K8s更新证书

使用kubeadm安装的k8s集群，自动生成的集群内部认证证书，在一年后过期，所有核心组件无法z正常工作，这里记录一下更新证书方法。
1,备份原有文件：

mv /etc/kubernetes/pki/apiserver.crt /etc/kubernetes/pki/apiserver.crt.old
mv /etc/kubernetes/pki/apiserver.key /etc/kubernetes/pki/apiserver.key.old
mv /etc/kubernetes/pki/apiserver-kubelet-client.crt /etc/kubernetes/pki/apiserver-kubelet-client.crt.old
mv /etc/kubernetes/pki/apiserver-kubelet-client.key /etc/kubernetes/pki/apiserver-kubelet-client.key.old
 #mv /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.crt.old
 #mv /etc/kubernetes/pki/ca.key /etc/kubernetes/pki/ca.key.old
 #mv /etc/kubernetes/pki/front-proxy-ca.crt /etc/kubernetes/pki/front-proxy-ca.crt.old
 #mv /etc/kubernetes/pki/front-proxy-ca.key /etc/kubernetes/pki/front-proxy-ca.key.old
mv /etc/kubernetes/pki/front-proxy-client.crt /etc/kubernetes/pki/front-proxy-client.crt.old
mv /etc/kubernetes/pki/front-proxy-client.key /etc/kubernetes/pki/front-proxy-client.key.old
 #mv /etc/kubernetes/pki/sa.key /etc/kubernetes/pki/sa.key.old
 #mv /etc/kubernetes/pki/sa.pub /etc/kubernetes/pki/sa.pub.old

2，生产新证书：（kubeadm需要连接google服务器，这里用了pptp拨号才出去）

kubeadm alpha phase certs apiserver --apiserver-advertise-address 192.168.73.131 --apiserver-cert-extra-sans 192.168.73.143 --apiserver-cert-extra-sans 192.168.73.144 --apiserver-cert-extra-sans 192.168.73.145 --apiserver-cert-extra-sans k8s143 --apiserver-cert-extra-sans k8s144 --apiserver-cert-extra-sans k8s145 #143，144，145主机组成管理多活集群，131是浮动地址
kubeadm alpha phase certs apiserver-kubelet-client
kubeadm alpha phase certs front-proxy-client

3，备份旧配置文件：

mv /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.old
mv /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.old
mv /etc/kubernetes/controller-manager.conf /etc/kubernetes/controller-manager.conf.old
mv /etc/kubernetes/scheduler.conf /etc/kubernetes/scheduler.conf.old

4，生成新的配置文件：

kubeadm alpha phase kubeconfig all --apiserver-advertise-address 192.168.73.131

同步配置文件：
scp admin.conf k8s144:/etc/kubernetes/
scp controller-manager.conf k8s144:/etc/kubernetes/
scp kubelet.conf k8s144:/etc/kubernetes/
scp scheduler.conf k8s144:/etc/kubernetes/


scp /etc/kubernetes/admin.conf k8s145:/etc/kubernetes/
scp /etc/kubernetes/controller-manager.conf k8s145:/etc/kubernetes/
scp /etc/kubernetes/kubelet.conf k8s145:/etc/kubernetes/
scp /etc/kubernetes/scheduler.conf k8s145:/etc/kubernetes/


scp /etc/kubernetes/apiserver* k8s144:/etc/kubernetes/
scp /etc/kubernetes/front-proxy-client.* k8s144:/etc/kubernetes/


scp /etc/kubernetes/apiserver* k8s145:/etc/kubernetes/
scp /etc/kubernetes/front-proxy-client.* k8s145:/etc/kubernetes/

5, 重启服务：
在每个管理节点，列出kube-apiserver，kube-controller-manager, kube-scheduler 容器的id；
依次重启；

6，kubelet使用的/var/lib/kubelet/pki/kubelet/目录下的client证书，可以任意删除，启动自动重新获取；

7，更新kubectl 配置文件

cd ~/.kube/
cat /etc/kubernetes/admin.conf > ./config

8，查看集群状态

kubectl get node
kubectl get po --all-namespaces

9，补充：
    /etc/kubernetes/pki/etcd/下的证书，在三个管理节点，内容是不同的；
    9.1 直接更新：kubeadm certs renew etcd-apiserver
kubeadm certs renew etcd-peer
kubeadm certs renew etcd-healthcheck-client
    9.2 如果不小心覆盖掉了，要先删除 通过以下命令重新生成。
rm -rf etcd-peer* 
rm -rf apiserver*
rm -rf healthcheck-client *  
 
kubeadm init phase certs etcd-peer
kubeadm init phase certs etcd-server
kubeadm init phase certs etcd-healthcheck-client