【K8s】Kubernetes 集群证书过期处理方法

行者Sun

发布于 2024-09-02 12:47:31

2390

发布于 2024-09-02 12:47:31

文章被收录于专栏：Kubernetes

以下内容均来自个人笔记并重新梳理，如有错误欢迎指正！

如果对您有帮助，烦请点赞、关注、转发！如果您有其他想要了解的，欢迎私信联系我～

背景介绍

使用 kubeadm 安装的 Kubernetes 集群，运行一段时间后执行 kubectl 命令突然出现以下报错：

Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2023-09-22T15:05:09+08:00 is after 2023-09-20T04:04:02Z

报错原因是 Kubernetes 集群证书已经过期（默认有效期 365 天），处理方法是对 Kubernetes 集群证书进行更新以重置有效期，本文将介绍具体处理过程。

相关概念

Kubernetes 集群证书是用于在 Kubernetes 集群中实现安全通信的关键组件，主要用于在集群的各个组件之间建立信任和进行身份验证。

Kubernetes 集群证书包括：

CA（证书颁发机构）证书：用于签名其他证书，是信任链的根
API Server 证书：用于 API Server 的 TLS 认证
kubelet 证书：用于 kubelet 与 API Server 之间的通信
kube-proxy 证书：用于 kube-proxy 与 API Server 之间的通信
etcd 证书：用于 etcd 集群内部节点之间的通信
服务账户证书：用于服务账户与 API Server 之间的通信

kubeadm 是 Kubernetes 集群的启动和初始化工具，它在创建集群时生成 Kubernetes 集群证书，并默认设置有效期为一年。

处理过程

1、备份证书

cd /etc/kubernetes && mv pki pki-old

2、检测证书

# kubeadm 20 之前的版本使用本命令
kubeadm alpha certs check-expiration
 
# kubeadm 20 之后的版本使用本命令
kubeadm certs check-expiration
 
🔔 输出示例如下：
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
 
CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Aug 02, 2025 07:24 UTC   358d            ca                      no      
apiserver                  Aug 02, 2025 07:24 UTC   358d            ca                      no      
apiserver-etcd-client      Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
apiserver-kubelet-client   Aug 02, 2025 07:24 UTC   358d            ca                      no      
controller-manager.conf    Aug 02, 2025 07:24 UTC   358d            ca                      no      
etcd-healthcheck-client    Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
etcd-peer                  Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
etcd-server                Aug 02, 2025 07:24 UTC   358d            etcd-ca                 no      
front-proxy-client         Aug 02, 2025 07:24 UTC   358d            front-proxy-ca          no      
scheduler.conf             Aug 02, 2025 07:24 UTC   358d            ca                      no      
super-admin.conf           Aug 02, 2025 07:24 UTC   358d            ca                      no      
 
CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 31, 2034 07:24 UTC   9y              no      
etcd-ca                 Jul 31, 2034 07:24 UTC   9y              no      
front-proxy-ca          Jul 31, 2034 07:24 UTC   9y              no

3、更新证书

# kubeadm 20 之前的版本使用本命令
kubeadm alpha certs renew all
 
# kubeadm 20 之后的版本使用本命令
kubeadm certs renew all
 
🔔 有效期将被重置为 365 天
🔔 输出示例如下：
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
 
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
certificate embedded in the kubeconfig file for the super-admin renewed
 
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

4、更新 Kubeconfig

cd ～/.kube && mv config config-bak
yes | cp /etc/kubernetes/admin.conf config
 
🔔 若不更新 Kubeconfig，执行 kubectl 命令会出现报错：error: You must be logged in to the server (Unauthorized)

5、重启服务

# 重启 kubelet 服务
systemctl restart kubelet
 
# 重启 kube-apiserver、kube-controller-manage、kube-scheduler 容器
docker ps | grep kube-apiserver | grep -v pause | awk '{print $1}' | xargs -i docker restart {}
docker ps | grep kube-controller-manage | grep -v pause | awk '{print $1}' | xargs -i docker restart {}
docker ps | grep kube-scheduler | grep -v pause | awk '{print $1}' | xargs -i docker restart {}
 
🔔 使用 kubeadm 安装的集群，Master 节点的核心组件都是以静态 Pod 的方式运行的，因此重启服务可以采用重启对应容器的方式

6、验证效果

通过执行 kubectl 命令或检测证书，验证集群证书是否更新成功。

本文参与腾讯云自媒体同步曝光计划，分享自微信公众号。

原始发表：2024-08-30，如有侵权请联系 cloudcommunity@tencent.com 删除

kubernetes