1、查看证书到期时间：

kubeadm certs check-expiration

2、备份k8s配置

cp -rp /etc/kubernetes /etc/kubernetes.bak

3、删除旧的证书

rm -rf /etc/kubernetes/pki/apiserver.key

4、重新生成全部证书

kubeadm certs renew all

5、备份旧配置文件

mv /etc/kubernetes/*.conf /tmp/

6、生成所有配置文件

kubeadm init phase kubeconfig all

7、重启kubelet

systemctl restart kubelet

8、替换kubeconfig

cp /etc/kubernetes/admin.conf ~/.kube/config

9、查看证书时间（续一年）

kubeadm alpha certs check-expiration

10、重启kube-apiserver、kube-controller-manager、kube-scheduler组件容器

docker ps |grep kube-apiserver|grep -v pause|awk '{print $1}'|xargs -i docker restart {}

docker ps |grep kube-controller-manage|grep -v pause|awk '{print $1}'|xargs -i docker restart {}

docker ps |grep kube-scheduler|grep -v pause|awk '{print $1}'|xargs -i docker restart {}

11、查看kube-controller-manager日志

kubectl logs -f -n kube-system kube-controller-manager-master01

E1026 08:02:25.772750 1 leaderelection.go:325] error retrieving resource lock kube-system/kube-controller-manager: Unauthorized

以上日志不再打印，说明OK了。