测试开发技术网站

[TOC]

# 问题：在k8s集群执行kubectl 命令报如下错误

```bash
[root@master ~]# kubectl get node
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2024-03-13T15:21:13+08:00 is after 2024-03-13T06:52:05Z
[root@master ~]#
```

# 解决办法
(1) 备份证书
```bash
cp -r /etc/kubernetes  /etc/kubernetes_2024
```

(2)检测证书过期
```bash
[root@master ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 13, 2024 06:52 UTC   <invalid>                               no
apiserver                  Mar 13, 2024 06:52 UTC   <invalid>       ca                      no
apiserver-etcd-client      Mar 13, 2024 06:52 UTC   <invalid>       etcd-ca                 no
apiserver-kubelet-client   Mar 13, 2024 06:52 UTC   <invalid>       ca                      no
controller-manager.conf    Mar 13, 2024 06:52 UTC   <invalid>                               no
etcd-healthcheck-client    Mar 13, 2024 06:52 UTC   <invalid>       etcd-ca                 no
etcd-peer                  Mar 13, 2024 06:52 UTC   <invalid>       etcd-ca                 no
etcd-server                Mar 13, 2024 06:52 UTC   <invalid>       etcd-ca                 no
front-proxy-client         Mar 13, 2024 06:52 UTC   <invalid>       front-proxy-ca          no
scheduler.conf             Mar 13, 2024 06:52 UTC   <invalid>                               no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 11, 2032 06:37 UTC   7y              no
etcd-ca                 Mar 11, 2032 06:37 UTC   7y              no
front-proxy-ca          Mar 11, 2032 06:37 UTC   7y              no
[root@master ~]#
```

![](https://redrose2100.oss-cn-hangzhou.aliyuncs.com/img/45eaaa30-e10a-11ee-abe9-0242ac110004.png)

(3)更新证书
```bash
kubeadm certs renew all
```

(4)再次查看证书过期时间，如下表示已经更新
```bash
[root@master ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 13, 2025 07:24 UTC   364d                                    no
apiserver                  Mar 13, 2025 07:24 UTC   364d            ca                      no
apiserver-etcd-client      Mar 13, 2025 07:24 UTC   364d            etcd-ca                 no
apiserver-kubelet-client   Mar 13, 2025 07:24 UTC   364d            ca                      no
controller-manager.conf    Mar 13, 2025 07:24 UTC   364d                                    no
etcd-healthcheck-client    Mar 13, 2025 07:24 UTC   364d            etcd-ca                 no
etcd-peer                  Mar 13, 2025 07:24 UTC   364d            etcd-ca                 no
etcd-server                Mar 13, 2025 07:24 UTC   364d            etcd-ca                 no
front-proxy-client         Mar 13, 2025 07:24 UTC   364d            front-proxy-ca          no
scheduler.conf             Mar 13, 2025 07:24 UTC   364d                                    no

（5）再次执行 kubectl 命令，如下表示已经ok
```bash
[root@master ~]# kubectl get node
NAME     STATUS   ROLES                  AGE    VERSION
master   Ready    control-plane,master   2y     v1.21.2
node1    Ready    <none>                 2y     v1.21.2
node2    Ready    <none>                 2y     v1.21.2
node3    Ready    <none>                 617d   v1.21.2
[root@master ~]#

```

# 新的问题一
此时有可能会继续出现如下错误
```bash
error: You must be logged in to the server (Unauthorized)
```

# 新问题一解决办法
(1) 备份原配置文件
```bash
cp -rp /root/.kube/config /root/.kube/config.bak_2024
```
(2)生成新的配置文件
```bash
cp -i /etc/kubernetes/admin.conf /root/.kube/config
```
![](https://redrose2100.oss-cn-hangzhou.aliyuncs.com/img/c0b49c20-e10b-11ee-abe9-0242ac110004.png)

# 新增问题二
此时在部署服务的时候，比如更新了image的tag等，k8s部署没有任何反应，即k8s功能并未真正生效

# 新增问题二解决办法
（1）重启 kubeadm
```bash
systemctl restart kubelet
```
(2)docker 重启apiserver，scheduler，controller-manager 容器
```bash
docker ps | grep apiserver | awk '{print $1}'| xargs docker restart
docker ps | grep scheduler | awk '{print $1}'| xargs docker restart
docker ps | grep controller-manager | awk '{print $1}'|xargs docker restart
```
将上述命令查询到的容器id重启
```bash
docker restart xxx
```

至此，k8s 证书更新的问题彻底都解决了

测试开发技术网站

博客