K8s更新证书

使用kubeadm安装的k8s集群，自动生成的集群内部认证证书，在一年后过期，所有核心组件无法z正常工作，这里记录一下更新证书方法。
1,备份原有文件：

1. mv /etc/kubernetes/pki/apiserver.crt /etc/kubernetes/pki/apiserver.crt.old
   
2. mv /etc/kubernetes/pki/apiserver.key /etc/kubernetes/pki/apiserver.key.old
   
3. mv /etc/kubernetes/pki/apiserver-kubelet-client.crt /etc/kubernetes/pki/apiserver-kubelet-client.crt.old
   
4. mv /etc/kubernetes/pki/apiserver-kubelet-client.key /etc/kubernetes/pki/apiserver-kubelet-client.key.old
   
5.  #mv /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.crt.old
   
6.  #mv /etc/kubernetes/pki/ca.key /etc/kubernetes/pki/ca.key.old
   
7.  #mv /etc/kubernetes/pki/front-proxy-ca.crt /etc/kubernetes/pki/front-proxy-ca.crt.old
   
8.  #mv /etc/kubernetes/pki/front-proxy-ca.key /etc/kubernetes/pki/front-proxy-ca.key.old
   
9. mv /etc/kubernetes/pki/front-proxy-client.crt /etc/kubernetes/pki/front-proxy-client.crt.old
   
10. mv /etc/kubernetes/pki/front-proxy-client.key /etc/kubernetes/pki/front-proxy-client.key.old
    
11.  #mv /etc/kubernetes/pki/sa.key /etc/kubernetes/pki/sa.key.old
    
12.  #mv /etc/kubernetes/pki/sa.pub /etc/kubernetes/pki/sa.pub.old

2，生产新证书：（kubeadm需要连接google服务器，这里用了pptp拨号才出去）

1. kubeadm alpha phase certs apiserver --apiserver-advertise-address 192.168.73.131 --apiserver-cert-extra-sans 192.168.73.143 --apiserver-cert-extra-sans 192.168.73.144 --apiserver-cert-extra-sans 192.168.73.145 --apiserver-cert-extra-sans k8s143 --apiserver-cert-extra-sans k8s144 --apiserver-cert-extra-sans k8s145 #143，144，145主机组成管理多活集群，131是浮动地址
2. kubeadm alpha phase certs apiserver-kubelet-client
   
3. kubeadm alpha phase certs front-proxy-client

3，备份旧配置文件：

1. mv /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.old
   
2. mv /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.old
   
3. mv /etc/kubernetes/controller-manager.conf /etc/kubernetes/controller-manager.conf.old
   
4. mv /etc/kubernetes/scheduler.conf /etc/kubernetes/scheduler.conf.old

4，生成新的配置文件：

1. kubeadm alpha phase kubeconfig all --apiserver-advertise-address 192.168.73.131
2. 
   
3. 同步配置文件：
4. scp admin.conf k8s144:/etc/kubernetes/
   scp controller-manager.conf k8s144:/etc/kubernetes/
   scp kubelet.conf k8s144:/etc/kubernetes/
   scp scheduler.conf k8s144:/etc/kubernetes/
   
   
   scp /etc/kubernetes/admin.conf k8s145:/etc/kubernetes/
   scp /etc/kubernetes/controller-manager.conf k8s145:/etc/kubernetes/
   scp /etc/kubernetes/kubelet.conf k8s145:/etc/kubernetes/
   scp /etc/kubernetes/scheduler.conf k8s145:/etc/kubernetes/
   
   
   scp /etc/kubernetes/apiserver* k8s144:/etc/kubernetes/
   scp /etc/kubernetes/front-proxy-client.* k8s144:/etc/kubernetes/
   
   
   scp /etc/kubernetes/apiserver* k8s145:/etc/kubernetes/
   scp /etc/kubernetes/front-proxy-client.* k8s145:/etc/kubernetes/
   
   

5, 重启服务：
在每个管理节点，列出kube-apiserver，kube-controller-manager, kube-scheduler 容器的id；
依次重启；

6，kubelet使用的/var/lib/kubelet/pki/kubelet/目录下的client证书，可以任意删除，启动自动重新获取；

7，更新kubectl 配置文件

1. cd ~/.kube/
   
2. cat /etc/kubernetes/admin.conf > ./config

8，查看集群状态

1. kubectl get node
   
2. kubectl get po --all-namespaces