manager.conf kubelet.conf scheduler.conf bak/
   ​```i7
   

4. 创建kubeconfig文件
   复制代码kubeadm init phase kubeconfig all --config /opt/config.yaml chmod 777 /etc/kubernetes/admin.conf

   1
   2
   3
   kubeadm init phase kubeconfig all --config /opt/config.yaml
   chmod 777 /etc/kubernetes/admin.conf
   

5. 重启相关服务
   复制代码docker ps | grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler' | awk -F ' ' '{print $1}' |xargs docker restart

   1
   2
   docker ps | grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler' | awk -F ' ' '{print $1}' |xargs docker restart
   

6. 验证apiserver
   复制代码kubectl get no

   1
   2
   kubectl get no
   

若报错

1
2
3
4
5
6
7
8
9
You must be logged in to the server(unauthorized)
#执行
export KUBECONFIG=/etc/kubernetes/admin.conf
#或者在 /etc/profile文件中，写入
export KUBECONFIG=/etc/kubernetes/admin.conf
#执行
source
/etc/profile

最后

以上就是勤奋身影最近收集整理的关于k8s 1.14证书延期证书延期（非ca）的全部内容，更多相关k8s内容请搜索靠谱客的其他文章。