Kuberneters节点加入证书过期问题解决方案

证书过期加入集群报错如下： 

root@worker00 ~]# kubeadm join 172.16.0.106:6443 --token bovuz7.a7rzxono6gk5jt78 --discovery-token-ca-cert-hash sha256:49e20dee4a7794f99ab6999daed1f32b0e8585bdbf8c96636dea502448982789
W0804 17:04:08.455469    4376 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
[preflight] Running pre-flight checks
error execution phase preflight: couldn't validate the identity of the API Server: could not find a JWS signature in the cluster-info ConfigMap for token ID "bovuz7"
To see the stack trace of this error execute with --v=5 or higher

解决方案,重新生成token，以及sha256：

root@master00 ~]# kubeadm token create
W0804 17:12:29.119893   19826 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
ahmkaw.06mtkupwl3dvt3up
[root@master00 ~]# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
49e20dee4a7794f99ab6999daed1f32b0e8585bdbf8c96636dea502448982789
[root@master00 ~]# 

 更换token和sha256再次加入即可：

[root@worker00 ~]# kubeadm join 172.16.0.106:6443 --token ahmkaw.06mtkupwl3dvt3up --discovery-token-ca-cert-hash sha256:49e20dee4a7794f99ab6999daed1f32b0e8585bdbf8c96636dea502448982789
W0804 17:15:01.868306    5148 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

[root@worker00 ~]#