一.第一种解决方法

1.修改kube-controller-manager.service添加或者修改如下内容

--experimental-cluster-signing-duration=87600h     \

然后执行以下命令重启kube-controller-manager

systemctl daemon-reload
systemctl restart kube-controller-manager

2.执行以下步骤重新生成kubelet证书,xx.xx.xx.xx为k8s apiserver的 IP

mkdir -p /app/k8s
cd /app/k8s

export KUBE_APISERVER="https://xx.xx.xx.xx:6443"
export node_name="kube-node1" 

创建 token

export BOOTSTRAP_TOKEN=$(kubeadm token create \
--description kubelet-bootstrap-token \
--groups system:bootstrappers:${node_name} \
--kubeconfig ~/.kube/config)

#设置集群参数
kubectl config set-cluster kubernetes \
--certificate-authority=/etc/kubernetes/cert/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig

#设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
--token=${BOOTSTRAP_TOKEN} \
--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig

#设置上下文参数
kubectl config set-context default \
--cluster=kubernetes \
--user=kubelet-bootstrap \
--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig

 设置默认上下文
kubectl config use-context default --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig

kubeadm token list --kubeconfig ~/.kube/config

rm -rf /etc/kubernetes/kubelet-bootstrap.kubeconfig
cp kubelet-bootstrap-${node_name}.kubeconfig /etc/kubernetes/kubelet-bootstrap.kubeconfig

rm -rf /etc/kubernetes/cert/kubelet-client*

service kubelet restart
sleep 5
kubectl get csr | awk '{print $1}' | grep -v "NAME"|xargs kubectl certificate approve

 

3.在kulebet服务器执行以下命令验证kubelet证书的有效期，如果是10年代表修改成功

二.第二种解决方法
1.修改kubelet.service添加如下内容
–feature-gates=RotateKubeletServerCertificate=true --feature-gates=RotateKubeletClientCertificate=true --rotate-certificates \

2.修改kube-controller-manager.service添加如下内容
#证书有效期为10年
–experimental-cluster-signing-duration=87600h0m0s --feature-gates=RotateKubeletServerCertificate=true \

3.创建自动批准相关CSR请求的ClusterRole
3.1.vim tls-instructs-csr.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeserver
rules:

• apiGroups: [“certificates.k8s.io”]
  resources: [“certificatesigningrequests/selfnodeserver”]
  verbs: [“create”]

3.2.kubectl apply -f tls-instructs-csr.yaml

4.自动批准 kubelet-bootstrap 用户 TLS bootstrapping 首次申请证书的 CSR 请求
kubectl create clusterrolebinding node-client-auto-approve-csr --clusterrole=system:certificates.k8s.io:certificatesigningrequests:nodeclient --user=kubelet-bootstrap

5.自动批准 system:nodes 组用户更新 kubelet 10250 api 端口证书的 CSR 请求
kubectl create clusterrolebinding node-client-auto-renew-crt --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeclient --group=system:nodes

6.重启kube-controller-manager服务

systemctl daemon-reload
systemctl restart kube-controller-manager

7.进入到ssl配置目录，删除 kubelet 证书
cd /etc/kubernetes/cert
rm -f kubelet-client*.pem kubelet.key kubelet.crt

8.重启kubelet服务
systemctl daemon-reload
systemctl restart kubelet

9.进入到ssl配置目录，查看kubelet-client证书有效期
cd /etc/kubernetes/cert
openssl x509 -in kubelet-client-current.pem -noout -text | grep “Not”
Not Before: May 13 02:36:00 2019 GMT
Not After : May 10 02:36:00 2029 GMT