K8s更新证书

K8s更新证书

http://blog.chinaunix.net/uid-28813320-id-5823201.html
1、备份原有文件
mv /etc/kubernetes/pki/apiserver.crt /etc/kubernetes/pki/apiserver.crt.old.old
mv /etc/kubernetes/pki/apiserver.key /etc/kubernetes/pki/apiserver.key.old.old
mv /etc/kubernetes/pki/apiserver-kubelet-client.crt /etc/kubernetes/pki/apiserver-kubelet-client.crt.old
mv /etc/kubernetes/pki/apiserver-kubelet-client.key /etc/kubernetes/pki/apiserver-kubelet-client.key.old
#mv /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.crt.old
#mv /etc/kubernetes/pki/ca.key /etc/kubernetes/pki/ca.key.old
#mv /etc/kubernetes/pki/front-proxy-ca.crt /etc/kubernetes/pki/front-proxy-ca.crt.old
#mv /etc/kubernetes/pki/front-proxy-ca.key /etc/kubernetes/pki/front-proxy-ca.key.old
mv /etc/kubernetes/pki/front-proxy-client.crt /etc/kubernetes/pki/front-proxy-client.crt.old
mv /etc/kubernetes/pki/front-proxy-client.key /etc/kubernetes/pki/front-proxy-client.key.old
#mv /etc/kubernetes/pki/sa.key /etc/kubernetes/pki/sa.key.old
#mv /etc/kubernetes/pki/sa.pub /etc/kubernetes/pki/sa.pub.old

2、pptp拨号
现在windows上面拨号
然后去linux上面去使用pptp拨号

3、生产新证书（kubeadm需要连接google服务器，这里用了pptp拨号才出去）
kubeadm alpha phase certs apiserver --apiserver-advertise-address 192.168.73.131 --apiserver-cert-extra-sans 192.168.73.143 --apiserver-cert-extra-sans 192.168.73.144 --apiserver-cert-extra-sans 192.168.73.145 --apiserver-cert-extra-sans k8s143 --apiserver-cert-extra-sans k8s144 --apiserver-cert-extra-sans k8s145 #143,144,145组成集群模式131是浮动地址

kubeadm alpha phase certs apiserver-kubelet-client

kubeadm alpha phase certs front-proxy-client

4、备份旧配置文件
mv /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.old
mv /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.old
mv /etc/kubernetes/controller-manager.conf /etc/kubernetes/controller-manager.conf.old
mv /etc/kubernetes/scheduler.conf /etc/kubernetes/scheduler.conf.old
5、kubeadm alpha phase kubeconfig all --apiserver-advertise-address 192.168.73.131

6、重启服务
在每个管理节点，列出kube-apiserver，kube-controller-manager, kube-scheduler 容器的id；
依次重启；
7、kubelet使用的/var/lib/kubelet/pki/kubelet/目录下的client证书，可以任意删除，启动自动重新获取

8、更新kubectl 配置文件
8.1. cd ~/.kube/
8.2. cat /etc/kubernetes/admin.conf > ./config

9、查看集群状态
9.1. kubectl get node
9.2. kubectl get po --all-namespaces