对于版本1.21.5，这是我的解决方案：
步骤1：
ssh到主节点，然后在步骤2中检查证书。
步骤2：
运行此命令：kubeadm certs check-expiration
root@kube-master-1:~
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Oct 21, 2022 16:05 UTC <invalid> no
apiserver Oct 21, 2022 16:05 UTC <invalid> ca no
!MISSING! apiserver-etcd-client
apiserver-kubelet-client Oct 21, 2022 16:05 UTC <invalid> ca no
controller-manager.conf Oct 21, 2022 16:05 UTC <invalid> no
!MISSING! etcd-healthcheck-client
!MISSING! etcd-peer
!MISSING! etcd-server
front-proxy-client Oct 21, 2022 16:05 UTC <invalid> front-proxy-ca no
scheduler.conf Oct 21, 2022 16:05 UTC <invalid> no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Oct 19, 2031 16:05 UTC 8y no
!MISSING! etcd-ca
front-proxy-ca Oct 19, 2031 16:05 UTC 8y no
并查看它们全部在昨天过期。
第三步：
备份所有现有证书：
root@kube-master-1:~
root@kube-master-1:~
root@kube-master-1:~
root@kube-master-1:~
root@kube-master-1:~
步骤4：
要更新所有证书，请运行以下命令：kubeadm certs renew all
root@kube-master-1:~
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W1023 15:15:16.234334 2175921 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.233.0.10]; the provided value is: [169.254.25.10]
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
第五步：第四步的最后一行告诉我们重要注意事项：
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates
为完成此运行：
kubectl -n kube-system delete pod -l 'component=kube-apiserver'
kubectl -n kube-system delete pod -l 'component=kube-controller-manager'
kubectl -n kube-system delete pod -l 'component=kube-scheduler'
kubectl -n kube-system delete pod -l 'component=etcd'
步骤6：然后重新启动主节点。
步骤7：查看结果：
root@kube-master-1:~
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W1023 15:15:23.141925 2177263 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.233.0.10]; the provided value is: [169.254.25.10]
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Oct 23, 2023 07:15 UTC 364d no
apiserver Oct 23, 2023 07:15 UTC 364d ca no
apiserver-kubelet-client Oct 23, 2023 07:15 UTC 364d ca no
controller-manager.conf Oct 23, 2023 07:15 UTC 364d no
front-proxy-client Oct 23, 2023 07:15 UTC 364d front-proxy-ca no
scheduler.conf Oct 23, 2023 07:15 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Oct 19, 2031 16:05 UTC 8y no
front-proxy-ca Oct 19, 2031 16:05 UTC 8y no
所有这些都将更新到2023年。
