Kubernetes 向 APIServer 证书中添加更多的域名或者IP

一、描述

通过kubeadm部署完成以后，忘记把公网的域名和ip地址放入到apiserver的证书里面了。通过以下的步骤可以重新更新一下apiserver证书里面的地址。

1.1、错误消息

# kubectl 1.25.0
akiraka@Aka:~/.kube$ kubectl get pod
Unable to connect to the server: x509: certificate is valid for 127.0.0.1, 10.103.97.2, 172.18.3.69, 10.96.0.1, not 124.71.193.123

# kubectl 1.26.0
akiraka@Aka:~/Downloads$ ./kubectl get pod -A
E0201 10:38:28.380170    4804 memcache.go:238] couldn't get current server API group list: Get "https://124.71.193.123:6443/api?timeout=32s": x509: certificate is valid for 127.0.0.1, 10.96.0.1, 10.103.97.2, 172.18.3.69, not 124.71.193.123

二、解决方法

由于证书无我这台机器外网地址则无法连接

2.1、备份现有的Cluster配置文件

kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' > kubeadm.yaml

2.2、在yaml以下的段添加公网ip和域名

# 编辑 kubeadm.yaml 文件
vim kubeadm.yaml

# 找到这个位置
apiServer:
  certSANs:
  - 127.0.0.1
  - apiserver.cluster.local
  - 10.103.97.2
  - 172.18.3.69
  - 124.71.193.143 # 新增的
  extraArgs:
    audit-log-format: json

2.3、备份老的apiserver的证书文件

mkdir -p /etc/kubernetes/pki/backup
mv /etc/kubernetes/pki/apiserver.{crt,key} /etc/kubernetes/pki/backup/

2.4、生产新的apiserver证书文件

kubeadm init phase certs apiserver --config kubeadm.yaml

2.5、验证

akiraka@Aka:~/Downloads$ kubectl get pod -A
NAMESPACE          NAME                                      READY   STATUS    RESTARTS   AGE
calico-apiserver   calico-apiserver-569cc57b6b-5gz6q         1/1     Running   0          41m
calico-apiserver   calico-apiserver-569cc57b6b-f4n7f         1/1     Running   0          41m
calico-system      calico-kube-controllers-7f55d475d-4g6tr   1/1     Running   0          42m
calico-system      calico-node-fxltc                         1/1     Running   0          42m
calico-system      calico-typha-6764dfd865-m492c             1/1     Running   0          42m
calico-system      csi-node-driver-rczms                     2/2     Running   0          41m
kube-system        coredns-787d4945fb-lthlb                  1/1     Running   0          42m
kube-system        coredns-787d4945fb-spdtg                  1/1     Running   0          42m
kube-system        etcd-ecs-a528-0001                        1/1     Running   0          42m
kube-system        kube-apiserver-ecs-a528-0001              1/1     Running   0          42m
kube-system        kube-controller-manager-ecs-a528-0001     1/1     Running   0          42m
kube-system        kube-proxy-gnw5r                          1/1     Running   0          42m
kube-system        kube-scheduler-ecs-a528-0001              1/1     Running   0          42m
tigera-operator    tigera-operator-dd6596576-72wmm           1/1     Running   0          42m