You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

在最开始创建集群的时候我们的apiserver证书可能只加了一个IP，随着集群需要高可用稳定性，所以需要增加master的IP或者迁移master，这个时候就需要重新签发apiserver证书

将kubeadm的配置文件导出

kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' > kubeadm-init.yaml

修改文件内容添加masterIP

apiServer:
  certSANs:
  - 10.10.51.5
  - 10.10.51.11
  extraArgs:
    authorization-mode: Node,RBAC
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controlPlaneEndpoint: 10.10.51.5:6443
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.23.17
networking:
  dnsDomain: cluster.local
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/16
scheduler: {}

编辑内容添加IP后将下现有的apiserver证书移动到其他位置，因为 kubeadm 检测到他们已经存在于指定的位置，它就不会创建新的了。

mv /etc/kubernetes/pki /etc/kubernetes/pki.bak

使用 kubeadm 命令生成一个新的证书：

kubeadm init phase certs all --config kubeadm-init.yaml


验证新的证书信息

kubeadm certs check-expiration
openssl x509 -in /etc/kubernetes/pki/ca.crt -text|grep -E "Before|After"

没有问题的话重启apiserver

mv /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/ && sleep 5 && mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/

更新kubeadm-config的configmap内容

kubeadm init phase upload-config kubeadm --config kubeadm-init.yaml

检查更新后的configmap

kubectl -n kube-system get configmap kubeadm-config -o yaml
  • No labels