检查证书是否过期
kubeadm certs check-expiration[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Nov 11, 2024 07:10 UTC 362d ca no
apiserver Nov 11, 2024 07:10 UTC 362d ca no
apiserver-etcd-client Nov 11, 2024 07:10 UTC 362d etcd-ca no
apiserver-kubelet-client Nov 11, 2024 07:10 UTC 362d ca no
controller-manager.conf Nov 11, 2024 07:10 UTC 362d ca no
etcd-healthcheck-client Nov 11, 2024 07:10 UTC 362d etcd-ca no
etcd-peer Nov 11, 2024 07:10 UTC 362d etcd-ca no
etcd-server Nov 11, 2024 07:10 UTC 362d etcd-ca no
front-proxy-client Nov 11, 2024 07:10 UTC 362d front-proxy-ca no
scheduler.conf Nov 11, 2024 07:10 UTC 362d ca no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Nov 09, 2033 07:10 UTC 9y no
etcd-ca Nov 09, 2033 07:10 UTC 9y no
front-proxy-ca Nov 09, 2033 07:10 UTC 9y no 上面的列表中没有包含 kubelet.conf，因为 kubeadm 将 kubelet 配置为自动更新证书。 轮换的证书位于目录 /var/lib/kubelet/pki。更新证书
生成证书
kubeadm certs renew all[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.更新配置文件
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config重启 kubelet 服务
# systemctl restart kubelet参考文档
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/