How to update kubernetes certificates

By default ,Kubernetes Certificate required every other year renew once , The following is a documented certificate update process .

1. Check the certificate

stay Master View the certificate expiration time on the node :

1 2 3 4 5 6 7 8 910111213

kubeadm certs check-expirationCERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGEDadmin.conf Apr 02, 2023 09:53 UTC 296d no apiserver Apr 02, 2023 09:53 UTC 296d ca no apiserver-kubelet-client Apr 02, 2023 09:53 UTC 296d ca no controller-manager.conf Apr 02, 2023 09:53 UTC 296d no front-proxy-client Apr 02, 2023 09:53 UTC 296d front-proxy-ca no scheduler.conf Apr 02, 2023 09:53 UTC 296d no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGEDca Mar 30, 2032 09:53 UTC 9y no front-proxy-ca Mar 30, 2032 09:53 UTC 9y no

2. Back up related files

Here you can directly back up the entire Kubernetes The configuration file

1	cp -r /etc/kubernetes /etc/kubernetes.old

3. At every Master Execute the command on the node to update the certificate

1 2 3 4 5 6 7 8 910

kubeadm certs renew allcertificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewedcertificate for serving the Kubernetes API renewedcertificate for the API server to connect to kubelet renewedcertificate embedded in the kubeconfig file for the controller manager to use renewedcertificate for the front proxy client renewedcertificate embedded in the kubeconfig file for the scheduler manager to use renewedDone renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

4. At every Master Restart related services on the node

1	docker ps |egrep "k8s_kube-apiserver|k8s_kube-scheduler|k8s_kube-controller"|awk '{print $1}'|xargs docker restart

If etcd Start with a container , You also need to reboot .

5. to update ~/.kube/config file

12	sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id -u):$(id -g) $HOME/.kube/config