Когда k8s выполняет kubectl get nodes на главном узле, он запрашивает:
root@k8s-master01 .kube]# kubectl --kubeconfig=/root/.kube/config get nodes Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-11-24T16:57:15+08:00 is after 2022-09-16T09:13:17Z
Команда обновления сертификата:
обновление сертификатов kubeadml
[root@k8s-master01 ~]# kubeadm certs renew all [renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
Проверить команду:
проверка срока действия сертификатов kubeadm
[root@k8s-master01 ~]# kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Jul 27, 2023 09:25 UTC 245d ca no apiserver Jul 27, 2023 09:25 UTC 245d ca no apiserver-etcd-client Jul 27, 2023 09:25 UTC 245d etcd-ca no apiserver-kubelet-client Jul 27, 2023 09:25 UTC 245d ca no controller-manager.conf Jul 27, 2023 09:25 UTC 245d ca no etcd-healthcheck-client Jul 27, 2023 09:25 UTC 245d etcd-ca no etcd-peer Jul 27, 2023 09:25 UTC 245d etcd-ca no etcd-server Jul 27, 2023 09:25 UTC 245d etcd-ca no front-proxy-client Jul 27, 2023 09:25 UTC 245d front-proxy-ca no scheduler.conf Jul 27, 2023 09:25 UTC 245d ca no
Найдите расположение admin.conf
[root@k8s-master01 .kube]# find / -name admin.conf /etc/kubernetes/admin.conf [root@k8s-master01 .kube]# kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes NAME STATUS ROLES AGE VERSION k8s-master01 Ready master 433d v1.19.4 k8s-node01 Ready <none> 433d v1.19.4 k8s-node02 Ready <none> 433d v1.19.4 k8s-node03 Ready <none> 433d v1.19.4
Скопируйте admin.conf в /root/.kube/config и выполните команду kubectl get nodes для проверки.
[root@k8s-master01 .kube]# cp /etc/kubernetes/admin.conf /root/.kube/config cp: overwrite ‘/root/.kube/config’? yes [root@k8s-master01 .kube]# [root@k8s-master01 .kube]# [root@k8s-master01 .kube]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master01 Ready master 433d v1.19.4 k8s-node01 Ready <none> 433d v1.19.4 k8s-node02 Ready <none> 433d v1.19.4 k8s-node03 Ready <none> 433d v1.19.4
Вы хотите повысить осведомленность о своем запуске программного обеспечения? Посмотрите Цирк.
Мы предлагаем бесплатные консультации экспертов и индивидуальные решения, которые помогут вам повысить осведомленность о вашем технологическом продукте или услуге и принять их.
Больше контента на PlainEnglish.io.
Подпишитесь на нашу бесплатную еженедельную рассылку новостей. Подпишитесь на нас в Twitter, LinkedIn, YouTube и Discord.
