背景：
使用kubeadm安装的kubernetes（1.11.6）集群，使用了一年以后，登录master无法正常查询节点以及pod信息,但是服务可以正常访问。
报错内容如下：
$ kubectl get no
error: the server doesn't have a resource type "no"
$ kubectl get -n kube-system po
error: the server doesn't have a resource type "po"
通过度娘以及谷歌的查询，最好发现是因为证书过期导致，官方的说法是，通过这种方式，让用户不断的升级版本，现在这套环境上跑着用户的生产环境，不可能去做升级或是重装的事情，这个影响太大了，所以需要在不重装kubernates的前提上，把这个问题解决掉。
处理过程如下：
备份证书(3 master)
$ mv /etc/kubernetes/pki/apiserver.key /etc/kubernetes/pki/apiserver.key.old
$ mv /etc/kubernetes/pki/apiserver.crt /etc/kubernetes/pki/apiserver.crt.old
$ mv /etc/kubernetes/pki/apiserver-kubelet-client.crt /etc/kubernetes/pki/apiserver-kubelet-client.crt.old
$ mv /etc/kubernetes/pki/apiserver-kubelet-client.key /etc/kubernetes/pki/apiserver-kubelet-client.key.old
$ mv /etc/kubernetes/pki/front-proxy-client.crt /etc/kubernetes/pki/front-proxy-client.crt.old
$ mv /etc/kubernetes/pki/front-proxy-client.key /etc/kubernetes/pki/front-proxy-client.key.old
制作新的证书
$ kubeadm alpha phase certs apiserver --apiserver-advertise-address 192.168.175.61
[certificates] Generated apiserver certificate and key.
[certificates] apiserver serving cert is signed for DNS names [ubuntu kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.175.61]
$ kubeadm alpha phase certs apiserver-kubelet-client
[certificates] Generated apiserver-kubelet-client certificate and key.
$ kubeadm alpha phase certs front-proxy-client
[certificates] Generated front-proxy-client certificate and key.
将证书分发至每个master
$ scp -r /etc/kubernetes/pki master2:/etc/kubernetes/pki
$ scp -r /etc/kubernetes/pki master3:/etc/kubernetes/pki
备份配置文件(3 master都需备份)
$ mv /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.old
$ mv /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.old
$ mv /etc/kubernetes/controller-manager.conf /etc/kubernetes/controller-manager.conf.old
$ mv /etc/kubernetes/scheduler.conf /etc/kubernetes/scheduler.conf.old
制作新配置文件(3 master都需操作)
$ kubeadm alpha phase kubeconfig all --apiserver-advertise-address 192.168.175.61
确认kubectl正在查找正确的配置文件路径
$ mv $HOME/.kube/config $HOME/.kube/config.old
$ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
$ sudo chown $(id -u):$(id -g) $HOME/.kube/config
$ sudo chmod 777 $HOME/.kube/config
$ export KUBECONFIG=$HOME/.kube/config
重启kube-apiserver，kube-controller-manager, kube-scheduler
当做完以上操作以后，我的集群恢复正常
$ kubectl get no
NAME STATUS ROLES AGE VERSION
k8s-m1 Ready master 1y v1.11.6
k8s-m2 Ready master 1y v1.11.6
k8s-m3 Ready master 1y v1.11.6
k8s-mysql Ready <none> 1y v1.11.6
$ kubectl get -n kube-system po
NAME READY STATUS RESTARTS AGE
coredns-6d7874cb5-sqw9h 1/1 Running 0 30d
coredns-6d7874cb5-vzt4q 1/1 Running 0 4d
kube-apiserver-k8s-m1 1/1 Running 0 30d
kube-apiserver-k8s-m2 1/1 Running 0 30d
kube-apiserver-k8s-m3 1/1 Running 0 30d
kube-controller-manager-k8s-m1 1/1 Running 0 30d
kube-controller-manager-k8s-m2 1/1 Running 0 30d
kube-controller-manager-k8s-m3 1/1 Running 0 30d
kube-flannel-ds-cbl4h 1/1 Running 0 34d
kube-flannel-ds-cs9lb 1/1 Running 0 34d
kube-flannel-ds-mbhvd 1/1 Running 0 33d
kube-flannel-ds-sjf54 1/1 Running 0 32d
kube-proxy-cbp7k 1/1 Running 0 81d
kube-proxy-hc4bd 1/1 Running 0 198d
kube-proxy-ssrpq 1/1 Running 0 34d
kube-proxy-wtvzl 1/1 Running 0 180d
kube-scheduler-k8s-m1 1/1 Running 0 30d
kube-scheduler-k8s-m2 1/1 Running 0 30d
kube-scheduler-k8s-m3 1/1 Running 0 30d
kubernetes-dashboard-d4866d978-fmkgg 1/1 Running 0 30d
node-exporter-6wqwb 1/1 Running 0 10d
node-exporter-k6x6w 1/1 Running 0 10d
node-exporter-s8knb 1/1 Running 0 10d
网友评论