Kubernetes
Kubeadm安装k8s集群升级100年证书时报错：Unable to connect to the server: EOF：求解决方法.
本文主要是介绍Kubeadm安装k8s集群升级100年证书时报错：Unable to connect to the server: EOF：求解决方法.，对大家解决编程问题具有一定的参考价值，需要的程序猿们随着小编来一起学习吧！
报错信息：
使用命令时：
Kubelet服务报错：
报错情况，在更新完k8s100年证书的时候，到最后重新启动kubelet服务的时候，服务是可以重新启动的，但是kubectl的命令是无法使用的，会等好长时间然后报出上面图片第一个的错误。还请各位大佬给出一些解决办法，实在是劳烦各位大佬了，自己找了好几天没有找到问题原因，万分感谢。
以下是更新证书的操作步骤，望大佬参考：
更新k8s证书100年步骤：
查看kubeadm版本：
[root@k8s-master01 ~]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.17", GitCommit:"953be8927218ec8067e1af2641e540238ffd7576", GitTreeState:"clean", BuildDate:"2023-02-22T13:33:14Z", GoVersion:"go1.19.6", Compiler:"gc", Platform:"linux/amd64"}
同步一下K8S仓库的地址：
[root@k8s-master01 ~]# git clone https://gitee.com/mirrors/kubernetes.git Cloning into 'kubernetes'... remote: Enumerating objects: 1427037, done. remote: Counting objects: 100% (14341/14341), done. remote: Compressing objects: 100% (8326/8326), done. remote: Total 1427037 (delta 9201), reused 8548 (delta 5365), pack-reused 1412696 Receiving objects: 100% (1427037/1427037), 911.55 MiB | 16.42 MiB/s, done. Resolving deltas: 100% (1039605/1039605), done. Checking out files: 100% (23746/23746), done.
切换分支到自己的k8s版本：
[root@k8s-master01 kubernetes]# git checkout v1.23.17 Checking out files: 100% (17024/17024), done. Note: checking out 'v1.23.17'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b new_branch_name HEAD is now at 953be89... Release commit for Kubernetes v1.23.17
启动一个Golang环境的容器：
[root@k8s-master01 kubernetes]# docker run -ti --rm -v `pwd`:/go/src/ registry.cn-beijing.aliyuncs.com/dotbalo/golang:kubeadm bash Unable to find image 'registry.cn-beijing.aliyuncs.com/dotbalo/golang:kubeadm' locally kubeadm: Pulling from dotbalo/golang f606d8928ed3: Pull complete 47db815c6a45: Pull complete bf4849400000: Pull complete a572f7a256d3: Pull complete 643043c84a42: Pull complete 4bbfdffcd51b: Pull complete 7bacd2cea1ca: Pull complete 4ca1c8393efa: Pull complete Digest: sha256:af620e3fb7f2a8ee5e070c2f5608cc6e1600ec98c94d7dd25778a67f1a0b792a Status: Downloaded newer image for registry.cn-beijing.aliyuncs.com/dotbalo/golang:kubeadm
进入到Golang的源码目录：
root@85165a2f7d91:/go# cd /go/src/ root@85165a2f7d91:/go/src#
构建代理：
root@85165a2f7d91:/go/src# go env -w GOPROXY=https://goproxy.cn,direct root@85165a2f7d91:/go/src# go env -w GOSUMDB=off
过滤配置文件证书有效时间：
root@85165a2f7d91:/go/src# grep "365" cmd/kubeadm/app/constants/constants.go
CertificateValidity = time.Hour * 24 * 365
更改配置文件证书有效时间：
root@85165a2f7d91:/go/src# sed -i 's#365#365 * 100#g' cmd/kubeadm/app/constants/constants.go
查询一下是否更改：
root@85165a2f7d91:/go/src# grep "365" cmd/kubeadm/app/constants/constants.go
CertificateValidity = time.Hour * 24 * 365 * 100
创建文件夹，它编译完之后，会把二进制文件输出到文件夹内：
root@85165a2f7d91:/go/src# mkdir -p _output/
更改一下权限：
root@85165a2f7d91:/go/src# chmod 777 -R _output/
编译一下，时间可能较长，耐心等待：
root@85165a2f7d91:/go/src# make WHAT=cmd/kubeadm
查看一下编译的目录：
root@5592256d5bb3:/go/src# ls _output/bin/kubeadm _output/bin/kubeadm
拷贝一下文件到./kubeadm下：
root@5592256d5bb3:/go/src# cp _output/bin/kubeadm ./kubeadm
执行到这里然后退出！！！
exit
拷贝一下我们的证书：
[root@k8s-master01 kubernetes]# cp kubeadm /opt/
这个使用要使用kubeadm去更新一下我们的证书：
[root@k8s-master01 kubernetes]# /opt/kubeadm certs renew all [renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' [renew] Error reading configuration from the Cluster. Falling back to default configuration certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
这里我们查看一下我们的kubeadm版本：
[root@k8s-master01 kubernetes]# /opt/kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"23+", GitVersion:"v1.23.17-dirty", GitCommit:"953be8927218ec8067e1af2641e540238ffd7576", GitTreeState:"dirty", BuildDate:"2023-03-30T11:19:36Z", GoVersion:"go1.19.2", Compiler:"gc", Platform:"linux/amd64"}
所有master节点上面检查是否更新了：
[root@k8s-master01 kubernetes]# kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' [check-expiration] Error reading configuration from the Cluster. Falling back to default configuration CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Mar 06, 2123 13:46 UTC 99y ca no apiserver Mar 06, 2123 13:46 UTC 99y ca no apiserver-etcd-client Mar 06, 2123 13:46 UTC 99y etcd-ca no apiserver-kubelet-client Mar 06, 2123 13:46 UTC 99y ca no controller-manager.conf Mar 06, 2123 13:46 UTC 99y ca no etcd-healthcheck-client Mar 06, 2123 13:46 UTC 99y etcd-ca no etcd-peer Mar 06, 2123 13:46 UTC 99y etcd-ca no etcd-server Mar 06, 2123 13:46 UTC 99y etcd-ca no front-proxy-client Mar 06, 2123 13:46 UTC 99y front-proxy-ca no scheduler.conf Mar 06, 2123 13:46 UTC 99y ca no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Mar 20, 2033 03:14 UTC 9y no etcd-ca Mar 20, 2033 03:14 UTC 9y no front-proxy-ca Mar 20, 2033 03:14 UTC 9y no
所有master节点重启kubelet：
[root@k8s-master01 kubernetes]# systemctl restart kubelet
到这里就报了上述错误，还望大佬给出解决办法，谢谢！
这篇关于Kubeadm安装k8s集群升级100年证书时报错：Unable to connect to the server: EOF：求解决方法.的文章就介绍到这儿，希望我们推荐的文章对大家有所帮助，也希望大家多多支持为之网！
您可能喜欢
-
云原生周刊：利用 eBPF 增强 K8s12-23
-
/kubernetes 1.32版本更新解读：新特性和变化一目了然12-20
-
拒绝 Helm？ 如何在 K8s 上部署 KRaft 模式 Kafka 集群？12-19
-
云原生周刊：Kubernetes v1.32 正式发布12-16
-
Kubernetes上运行Minecraft：打造开发者平台的例子12-13
-
深入 Kubernetes 的健康奥秘：探针（Probe）究竟有多强？12-12
-
运维实战：K8s 上的 Doris 高可用集群最佳实践12-10
-
2024年最好用的十大Kubernetes工具12-02
-
OPA守门人：Kubernetes集群策略编写指南12-02
-
云原生周刊：K8s 严重漏洞11-26
-
在Kubernetes (k8s) 中搭建三台 Nginx 服务器怎么实现？-icode9专业技术文章分享11-15
-
基于Kubernetes的自定义AWS云平台搭建指南11-05
-
基于Kubernetes Gateway API的现代流量管理方案11-05
-
在Kubernetes上部署你的第一个应用：Nginx服务器11-05
-
利用拓扑感知路由控制Kubernetes中的流量11-05
栏目导航
