一、問題：k8s證書過期
[root@nb001 ~]# kubectl get node
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-12-10T10:26:21+08:00 is after 2022-12-10T01:55:52Z
二、解決方案：
2.1 處理步驟
# 備份 kubernetes配置
cp -r /etc/kubernetes /etc/kubernetes_bak
# 檢測證書過期
kubeadm certs check-expiration
# 更新證書
kubeadm certs renew all
2.2 處理步驟詳細(xì)情況
[root@nb001 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Dec 10, 2022 01:55 UTC <invalid> no
apiserver Dec 10, 2022 01:55 UTC <invalid> ca no
apiserver-etcd-client Dec 10, 2022 01:55 UTC <invalid> etcd-ca no
apiserver-kubelet-client Dec 10, 2022 01:55 UTC <invalid> ca no
controller-manager.conf Dec 10, 2022 01:55 UTC <invalid> no
etcd-healthcheck-client Dec 10, 2022 01:55 UTC <invalid> etcd-ca no
etcd-peer Dec 10, 2022 01:55 UTC <invalid> etcd-ca no
etcd-server Dec 10, 2022 01:55 UTC <invalid> etcd-ca no
front-proxy-client Dec 10, 2022 01:55 UTC <invalid> front-proxy-ca no
scheduler.conf Dec 10, 2022 01:55 UTC <invalid> no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Dec 08, 2031 01:55 UTC 8y no
etcd-ca Dec 08, 2031 01:55 UTC 8y no
front-proxy-ca Dec 08, 2031 01:55 UTC 8y no
如上，發(fā)現(xiàn)很多證書都是<invalid>的狀態(tài)，接著更新證書：
[root@nb001 .kube]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
[root@nb001 .kube]# kubectl get node
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-12-10T10:33:16+08:00 is after 2022-12-10T01:55:52Z
如下，更新證書后，證書過期時(shí)間已經(jīng)更新為365d
[root@nb001 .kube]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Dec 10, 2023 02:33 UTC 364d no
apiserver Dec 10, 2023 02:33 UTC 364d ca no
apiserver-etcd-client Dec 10, 2023 02:33 UTC 364d etcd-ca no
apiserver-kubelet-client Dec 10, 2023 02:33 UTC 364d ca no
controller-manager.conf Dec 10, 2023 02:33 UTC 364d no
etcd-healthcheck-client Dec 10, 2023 02:33 UTC 364d etcd-ca no
etcd-peer Dec 10, 2023 02:33 UTC 364d etcd-ca no
etcd-server Dec 10, 2023 02:33 UTC 364d etcd-ca no
front-proxy-client Dec 10, 2023 02:33 UTC 364d front-proxy-ca no
scheduler.conf Dec 10, 2023 02:33 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Dec 08, 2031 01:55 UTC 8y no
etcd-ca Dec 08, 2031 01:55 UTC 8y no
front-proxy-ca Dec 08, 2031 01:55 UTC 8y no
三、新的問題①及解決方案
3.1 再次查看kubectl get node，發(fā)現(xiàn)有新的錯(cuò)誤：error: You must be logged in to the server (Unauthorized)
[root@nb001 .kube]# kubectl get node
error: You must be logged in to the server (Unauthorized)
3.2 上述錯(cuò)誤解決方案
- 備份配置文件
cp -rp $HOME/.kube/config $HOME/.kube/config.bak，并生成新的配置文件sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config - 執(zhí)行
kubectl get node查看解決結(jié)果
詳情如下：
[root@nb001 .kube]# cd /etc/kubernetes
[root@nb001 kubernetes]# ls
admin.conf controller-manager.conf kubelet.conf manifests pki scheduler.conf
[root@nb001 kubernetes]# cd $HOME/.kube/
[root@nb001 .kube]# ls
cache config
[root@nb001 .kube]# cp -rp config config.bak
[root@nb001 .kube]# ls
cache config config.bak
[root@nb001 .kube]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
cp: overwrite ‘/root/.kube/config’? y
[root@nb001 .kube]# ls -lrth
total 20K
-rw------- 1 root root 5.5K Dec 10 2021 config.bak
drwxr-x--- 4 root root 4.0K Dec 10 2021 cache
-rw------- 1 root root 5.5K Dec 10 10:35 config
[root@nb001 .kube]# kubectl get node
NAME STATUS ROLES AGE VERSION
nb001 Ready control-plane,master 365d v1.21.5
nb002 Ready <none> 365d v1.21.5
nb003 Ready <none> 241d v1.21.5
四、新的問題②及解決方案
4.1 上述問題解決后，執(zhí)行kubectl apply、kubectl create命令可以正常執(zhí)行，但無法實(shí)際操作資源
換句話說：就是執(zhí)行了，但沒生效
舉例： 比如你更新 service-user.yaml 調(diào)整了鏡像版本，想重新部署下user服務(wù)。執(zhí)行kubectl apply -f service-user.yaml ，但實(shí)際pod還是上次部署的pod，并沒有重新部署。其余不生效的情況類似。
此外：在kuboard上的表現(xiàn)如下圖，都是空的：
文章來源：http://www.zghlxwxcb.cn/news/detail-435908.html
4.2 解決方案
- 重啟kubelet
systemctl restart kubelet
- 重啟kube-apiserver、kube-controller-manage、kube-scheduler
# 如果是docker作為容器的話，可執(zhí)行如下命令。其余容器方法類似
docker ps |grep kube-apiserver|grep -v pause|awk '{print $1}'|xargs -i docker restart {}
docker ps |grep kube-controller-manage|grep -v pause|awk '{print $1}'|xargs -i docker restart {}
docker ps |grep kube-scheduler|grep -v pause|awk '{print $1}'|xargs -i docker restart {}
- 重新部署user服務(wù)即可
至此，由于k8s證書過期引起的問題得到徹底解決。文章來源地址http://www.zghlxwxcb.cn/news/detail-435908.html
End
到了這里，關(guān)于K8S異常之Unable to connect to the server: x509: certificate has expired or is not yet valid的文章就介紹完了。如果您還想了解更多內(nèi)容，請?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
