k8s证书到期处理

wxh_无香花自开2026-05-14 15:18

#1、查看证书到期时间：

kubeadm certs check-expiration

$root@k8s-master$ $ kubeadm certs check-expiration

$check-expiration$ Reading configuration from the cluster...

$check-expiration$ FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED

admin.conf Apr 28, 2027 08:00 UTC 364d ca no

apiserver Apr 28, 2027 08:00 UTC 364d ca no

apiserver-etcd-client Apr 28, 2027 08:00 UTC 364d etcd-ca no

apiserver-kubelet-client Apr 28, 2027 08:00 UTC 364d ca no

controller-manager.conf Apr 28, 2027 08:00 UTC 364d ca no

etcd-healthcheck-client Apr 28, 2027 08:00 UTC 364d etcd-ca no

etcd-peer Apr 28, 2027 08:00 UTC 364d etcd-ca no

etcd-server Apr 28, 2027 08:00 UTC 364d etcd-ca no

front-proxy-client Apr 28, 2027 08:00 UTC 364d front-proxy-ca no

scheduler.conf Apr 28, 2027 08:00 UTC 364d ca no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED

ca Apr 22, 2034 07:26 UTC 7y no

etcd-ca Apr 22, 2034 07:26 UTC 7y no

front-proxy-ca Apr 22, 2034 07:26 UTC 7y no

#2、更新所有证书有效期

kubeadm certs renew all

#3、重启控制平面组件

方法一：临时移动静态Pod的清单文件（适用于所有环境）

将这些Pod的YAML文件（通常位于 /etc/kubernetes/manifests/）移出该目录，稍后移回即可触发重启。

sudo mv /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/

sleep 30

sudo mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/

sudo kubectl delete pod -n kube-system -l 'component in (kube-apiserver, etcd, kube-scheduler, kube-controller-manager)'

#4、更新本地kubeconfig

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

sudo chown $(id -u):$ (id -g) $HOME/.kube/config