{"id":426,"date":"2022-08-29T10:05:41","date_gmt":"2022-08-29T02:05:41","guid":{"rendered":"https:\/\/www.db2go.net\/?p=426"},"modified":"2022-08-29T10:05:41","modified_gmt":"2022-08-29T02:05:41","slug":"%e8%a7%a3%e5%86%b3k8s%e8%af%81%e4%b9%a6%e8%bf%87%e6%9c%9f%e9%97%ae%e9%a2%98","status":"publish","type":"post","link":"https:\/\/www.db2go.net\/?p=426","title":{"rendered":"\u89e3\u51b3k8s\u8bc1\u4e66\u8fc7\u671f\u95ee\u9898"},"content":{"rendered":"
    \n
  1. \u53d1\u73b0\u8bc1\u4e66\u8fc7\u671f<\/li>\n<\/ol>\n
    # kubectl get node\nUnable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-08-29T09:45:20+08:00 is after 2022-08-27T01:18:19Z\n<\/code><\/pre>\n
      \n
    1. \u67e5\u770b\u5404\u79cd\u8bc1\u4e66\u5468\u671f<\/li>\n<\/ol>\n
      # kubeadm certs check-expiration\n[check-expiration] Reading configuration from the cluster...\n[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'\n[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration\n\nCERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED\nadmin.conf                 Aug 27, 2022 01:18 UTC   <invalid>                               no      \napiserver                  Aug 27, 2022 01:18 UTC   <invalid>       ca                      no      \napiserver-etcd-client      Aug 27, 2022 01:18 UTC   <invalid>       etcd-ca                 no      \napiserver-kubelet-client   Aug 27, 2022 01:18 UTC   <invalid>       ca                      no      \ncontroller-manager.conf    Aug 27, 2022 01:18 UTC   <invalid>                               no      \netcd-healthcheck-client    Aug 27, 2022 01:18 UTC   <invalid>       etcd-ca                 no      \netcd-peer                  Aug 27, 2022 01:18 UTC   <invalid>       etcd-ca                 no      \netcd-server                Aug 27, 2022 01:18 UTC   <invalid>       etcd-ca                 no      \nfront-proxy-client         Aug 27, 2022 01:18 UTC   <invalid>       front-proxy-ca          no      \nscheduler.conf             Aug 27, 2022 01:18 UTC   <invalid>                               no      \n\nCERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED\nca                      Aug 25, 2031 01:18 UTC   8y              no      \netcd-ca                 Aug 25, 2031 01:18 UTC   8y              no      \nfront-proxy-ca          Aug 25, 2031 01:18 UTC   8y              no      \n<\/code><\/pre>\n
        \n
      1. \u5907\u4efd\u914d\u7f6e\u6587\u4ef6<\/li>\n<\/ol>\n
        # cp -r \/etc\/kubernetes\/pki \/etc\/kubernetes\/pki.bak\n<\/code><\/pre>\n
          \n
        1. \u66f4\u65b0\u8bc1\u4e66<\/li>\n<\/ol>\n
          # kubeadm certs renew all\n[renew] Reading configuration from the cluster...\n[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'\n[renew] Error reading configuration from the Cluster. Falling back to default configuration\n\ncertificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed\ncertificate for serving the Kubernetes API renewed\ncertificate the apiserver uses to access etcd renewed\ncertificate for the API server to connect to kubelet renewed\ncertificate embedded in the kubeconfig file for the controller manager to use renewed\ncertificate for liveness probes to healthcheck etcd renewed\ncertificate for etcd nodes to communicate with each other renewed\ncertificate for serving etcd renewed\ncertificate for the front proxy client renewed\ncertificate embedded in the kubeconfig file for the scheduler manager to use renewed\n\nDone renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.\n<\/code><\/pre>\n
            \n
          1. \u89e3\u51b3\u65e0\u6743\u9650\u95ee\u9898\uff0c\u6839\u672c\u539f\u56e0\u662f $HOME\/.kube\/config<\/code> \u6587\u4ef6\u91cc\u9762\u7684\u4fe1\u606f\u8fd8\u6ca1\u6709\u88ab\u66f4\u65b0\uff0c\u6240\u4ee5\u9700\u8981 copy \u4e00\u4efd\u3002<\/li>\n<\/ol>\n
            # kubectl get pod\nerror: You must be logged in to the server (Unauthorized)\n\n#  cp -i \/etc\/kubernetes\/admin.conf $HOME\/.kube\/config\ncp\uff1a\u662f\u5426\u8986\u76d6\"\/root\/.kube\/config\"\uff1f yes\n# kubectl get node\nNAME               STATUS   ROLES                  AGE    VERSION\nvm-zdqmx-4c16g-3   Ready    control-plane,master   367d   v1.21.2\nvm-zdqmx-4c16g-4   Ready    <none>                 367d   v1.21.2\nvm-zdqmx-8c16g     Ready    <none>                 367d   v1.21.2\n<\/code><\/pre>\n
              \n
            1. \u518d\u6b21\u67e5\u770b\u5404\u7ec4\u4ef6\u4fe1\u606f<\/li>\n<\/ol>\n
              # kubeadm certs check-expiration\n[check-expiration] Reading configuration from the cluster...\n[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'\n\nCERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED\nadmin.conf                 Aug 29, 2023 01:48 UTC   364d                                    no      \napiserver                  Aug 29, 2023 01:48 UTC   364d            ca                      no      \napiserver-etcd-client      Aug 29, 2023 01:48 UTC   364d            etcd-ca                 no      \napiserver-kubelet-client   Aug 29, 2023 01:48 UTC   364d            ca                      no      \ncontroller-manager.conf    Aug 29, 2023 01:48 UTC   364d                                    no      \netcd-healthcheck-client    Aug 29, 2023 01:48 UTC   364d            etcd-ca                 no      \netcd-peer                  Aug 29, 2023 01:48 UTC   364d            etcd-ca                 no      \netcd-server                Aug 29, 2023 01:48 UTC   364d            etcd-ca                 no      \nfront-proxy-client         Aug 29, 2023 01:48 UTC   364d            front-proxy-ca          no      \nscheduler.conf             Aug 29, 2023 01:48 UTC   364d                                    no      \n\nCERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED\nca                      Aug 25, 2031 01:18 UTC   8y              no      \netcd-ca                 Aug 25, 2031 01:18 UTC   8y              no      \nfront-proxy-ca          Aug 25, 2031 01:18 UTC   8y              no      \n\n<\/code><\/pre>\n
              8.\u53c2\u8003\uff1ahttps:\/\/kubernetes.io\/zh-cn\/docs\/tasks\/administer-cluster\/kubeadm\/kubeadm-certs\/<\/p>\n","protected":false},"excerpt":{"rendered":"
              \u53d1\u73b0\u8bc1\u4e66\u8fc7\u671f # kubectl get node Unable to connect to the serv…<\/p>\n Read More<\/span> \u89e3\u51b3k8s\u8bc1\u4e66\u8fc7\u671f\u95ee\u9898<\/span><\/a>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"Layout":"","footnotes":""},"categories":[3],"tags":[],"class_list":["entry","author-suredandan","post-426","post","type-post","status-publish","format-standard","category-k8s"],"views":2403,"_links":{"self":[{"href":"https:\/\/www.db2go.net\/index.php?rest_route=\/wp\/v2\/posts\/426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.db2go.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.db2go.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.db2go.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.db2go.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=426"}],"version-history":[{"count":1,"href":"https:\/\/www.db2go.net\/index.php?rest_route=\/wp\/v2\/posts\/426\/revisions"}],"predecessor-version":[{"id":427,"href":"https:\/\/www.db2go.net\/index.php?rest_route=\/wp\/v2\/posts\/426\/revisions\/427"}],"wp:attachment":[{"href":"https:\/\/www.db2go.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.db2go.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.db2go.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}