k8s证书过期问题

[root@master pki]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Dec 28, 2021 08:24 UTC          ca                      no      
apiserver                  Dec 28, 2021 08:24 UTC          ca                      no      
apiserver-etcd-client      Dec 28, 2021 08:24 UTC          etcd-ca                 no      
apiserver-kubelet-client   Dec 28, 2021 08:24 UTC          ca                      no      
controller-manager.conf    Dec 28, 2021 08:24 UTC          ca                      no      
etcd-healthcheck-client    Dec 28, 2021 08:24 UTC          etcd-ca                 no      
etcd-peer                  Dec 28, 2021 08:24 UTC          etcd-ca                 no      
etcd-server                Dec 28, 2021 08:24 UTC          etcd-ca                 no      
front-proxy-client         Dec 28, 2021 08:24 UTC          front-proxy-ca          no      
scheduler.conf             Dec 28, 2021 08:24 UTC          ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Dec 20, 2031 07:18 UTC   9y              no      
etcd-ca                 Dec 20, 2031 07:18 UTC   9y              no      
front-proxy-ca          Dec 20, 2031 07:18 UTC   9y              no  

kubeamd  version

make WHAT=cmd/kubeadm GOFLAGS=-v

cp  /usr/bin/kubeadm /usr/bin/kubeadm_bak
cp -r  /etc/kubernetes/pki /etc/kubernetes/pki_bak

[root@master bin]# pwd
/opt/kubernetes-master/_output/bin
[root@master bin]# 
[root@master bin]# 
[root@master bin]# ll
total 79136
-rwxr-xr-x 1 root root  6295552 Dec 28 16:58 conversion-gen
-rwxr-xr-x 1 root root  6021120 Dec 28 16:58 deepcopy-gen
-rwxr-xr-x 1 root root  6029312 Dec 28 16:58 defaulter-gen
-rwxr-xr-x 1 root root  3376703 Dec 28 16:58 go2make
-rwxr-xr-x 1 root root 45187072 Dec 28 17:00 kubeadm
-rwxr-xr-x 1 root root  8126464 Dec 28 16:58 openapi-gen
-rwxr-xr-x 1 root root  5996544 Dec 28 16:58 prerelease-lifecycle-gen
[root@master bin]# 
[root@master bin]# cp kubeadm /usr/bin/
cp: overwrite ‘/usr/bin/kubeadm’? y

[root@master bin]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

[root@master bin]# docker ps | grep -v pause | grep -E "etcd|scheduler|controller|apiserver" | awk '{print $1}' | awk '{print "docker","restart",$1}' | bash
3af36fb43da0
6ff7681f2556
91eaaacf2664
b886b4e5f623