Kubernetes 证书过期 重新签发证书

证书过期报错错误，解决办法

[root@xianchaomaster1 ~]# kubectl get nodes
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2023-03-07T19:15:02+08:00 is after 2023-02-10T08:21:25Z
[root@xianchaomaster1 ~]# kubectl get node
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2023-03-07T19:15:07+08:00 is after 2023-02-10T08:21:25Z
[root@xianchaomaster1 ~]# Unable to connect to the server: x509: certificate has expired or is not yet valid: current timekubeadm alpha certs check-expiration^C
[root@xianchaomaster1 ~]# ^C
[root@xianchaomaster1 ~]# kubeadm alpha certs check-expiration
Command "check-expiration" is deprecated, please use the same command under "kubeadm certs"
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Feb 10, 2023 08:21 UTC   <invalid>                               no
apiserver                  Feb 10, 2023 08:21 UTC   <invalid>       ca                      no
apiserver-etcd-client      Feb 10, 2023 08:21 UTC   <invalid>       etcd-ca                 no
apiserver-kubelet-client   Feb 10, 2023 08:21 UTC   <invalid>       ca                      no
controller-manager.conf    Feb 10, 2023 08:21 UTC   <invalid>                               no
etcd-healthcheck-client    Feb 10, 2023 08:21 UTC   <invalid>       etcd-ca                 no
etcd-peer                  Feb 10, 2023 08:21 UTC   <invalid>       etcd-ca                 no
etcd-server                Feb 10, 2023 08:21 UTC   <invalid>       etcd-ca                 no
front-proxy-client         Feb 10, 2023 08:21 UTC   <invalid>       front-proxy-ca          no
scheduler.conf             Feb 10, 2023 08:21 UTC   <invalid>                               no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Feb 08, 2032 08:21 UTC   8y              no
etcd-ca                 Feb 08, 2032 08:21 UTC   8y              no
front-proxy-ca          Feb 08, 2032 08:21 UTC   8y              no
[root@xianchaomaster1 ~]# kubeadm alpha certs renew all
Command "all" is deprecated, please use the same command under "kubeadm certs"
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
You have new mail in /var/spool/mail/root
[root@xianchaomaster1 ~]# kubeadm alpha certs check-expiration
Command "check-expiration" is deprecated, please use the same command under "kubeadm certs"
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 06, 2024 11:16 UTC   364d                                    no
apiserver                  Mar 06, 2024 11:16 UTC   364d            ca                      no
apiserver-etcd-client      Mar 06, 2024 11:16 UTC   364d            etcd-ca                 no
apiserver-kubelet-client   Mar 06, 2024 11:16 UTC   364d            ca                      no
controller-manager.conf    Mar 06, 2024 11:16 UTC   364d                                    no
etcd-healthcheck-client    Mar 06, 2024 11:16 UTC   364d            etcd-ca                 no
etcd-peer                  Mar 06, 2024 11:16 UTC   364d            etcd-ca                 no
etcd-server                Mar 06, 2024 11:16 UTC   364d            etcd-ca                 no
front-proxy-client         Mar 06, 2024 11:16 UTC   364d            front-proxy-ca          no
scheduler.conf             Mar 06, 2024 11:16 UTC   364d                                    no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Feb 08, 2032 08:21 UTC   8y              no
etcd-ca                 Feb 08, 2032 08:21 UTC   8y              no
front-proxy-ca          Feb 08, 2032 08:21 UTC   8y              no

 

报认证错误，解决办法

[root@xianchaomaster1 ~]# kubectl get nodes
error: You must be logged in to the server (Unauthorized)
[root@xianchaomaster1 ~]# vim /etc/kubernetes/admin.conf
You have new mail in /var/spool/mail/root
[root@xianchaomaster1 ~]# export KUBECONFIG=/etc/kubernetes/admin.conf
[root@xianchaomaster1 ~]# source ~/.bash_profile
[root@xianchaomaster1 ~]# kubectl get nodes
NAME              STATUS   ROLES                  AGE    VERSION
xianchaomaster1   Ready    control-plane,master   390d   v1.20.6
xianchaonode1     Ready    worker                 390d   v1.20.6