使用 kubeadm 手动生成并替换证书

1、生成集群的配置文件

kubeadm config view > /tmp/cluster.yaml

2、备份原有证书

cp -rp /etc/kubernetes /etc/kubernetes.bak

3、备份etcd数据目录

cp -r /usr/etcd /usr/etcd.bak

4、更新证书

kubeadm alpha certs renew all --config=/tmp/cluster.yaml

mv admin.conf admin.conf.back

mv controller-manager.conf controller-manager.conf.back

mv kubelet.conf kubelet.conf.back

mv scheduler.conf scheduler.conf.back

kubeadm init phase kubeconfig all --config=/tmp/cluster.yaml

5、在三台Master上执行重启kube-apiserver,kube-controller,kube-scheduler,etcd这4个容器，使证书生效

docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' |xargs docker restart