自建K8S集群認證過期
今天使用kubectl命令查看pod信息時，一直正常運行的k8s集群突然不能訪問了，輸入任何命令都提示以下報錯：
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2025-01-25T1145+08:00 is after 2024-11-22T2348Z
解決方案：
參考官方文檔：kubeadm證書管理使用命令kubeadm alpha certs來管理證書：
使用命令kubeadm alpha certs renew all更新證書，返回
| [renew] Reading configuration from the cluster... | |
| [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml' | |
| certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed | |
| certificate for serving the Kubernetes API renewed | |
| certificate the apiserver uses to access etcd renewed | |
| certificate for the API server to connect to kubelet renewed | |
| certificate embedded in the kubeconfig file for the controller manager to use renewed | |
| certificate for liveness probes to healthcheck etcd renewed | |
| certificate for etcd nodes to communicate with each other renewed | |
| certificate for serving etcd renewed | |
| certificate for the front proxy client renewed | |
| certificate embedded in the kubeconfig file for the scheduler manager to use renewed |
使用如下命令拷貝新生成的配置文件
| sudo kubeadm alpha kubeconfig user --client-name=admin --org=system:masters > /tmp/admin.conf | |
| sudo cp /tmp/admin.conf $HOME/.kube/config | |
| sudo chown $(id -u):$(id -g) $HOME/.kube/config |
重啟kubeletsystemctl restart kubelet即可正常使用K8S集群
| [root@k8smaster k8s]# kubectl get po | |
| NAME READY STATUS RESTARTS AGE | |
| cron-job-test-1732318920-k2g76 0/1 Completed 0 63d | |
| cron-job-test-1732318980-kcr4x 0/1 Completed 0 63d | |
| cron-job-test-1732319040-b88rf 0/1 Completed 0 63d | |
再次查看證書到期情況
| [root@k8smaster k8s]# kubeadm alpha certs check-expiration | |
| [check-expiration] Reading configuration from the cluster... | |
| [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml' | |
| CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED | |
| admin.conf Jan 25, 2026 05:55 UTC 364d no | |
| apiserver Jan 25, 2026 05:55 UTC 364d ca no | |
| apiserver-etcd-client Jan 25, 2026 05:55 UTC 364d etcd-ca no | |
| apiserver-kubelet-client Jan 25, 2026 05:55 UTC 364d ca no | |
| controller-manager.conf Jan 25, 2026 05:55 UTC 364d no | |
| etcd-healthcheck-client Jan 25, 2026 05:55 UTC 364d etcd-ca no | |
| etcd-peer Jan 25, 2026 05:55 UTC 364d etcd-ca no | |
| etcd-server Jan 25, 2026 05:55 UTC 364d etcd-ca no | |
| front-proxy-client Jan 25, 2026 05:55 UTC 364d front-proxy-ca no | |
| scheduler.conf Jan 25, 2026 05:55 UTC 364d no | |
| CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED | |
| ca Nov 20, 2033 23:44 UTC 8y no | |
| etcd-ca Nov 20, 2033 23:44 UTC 8y no | |
| front-proxy-ca Nov 20, 2033 23:44 UTC 8y no | |
注意事項：
官網上給的命令是kubeadm certs check-expiration，標識的k8s版本是V1.15，直接在本地執行該命令報錯：
| [root@k8smaster k8s]# kubeadm certs check-expiration | |
| unknown command "certs" for "kubeadm" | |
| To see the stack trace of this error execute with --v=5 or higher |
查了下，我本地的k8s版本是1.19，certs命令放在了kubeadm alpha下，需要將kubeadm certs替換為kubeadm aplha certs執行即可
| [root@k8smaster k8sh]# kubeadm version | |
| kubeadm version: &version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.5", GitCommit:"e338cf2c6d297aa603b50ad3a301f761b4173aa6", GitTreeState:"clean", BuildDate:"2020-12-09T1140Z", GoVersion:"go1.15.2", Compiler:"gc", Platform:"linux/amd64"} |
| [root@k8smaster k8s]# kubeadm --help | |
| ┌──────────────────────────────────────────────────────────┐ | |
| │ KUBEADM │ | |
| │ Easily bootstrap a secure Kubernetes cluster │ | |
| │ │ | |
| │ Please give us feedback at: │ | |
| │ https://github.com/kubernetes/kubeadm/issues │ | |
| └──────────────────────────────────────────────────────────┘ | |
| Example usage: | |
| Create a two-machine cluster with one control-plane node | |
| (which controls the cluster), and one worker node | |
| (where your workloads, like Pods and Deployments run). | |
| ┌──────────────────────────────────────────────────────────┐ | |
| │ On the first machine: │ | |
| ├──────────────────────────────────────────────────────────┤ | |
| │ control-plane# kubeadm init │ | |
| └──────────────────────────────────────────────────────────┘ | |
| ┌──────────────────────────────────────────────────────────┐ | |
| │ On the second machine: │ | |
| ├──────────────────────────────────────────────────────────┤ | |
|
│ worker# kubeadm join |
|
| └──────────────────────────────────────────────────────────┘ | |
| You can then repeat the second step on as many other machines as you like. | |
| Usage: | |
| kubeadm [command] | |
| Available Commands: | |
| alpha Kubeadm experimental sub-commands | |
| completion Output shell completion code for the specified shell (bash or zsh) | |
| config Manage configuration for a kubeadm cluster persisted in a ConfigMap in the cluster | |
| help Help about any command | |
| init Run this command in order to set up the Kubernetes control plane | |
| join Run this on any machine you wish to join an existing cluster | |
| reset Performs a best effort revert of changes made to this host by 'kubeadm init ' or 'kubeadm join' | |
| token Manage bootstrap tokens | |
| upgrade Upgrade your cluster smoothly to a newer version with this command | |
| version Print the version of kubeadm | |
| Flags: | |
| --add-dir-header If true, adds the file directory to the header of the lo g messages | |
| -h, --help help for kubeadm | |
| --log-file string If non-empty, use this log file | |
| --log-file-max-size uint Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) | |
| --rootfs string [EXPERIMENTAL] The path to the 'real' host root filesyst em. | |
| --skip-headers If true, avoid header prefixes in the log messages | |
| --skip-log-headers If true, avoid headers when opening log files | |
| -v, --v Level number for the log level verbosity | |
| Use "kubeadm [command] --help" for more information about a command. | |
| [root@k8smaster k8s]# kubectl alpha --help | |
| These commands correspond to alpha features that are not enabled in Kubernetes | |
| clusters by default. | |
| Available Commands: | |
| debug Attach a debug container to a running pod | |
|
Use "kubectl |
|
| [root@k8smaster k8s]# kubeadm alpha --help | |
| Kubeadm experimental sub-commands | |
| Usage: | |
| kubeadm alpha [command] | |
| Available Commands: | |
| certs Commands related to handling kubernetes certificates | |
| kubeconfig Kubeconfig file utilities | |
| selfhosting Make a kubeadm cluster self-hosted | |
| Flags: | |
| -h, --help help for alpha | |
| Global Flags: | |
| --add-dir-header If true, adds the file directory to the header of the log messages | |
| --log-file string If non-empty, use this log file | |
| --log-file-max-size uint Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) | |
| --rootfs string [EXPERIMENTAL] The path to the 'real' host root filesystem. | |
| --skip-headers If true, avoid header prefixes in the log messages | |
| --skip-log-headers If true, avoid headers when opening log files | |
| -v, --v Level number for the log level verbosity | |
| Additional help topics: | |
| kubeadm alpha phase Invoke subsets of kubeadm functions separately for a manual install | |
| Use "kubeadm alpha [command] --help" for more information about a command. |
鏈接：https://www.cnblogs.com/wenha/p/18690938
聲明：本文內容及配圖由入駐作者撰寫或者入駐合作網站授權轉載。文章觀點僅代表作者本人，不代表電子發燒友網立場。文章及其配圖僅供工程師學習之用，如有內容侵權或者其他違規問題，請聯系本站處理。
舉報投訴
-
集群
+關注
關注
0文章
89瀏覽量
17209 -
命令
+關注
關注
5文章
697瀏覽量
22115
原文標題：自建K8S集群認證過期
文章出處：【微信號：magedu-Linux，微信公眾號：馬哥Linux運維】歡迎添加關注！文章轉載請注明出處。
發布評論請先 登錄
相關推薦
全面提升，阿里云Docker/Kubernetes(K8S) 日志解決方案與選型對比
摘要： 今天，日志服務再次升級Kubernetes（k8s）的日志解決方案。1分鐘內即可完成整個集群部署，支持動態擴容，提供采集宿主機日志、容器日志、容器stdout等所有數據源的一站式采集。點此
發表于 02-28 12:49
K8s 從懵圈到熟練 – 集群網絡詳解
導讀：阿里云 K8S 集群網絡目前有兩種方案：一種是 flannel 方案；另外一種是基于 calico 和彈性網卡 eni 的 terway 方案。Terway 和 flannel 類似
發表于 10-14 15:06
如何利用K8S全面擁抱微服務架構？
K8S是第一個將“一切以服務為中心，一切圍繞服務運轉”作為指導思想的創新型產品，它的功能和架構設計自始至終都遵循了這一指導思想，構建在K8S上的系統不僅可以獨立運行在物理機、虛擬機集群或者企業私有云上，也可以被托管在公有云中。
Docker不香嗎為什么還要用K8s
Docker 雖好用，但面對強大的集群，成千上萬的容器，突然感覺不香了。 這時候就需要我們的主角 Kubernetes 上場了，先來了解一下 K8s 的基本概念，后面再介紹實踐，由淺入深步步為營
簡單說明k8s和Docker之間的關系
這篇文章主要介紹了k8s和Docker關系簡單說明，本文利用圖文講解的很透徹，有需要的同學可以研究下 最近項目用到kubernetes（以下簡稱k8s，k和s之間有
K8S集群服務訪問失敗怎么辦 K8S故障處理集錦
問題1：K8S集群服務訪問失?。?? ? 原因分析：證書不能被識別，其原因為：自定義證書，過期等。 解決方法：更新證書即可。 問題2：K8S集群
多k8s集群環境中工作有多快
命令就會很低效。 今天介紹3個工具會讓你在多k8s集群環境中工作的很輕松。我將從以下幾個方面來評估工具實用性： 速度 如果你有多個k8s集群可選擇，你切換
切換k8s上下文有多快
use-context 命令就會很低效。 今天介紹3個工具會讓你在多k8s集群環境中工作的很輕松。我將從以下幾個方面來評估工具實用性： 速度 如果你有多個k8s集群可選擇，你切換
k8s是什么意思？kubeadm部署k8s集群（k8s部署）|PetaExpres
k8s是什么意思？ kubernetes簡稱K8s，是一個開源的，用于管理云平臺中多個主機上的容器化的應用，Kubernetes的目標是讓部署容器化的應用簡單并且高效（powerful
發表于 07-19 13:14
?1153次閱讀
K8s多集群管理：為什么需要多集群、多集群的優勢是什么
隨著K8s和云原生技術的快速發展，以及各大廠商在自己的數據中心使用K8s的API進行容器化應用編排和管理，讓應用交付本身變得越來越標準化和統一化，并且實現了與底層基礎設施的完全解耦，為多集群和混合云提供了一個堅實技術基礎。
發表于 09-14 10:48
?1475次閱讀
納尼?自建K8s集群日志收集還能通過JMQ保存到JES
作者：京東科技 劉恩浩 一、背景 基于K8s集群的私有化交付方案中，日志收集采用了ilogtail+logstash+kafka+es方案，其中ilogtail負責日志收集，logstash負責對數
k8s云原生開發要求
IO性能。網絡要求穩定，建議使用私有網絡VPC，并配置與Kubernetes兼容的網絡插件。操作系統需與K8s版本匹配，虛擬化平臺支持Docker等。此外，還需關注安全配置，如禁用Swap、調整Sysctl等，以及etcd數據存儲后端的配置。合理配置硬件可確保K8s
混合云部署k8s集群方法有哪些？
混合云部署k8s集群方法是首先需在本地與公有云分別建立K8s集群，并確保網絡連接。接著，配置kubeconfig文件連接兩集群，并安裝云服務
工商網監
評論