Kubernetes

Kubeadm安装k8s集群升级100年证书时报错：Unable to connect to the server: EOF：求解决方法.

本文主要是介绍Kubeadm安装k8s集群升级100年证书时报错：Unable to connect to the server: EOF：求解决方法.，对大家解决编程问题具有一定的参考价值，需要的程序猿们随着小编来一起学习吧！

报错信息：

使用命令时：

 Kubelet服务报错：

 报错情况，在更新完k8s100年证书的时候，到最后重新启动kubelet服务的时候，服务是可以重新启动的，但是kubectl的命令是无法使用的，会等好长时间然后报出上面图片第一个的错误。还请各位大佬给出一些解决办法，实在是劳烦各位大佬了，自己找了好几天没有找到问题原因，万分感谢。

 

以下是更新证书的操作步骤，望大佬参考：

更新k8s证书100年步骤：

查看kubeadm版本：

[root@k8s-master01 ~]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.17", GitCommit:"953be8927218ec8067e1af2641e540238ffd7576", GitTreeState:"clean", BuildDate:"2023-02-22T13:33:14Z", GoVersion:"go1.19.6", Compiler:"gc", Platform:"linux/amd64"}

 

 同步一下K8S仓库的地址：

[root@k8s-master01 ~]# git clone https://gitee.com/mirrors/kubernetes.git
Cloning into 'kubernetes'...
remote: Enumerating objects: 1427037, done.
remote: Counting objects: 100% (14341/14341), done.
remote: Compressing objects: 100% (8326/8326), done.
remote: Total 1427037 (delta 9201), reused 8548 (delta 5365), pack-reused 1412696
Receiving objects: 100% (1427037/1427037), 911.55 MiB | 16.42 MiB/s, done.
Resolving deltas: 100% (1039605/1039605), done.
Checking out files: 100% (23746/23746), done.

 

切换分支到自己的k8s版本：

[root@k8s-master01 kubernetes]# git checkout v1.23.17
Checking out files: 100% (17024/17024), done.
Note: checking out 'v1.23.17'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b new_branch_name

HEAD is now at 953be89... Release commit for Kubernetes v1.23.17

启动一个Golang环境的容器：

[root@k8s-master01 kubernetes]# docker run -ti --rm -v `pwd`:/go/src/ registry.cn-beijing.aliyuncs.com/dotbalo/golang:kubeadm bash
Unable to find image 'registry.cn-beijing.aliyuncs.com/dotbalo/golang:kubeadm' locally
kubeadm: Pulling from dotbalo/golang
f606d8928ed3: Pull complete 
47db815c6a45: Pull complete 
bf4849400000: Pull complete 
a572f7a256d3: Pull complete 
643043c84a42: Pull complete 
4bbfdffcd51b: Pull complete 
7bacd2cea1ca: Pull complete 
4ca1c8393efa: Pull complete 
Digest: sha256:af620e3fb7f2a8ee5e070c2f5608cc6e1600ec98c94d7dd25778a67f1a0b792a
Status: Downloaded newer image for registry.cn-beijing.aliyuncs.com/dotbalo/golang:kubeadm

进入到Golang的源码目录：

root@85165a2f7d91:/go# cd /go/src/
root@85165a2f7d91:/go/src#

构建代理：

root@85165a2f7d91:/go/src# go env -w GOPROXY=https://goproxy.cn,direct
root@85165a2f7d91:/go/src# go env -w GOSUMDB=off

过滤配置文件证书有效时间：

root@85165a2f7d91:/go/src# grep "365" cmd/kubeadm/app/constants/constants.go
    CertificateValidity = time.Hour * 24 * 365

更改配置文件证书有效时间：

root@85165a2f7d91:/go/src# sed -i 's#365#365 * 100#g' cmd/kubeadm/app/constants/constants.go

查询一下是否更改：

root@85165a2f7d91:/go/src# grep "365" cmd/kubeadm/app/constants/constants.go
    CertificateValidity = time.Hour * 24 * 365 * 100

创建文件夹，它编译完之后，会把二进制文件输出到文件夹内：

root@85165a2f7d91:/go/src# mkdir -p _output/

更改一下权限：

root@85165a2f7d91:/go/src# chmod 777 -R _output/

编译一下，时间可能较长，耐心等待：

root@85165a2f7d91:/go/src# make WHAT=cmd/kubeadm

查看一下编译的目录：

root@5592256d5bb3:/go/src# ls _output/bin/kubeadm 
_output/bin/kubeadm

拷贝一下文件到./kubeadm下：

root@5592256d5bb3:/go/src# cp _output/bin/kubeadm ./kubeadm

执行到这里然后退出！！！

exit

拷贝一下我们的证书：

[root@k8s-master01 kubernetes]# cp kubeadm /opt/

 这个使用要使用kubeadm去更新一下我们的证书：

[root@k8s-master01 kubernetes]# /opt/kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

这里我们查看一下我们的kubeadm版本：

[root@k8s-master01 kubernetes]# /opt/kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"23+", GitVersion:"v1.23.17-dirty", GitCommit:"953be8927218ec8067e1af2641e540238ffd7576", GitTreeState:"dirty", BuildDate:"2023-03-30T11:19:36Z", GoVersion:"go1.19.2", Compiler:"gc", Platform:"linux/amd64"}

所有master节点上面检查是否更新了：

[root@k8s-master01 kubernetes]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 06, 2123 13:46 UTC   99y             ca                      no      
apiserver                  Mar 06, 2123 13:46 UTC   99y             ca                      no      
apiserver-etcd-client      Mar 06, 2123 13:46 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Mar 06, 2123 13:46 UTC   99y             ca                      no      
controller-manager.conf    Mar 06, 2123 13:46 UTC   99y             ca                      no      
etcd-healthcheck-client    Mar 06, 2123 13:46 UTC   99y             etcd-ca                 no      
etcd-peer                  Mar 06, 2123 13:46 UTC   99y             etcd-ca                 no      
etcd-server                Mar 06, 2123 13:46 UTC   99y             etcd-ca                 no      
front-proxy-client         Mar 06, 2123 13:46 UTC   99y             front-proxy-ca          no      
scheduler.conf             Mar 06, 2123 13:46 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 20, 2033 03:14 UTC   9y              no      
etcd-ca                 Mar 20, 2033 03:14 UTC   9y              no      
front-proxy-ca          Mar 20, 2033 03:14 UTC   9y              no

所有master节点重启kubelet：

[root@k8s-master01 kubernetes]# systemctl restart kubelet

 

到这里就报了上述错误，还望大佬给出解决办法，谢谢！

这篇关于Kubeadm安装k8s集群升级100年证书时报错：Unable to connect to the server: EOF：求解决方法.的文章就介绍到这儿，希望我们推荐的文章对大家有所帮助，也希望大家多多支持为之网！
您可能喜欢
栏目导航