kubeadm部署的k8s1.29集群证书更新

1、查看证书有效期

kubeadm certs check-expiration

更新证书前：

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 29, 2025 09:55 UTC   362d            ca                      no      
apiserver                  Mar 29, 2025 09:55 UTC   362d            ca                      no      
apiserver-etcd-client      Mar 29, 2025 09:55 UTC   362d            etcd-ca                 no      
apiserver-kubelet-client   Mar 29, 2025 09:55 UTC   362d            ca                      no      
controller-manager.conf    Mar 29, 2025 09:55 UTC   362d            ca                      no      
etcd-healthcheck-client    Mar 29, 2025 09:55 UTC   362d            etcd-ca                 no      
etcd-peer                  Mar 29, 2025 09:55 UTC   362d            etcd-ca                 no      
etcd-server                Mar 29, 2025 09:55 UTC   362d            etcd-ca                 no      
front-proxy-client         Mar 29, 2025 09:55 UTC   362d            front-proxy-ca          no      
scheduler.conf             Mar 29, 2025 09:55 UTC   362d            ca                      no      
super-admin.conf           Mar 29, 2025 09:55 UTC   362d            ca                      no      CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 27, 2034 09:55 UTC   9y              no      
etcd-ca                 Mar 27, 2034 09:55 UTC   9y              no      
front-proxy-ca          Mar 27, 2034 09:55 UTC   9y              no      

更新证书后

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Apr 01, 2025 06:50 UTC   364d            ca                      no      
apiserver                  Apr 01, 2025 06:50 UTC   364d            ca                      no      
apiserver-etcd-client      Apr 01, 2025 06:50 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Apr 01, 2025 06:50 UTC   364d            ca                      no      
controller-manager.conf    Apr 01, 2025 06:50 UTC   364d            ca                      no      
etcd-healthcheck-client    Apr 01, 2025 06:50 UTC   364d            etcd-ca                 no      
etcd-peer                  Apr 01, 2025 06:50 UTC   364d            etcd-ca                 no      
etcd-server                Apr 01, 2025 06:50 UTC   364d            etcd-ca                 no      
front-proxy-client         Apr 01, 2025 06:50 UTC   364d            front-proxy-ca          no      
scheduler.conf             Apr 01, 2025 06:50 UTC   364d            ca                      no      
super-admin.conf           Apr 01, 2025 06:50 UTC   364d            ca                      no      CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 27, 2034 09:55 UTC   9y              no      
etcd-ca                 Mar 27, 2034 09:55 UTC   9y              no      
front-proxy-ca          Mar 27, 2034 09:55 UTC   9y              no

2、备份(每台机器有的都要备份)

cp -rp /etc/kubernetes /etc/kubernetes.bak
cp -rp /var/lib/etcd /var/lib/etcd.bak
cp -a ~/.kube ~/.kube_bak

3、重新生成证书，使用该命令不用提前删除过期证书(所有master节点都要做)

kubeadm certs renew all

4、再查看证书有效期

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep 'Not'Not Before: Mar 29 09:50:37 2024 GMTNot After : Apr  1 06:50:43 2025 GMT

5、重启四大组件（所有master操作）

docker ps | grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' | xargs docker restart

6、更新用户证书凭证（所有master操作）

cp /etc/kubernetes/admin.conf ~/.kube/config

7、所有节点重启kubelet

systemctl restart kubelet

8、检测状态，成功

systemctl status kubelet

9、检查组件状态

kubectl get cs