报错

Unable to connect to the server: x509: certificate has expired or is not yet valid

三台master均需要执行

1. 检查证书是否过期

kubeadm certs check-expiration

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W0728 17:06:28.688527  840002 utils.go:69] The recommended value for "readOnlyPort" in "KubeletConfiguration" is: 0; the provided value is: 10255

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 28, 2026 07:56 UTC   364d            ca                      no      
apiserver                  Jul 28, 2026 07:56 UTC   364d            ca                      no      
apiserver-etcd-client      Jul 28, 2026 07:56 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Jul 28, 2026 07:56 UTC   364d            ca                      no      
controller-manager.conf    Jul 28, 2026 07:56 UTC   364d            ca                      no      
etcd-healthcheck-client    Jul 28, 2026 07:56 UTC   364d            etcd-ca                 no      
etcd-peer                  Jul 28, 2026 07:56 UTC   364d            etcd-ca                 no      
etcd-server                Jul 28, 2026 07:56 UTC   364d            etcd-ca                 no      
front-proxy-client         Jul 28, 2026 07:56 UTC   364d            front-proxy-ca          no      
scheduler.conf             Jul 28, 2026 07:56 UTC   364d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 23, 2034 15:42 UTC   8y              no      
etcd-ca                 Jul 23, 2034 15:42 UTC   8y              no      
front-proxy-ca          Jul 23, 2034 15:42 UTC   8y              no      

2. 备份原有证书

cp -r /etc/kubernetes /data/kubernetes.conf.bak

3. 更新证书

kubeadm certs renew all

4. 更新配置文件

kubeadm init phase kubeconfig all

5. 重启k8s的组件

cd /etc/kubernetes/
mv manifests manifests_bak
# 等待pod全部消失后，在启动
mv manifests_bak manifests
# 所有节点重启kubelet
systemctl restart kubelet

6. 更新kubectl证书

cp /etc/kubernetes/admin.conf ~/.kube/config