使用kubeadm安装集群默认证书的有效期是一年，过期后需要重新续期

• 这套方法是在已经超过一年的有效期之后不得已采取的方法，最好还是在过期之前进行证书的续期
• 在过期之前进行续期请参考官方文档https://kubernetes.io/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

首先查看证书是否有效：

sudo openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '
输出：
            Not Before: May 24 03:32:37 2019 GMT
            Not After : May 23 03:32:38 2020 GMT

在当前目录下编辑配置文件kubeadm.conf并写入以下内容：

apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.15.0  # kubernetes 版本
apiServer:
  certSANs:
  - 192.168.188.xxx # master 所有节点IP地址，包括master和slave
  - 192.168.188.xxx # slave
  - 192.168.188.xxx # slave
  extraArgs:
    service-node-port-range: 80-32767
    advertise-address: 0.0.0.0
controlPlaneEndpoint: "192.168.188.xxx:6443"  # APIserver 地址,也就是master节点地址
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers #这里使用国内的镜像仓库，否则在重新签发的时候会报错

更新证书命令：

kubeadm alpha certs renew all --config kubeadm.conf
sudo openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '

输出：
            Not Before: Jun 24 10:55:40 2019 GMT
            Not After : Jul 27 08:37:35 2021 GMT

重新生成配置文件：

mv /etc/kubernetes/*.conf ~/.
kubeadm init phase kubeconfig all --config kubeadm.conf

更新.kube下的配置文件：

mv $HOME/.kube/config $HOME/.kube/config.old
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

重启kube-apiserver,kube-controller,kube-scheduler,etcd这4个容器：

docker ps | grep -v pause | grep -E "etcd|scheduler|controller|apiserver" | awk '{print $1}' | awk '{print "docker","restart",$1}' | bash

到这一步master节点就更新完成了，然后获取token在更新slave节点时要用

kubeadm token create

接下来需要ssh到每个slave节点让他们重新注册到master节点,下面会把kube2和kube3两个slave节点注册到kube1这个master节点上去

sudo kubeadm join --token=<token>  <ip of master node>:<port used 6443 is the default> --node-name <should be the same one >
eg:
sudo kubeadm join --token=ngazdd.43ufakkceyhst2j5  192.168.188.xxx:6443 --node-name kube2 --discovery-token-unsafe-skip-ca-verification
sudo kubeadm join --token=ngazdd.43ufakkceyhst2j5  192.168.188.xxx:6443 --node-name kube3 --discovery-token-unsafe-skip-ca-verification

此时会报错，提示有些文件已存在，并且10250端口已存在

root@kube3:~# sudo kubeadm join --token=ngazdd.43ufakkceyhst2j5  192.168.188.xxx:6443 --node-name kube3 --discovery-token-unsafe-skip-ca-verification
[preflight] Running pre-flight checks
	[WARNING Service-Docker]: docker service is not enabled, please run 'systemctl enable docker.service'
	[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
error execution phase preflight: [preflight] Some fatal errors occurred:
	[ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
	[ERROR FileAvailable--etc-kubernetes-bootstrap-kubelet.conf]: /etc/kubernetes/bootstrap-kubelet.conf already exists
	[ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists

需要删除这些已存在的端口，并且关闭kubelet

root@kube3:~# rm -rf /etc/kubernetes/kubelet.conf
root@kube3:~# rm -rf /etc/kubernetes/bootstrap-kubelet.conf
root@kube3:~# rm -rf /etc/kubernetes/pki/ca.crt
root@kube3:~# systemctl stop kubelet

再次执行就加入成功了

root@kube3:~# sudo kubeadm join --token=ngazdd.43ufakkceyhst2j5  192.168.188.xxx:6443 --node-name kube3 --discovery-token-unsafe-skip-ca-verification
[preflight] Running pre-flight checks
	[WARNING Service-Docker]: docker service is not enabled, please run 'systemctl enable docker.service'
	[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.15" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Activating the kubelet service
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

https://www.cnblogs.com/xiaoyuxixi/p/12667983.html
https://github.com/kubernetes/kubeadm/issues/581