场景：kubernetes(1.1.2版本)默认证书有效期是一年，到期后需要重新生成
方案一：集群处于不可用状态，手动更新证书和配置文件
重新生成证书
在所有控制平面执行以下命令，备份或删除过期证书
mkdir -p /etc/kubernetes/pki.bak/etcd
cd /etc/kubernetes/pki
mv apiserver* front-proxy-client* /etc/kubernetes/pki.bak
cd /etc/kubernetes/pki/etcd/
mv healthcheck-client* peer* server* /etc/kubernetes/pki.bak/etcd
可以选择保留ca证书，ca证书有效期一般为10年，可以重用，不需要删除
如果选择删除所有证书，这样的话就需要手动将第一个控制平面新生成的ca证书copy到其它控制平面的对应目录中
ca证书如下:
/etc/kubernetes/pki/ca.crt
/etc/kubernetes/pki/ca.key
/etc/kubernetes/pki/front-proxy-ca.crt
/etc/kubernetes/pki/front-proxy-ca.key
/etc/kubernetes/pki/sa.key
/etc/kubernetes/pki/sa.pub
/etc/kubernetes/pki/etcd/ca.crt
/etc/kubernetes/pki/etcd/ca.key
执行以下命令生成新证书
kubeadm alpha phase certs all --config=kubeadm.yaml
其中kubeadm.yaml为初始化集群时使用的配置文件，具体配置如下
（kubeadm config view）
kind: ClusterConfiguration
apiVersion: kubeadm.k8s.io/v1beta1
controlPlaneEndpoint: "192.168.100.170:6443"
apiServer:
certSANS:
- master1
- master2
- master3
- 192.168.100.170
- 192.168.100.171
- 192.168.100.181
- 192.168.100.191
重新生成配置文件
在每个控制平面节点执行以下命令，备份并重新生成配置文件，包括admin.conf、controller-manager.conf、kubelet.conf、scheduler.conf
cd /etc/kubernetes
mkdir conf.bak
mv *.conf conf.bak/
kubeadm alpha phase kubeconfig all --config kubeadm.yaml
在每个worker节点执行以下命令，备份重新生成kubelet的配置文件
cd /etc/kubernetes
mkdir conf.bak
mv *.conf conf.bak/
kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) --config kubeadm.yaml > /etc/kubernetes/kubelet.conf
注意，一般来说worker节点上只有ca.crt证书，没有ca.key，生成配置文件时会报错，这时需要从控制平面将ca.key拷贝过来，配置文件生成完毕后即可删除。上述命令在某版本执行时报错 可以改写为：kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) --apiserver-advertise-address 192.168.100.170 > /etc/kubernetes/kubelet.conf
在每个worker节点执行以下命令，备份或删除过期的证书（kubelet启动时会自动生成pki目录及证书），然后重启kubelet。
mv /var/lib/kubelet/pki /var/lib/kubelet/pki.bak
systemctl daemon-reload && systemctl restart kubelet
注意：命令执行过程中可能有配置文件版本与kubeadm不配套的情况，这时候按提示升级配置文件即可，如下
kubeadm config migrate --old-config old.yaml --new-config new.yaml
最后重启管理部件pod，包括etcd，apiserver，controller-manager，scheduler。如果集群不可用，可以到对应节点上通过docker rm 的方式删除容器，kubelet会自动拉起新的pod
踩坑：
etcd证书使用本地外部yaml生成
kubeadm init phase certs all --config=/home/kubernetes/config_1.13_local_etcd.yaml
当出现 Unable to connect to the server: x509: certificate has expired or is not yet valid
mv ~/.kube/config ~/.kube/config.bak && cp /etc/kubernetes/admin.conf ~/.kube/config
方案二：（未实践）如果集群正常使用中，则可以使用kubeadm进行证书轮换
检查证书是否过期
root@master1:~/.kube# kubeadm alpha certs check-expiration
CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
admin.conf Dec 30, 2020 02:43 UTC 364d no
apiserver Dec 30, 2020 02:25 UTC 364d no
apiserver-etcd-client Dec 30, 2020 02:25 UTC 364d no
apiserver-kubelet-client Dec 30, 2020 02:25 UTC 364d no
controller-manager.conf Jul 07, 2020 08:16 UTC 189d no
etcd-healthcheck-client Jul 04, 2020 09:26 UTC 186d no
etcd-peer Jul 04, 2020 09:26 UTC 186d no
etcd-server Jul 04, 2020 09:26 UTC 186d no
front-proxy-client Dec 30, 2020 02:25 UTC 364d no
scheduler.conf Jul 07, 2020 08:16 UTC 189d no
证书轮换
# Step 1): Backup old certs and kubeconfigs
mkdir /etc/kubernetes.bak
cp -r /etc/kubernetes/pki/ /etc/kubernetes.bak
cp /etc/kubernetes/*.conf /etc/kubernetes.bak
# Step 2): Renew all certs
kubeadm alpha certs renew all --config kubeadm.yaml
# Step 3): Renew all kubeconfigs
kubeadm alpha kubeconfig user --client-name=admin
kubeadm alpha kubeconfig user --org system:masters --client-name kubernetes-admin > /etc/kubernetes/admin.conf
kubeadm alpha kubeconfig user --client-name system:kube-controller-manager > /etc/kubernetes/controller-manager.conf
kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) > /etc/kubernetes/kubelet.conf
kubeadm alpha kubeconfig user --client-name system:kube-scheduler > /etc/kubernetes/scheduler.conf
# Another way to renew kubeconfigs
# kubeadm init phase kubeconfig all --config kubeadm.yaml
# Step 4): Copy certs/kubeconfigs and restart Kubernetes services
