kubelet证书延期

1、登录集群，确认IP地址

hostname -i
1

2、备份kubectl-controller-manager文件

cp /etc/kubernetes/manifests/kube-controller-manager.yaml  /opt/
1

3、修改期限，三台master主机都要改

4、生成bootstrap-kubeconfig文件，并将其重命名bootstrap-kubelet.conf

kubectl config --kubeconfig=/root/pki/bootstrap-kubeconfig set-cluster bootstrap --server='https://192.168.x.232:6443' --certificate-authority=/etc/kubernetes/pki/ca.crt  

(apiserver的地址)

 

kubectl config --kubeconfig=/root/pki/bootstrap-kubeconfig set-credentials kubelet-bootstrap --token=abcdef.0123456789abcdef

 

kubectl config --kubeconfig=/root/pki/bootstrap-kubeconfig set-context bootstrap --user=kubelet-bootstrap --cluster=bootstrap

 

kubectl config --kubeconfig=/root/pki/bootstrap-kubeconfig use-context bootstrap

 

mv bootstrap-kubeconfig bootstrap-kubelet.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

5、分发bootstrap-kubelet.conf文件到到各主机/etc/kubernetes/

cp /root/pki/bootstrap-kubelet.conf  /etc/kubernetes/
1

6、重命名pki目录

mv  /var/lib/kubelet/pki  /var/lib/kubelet/pki-bak
1

7、重启kubelet

systemctl restart kubelet
1

检查：

1、检查证书是否延期成功

openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -text |grep Not
1