k8s问题排查：the existing bootstrap client certificate in /etc/kubernetes/kubelet.conf is expired_kubelet part of the existing bootstrap client cert

journalctl -u kubelet --no-pager 发现kubelet启动失败

E0728 23:35:23.526561 12500 bootstrap.go:265] part of  the existing bootstrap client certificate in /etc/kubernetes/kubelet.conf is expired: 2022-10-05 03:16:49 +0000 UTC
E0728 23:35:23.526583 12500 server.go:292] "Failed to run kubelet" err="failed to run Kubelet: unable to load bootstrap kubeconfig: stat /etc/kubernetes/bootstrap-kubelet.conf: no such file or directory
1
2

从日志给出的提示说明是证书过期导致。

• 统一查看证书是否过期 ：

kubeadm certs check-expiration 
1

过期，需要重新生成证书

• 备份并重新生成证书

cp -r /etc/kubernetes/pki /etc/kubernetes/pki.bak20230729
cd /etc/kubernetes/pki
kubeadm certs renew all
1
2
3

• 备份并重新生成配置文件

cp -r /etc/kubernetes /etc/kubernetes.bak
cd /etc/kubernetes
kubeadm init phase kubeconfig all
1
2
3

• 重启kubelet

systemctl restart kubelet
1

• 用更新后的admin.conf替换/root/.kube/config文件

cp /etc/kubernetes/admin.conf ~/.kube/config
1

这时候一定要注意是否存在.kube文件夹，有的话一定要先删除，否则永远卡在激活中状态


执行完删除命令，在执行上面的复制命令

rm -rf $HOME/.kube
cp /etc/kubernetes/admin.conf ~/.kube/config
1
2

• 查看kubelet启动状态

systemctl status kubelet
1

参考资料：kubernetes 坑人的错误！！！Unable to connect to the server: x509: certificate signed by unknown authority