更新k8s证书（续签）

 

下载：
kubeadm-x86 md5: 7951a9348655b4f508b84ced66fcf371
kubeadm-arm md5: b11c4ce93722b07f96c2acdeaaa07e74

cd /etc/kubernetes
cp kubeadm .
mkdir bak
 
# 备份
cp -a pki/ *.conf bak/
 
# 更新证书
./kubeadm alpha certs renew apiserver
./kubeadm alpha certs renew apiserver-kubelet-client
./kubeadm alpha certs renew front-proxy-client
 
# 更新 conf 文件内的证书
./kubeadm alpha certs renew admin.conf
./kubeadm alpha certs renew controller-manager.conf
./kubeadm alpha certs renew scheduler.conf
 
# 更新 kubeconfig
cp admin.conf ~/.kube/config
 
# 更新 kubelet 配置, 会报超时，但最后会更新 kubelet.conf
mv kubelet.conf kubelet.conf.old
 
./kubeadm init phase kubeconfig kubelet
 
# 重启 apiserver, controller-manager 和 scheduler
 
kill $(ps -ef | grep -E 'apiserver|controll|schedu' | grep -v grep | awk '{print $2}')
 
# 检查
 
openssl x509 -noout -in /etc/kubernetes/pki/apiserver.crt -enddate
openssl s_client -connect 127.0.0.1:6443 -showcerts < /dev/null 2>&1  | openssl x509 x509 -enddate -noout
kubectl get nodes
 
cp /etc/kubernetes/admin.conf ~/.kube/config
 
---
 
 
# 拷贝 pki 下的证书到其他 master 机器
cd /etc/kubernetes/
tar zcvf pki.tar.gz pki
 
scp pki.tar.gz ...
 
 
# 在其他master机器上，同样先备份
 
 
cd /etc/kubernetes/
mkdir bak
cp -a *.conf pki bak
  
# 更新配置和重启服务即可
# 更新 conf 文件内的证书
./kubeadm alpha certs renew admin.conf
./kubeadm alpha certs renew controller-manager.conf
./kubeadm alpha certs renew scheduler.conf
 
# 更新 kubeconfig
cp admin.conf ~/.kube/config
 
# 更新 kubelet 配置, 会报超时，但最后会更新 kubelet.conf
mv kubelet.conf kubelet.conf.old
 
./kubeadm init phase kubeconfig kubelet
 
# 重启 apiserver, controller-manager 和 scheduler
 
openssl s_client -connect 127.0.0.1:6443 -showcerts < /dev/null 2>&1  | openssl x509 -noout -text | headkill $(ps -ef | grep -E 'apiserver|controll|schedu' | grep -v grep | awk '{print $2}')
 
 
# 检查
openssl s_client -connect 127.0.0.1:6443 -showcerts < /dev/null 2>&1  | openssl x509 x509 -enddate -noout
 
 
# 更新 kubectl 配置
 
 
cp /etc/kubernetes/admin.conf ~/.kube/config