重置csr

重置csr

注意：下面操作仅在刚安装k8s后24小时内有效

分析：kubelet启动后会生成如下文件。kubelet.conf文件决定了csr的存在，如果要想重新获取csr,可以停掉kubelet，删除kubelet.conf文件，重启kubelet就可以获得csr

ls -l /etc/kubernetes/kubelet.conf
ls -l /etc/kubernetes/pki/kubelet*

[root@test2 ~]# ls -l /etc/kubernetes/kubelet.conf
-rw-------  root root  Jan  : /etc/kubernetes/kubelet.conf

[root@test2 ~]# ls -l /etc/kubernetes/pki/kubelet*
-rw-------  root root  Jan  : /etc/kubernetes/pki/kubelet-client------.pem
lrwxrwxrwx  root root    Jan  : /etc/kubernetes/pki/kubelet-client-current.pem -> /etc/kubernetes/pki/kubelet-client------.pem
-rw-r--r--  root root  Jan  : /etc/kubernetes/pki/kubelet.crt
-rw-------  root root  Jan  : /etc/kubernetes/pki/kubelet.key

查看目前所有csr

[root@test1 ~]# kubectl get csr
NAME                                                   AGE       REQUESTOR           CONDITION
node-csr-462w6AWPUkqlTnmKUT1gs6orq6WqBWaTO1XndyRA5co   55m       kubelet-bootstrap   Approved,Issued
node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY   28m       kubelet-bootstrap   Approved,Issued

删除node1节点csr

[root@test1 ~]# kubectl delete csr node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY
certificatesigningrequest.certificates.k8s.io "node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY" deleted

[root@test1 ~]# kubectl get csr
NAME                                                   AGE       REQUESTOR           CONDITION
node-csr-462w6AWPUkqlTnmKUT1gs6orq6WqBWaTO1XndyRA5co   57m       kubelet-bootstrap   Approved,Issued

停掉该节点的kubelet

[root@lab3 ~]# systemctl stop kubelet

删除该节点的kubelet.conf文件

[root@lab1 ~]# rm -rf /etc/kubernetes/kubelet.conf

重启该节点的kubelet

[root@lab1 ~]# systemctl restart kubelet

查看csr

[root@test1 kubernetes]# kubectl get csr
NAME                                                   AGE       REQUESTOR           CONDITION
node-csr-462w6AWPUkqlTnmKUT1gs6orq6WqBWaTO1XndyRA5co   1h        kubelet-bootstrap   Approved,Issued
node-csr-in1KxGY-YMGu_CMY1Psl_1ZYx4kMDPwNkBuFP5_OXZY   25s       kubelet-bootstrap   Pending

参照文档：

https://my.oschina.net/u/3390908/blog/1649764