kubernetes docker 运维 rancher2.5.0 版本证书过期处理

雷特森博客 2024-04-30 1 0

rancher2.5.0 版本证书过期处理

通过rancher界面可以很方便查看管理kubernetes中的一些资源，有助于一些对k8s不太熟悉的人排查业务问题（如开发），运维人员看个人爱好使用。

坑：通过docker 起2.5.0版本rancher遇到的，rancher证书的有效期只有一年，一年后web管理界面无法登录，登陆宿主机查看相应容器的日志发现以下报错

2023/05/10 02:43:21 [INFO] Waiting for k3s to start

2023/05/10 02:43:22 [INFO] Starting API controllers

2023/05/10 02:45:05 [FATAL] Get "https://127.0.0.1:6443/api?timeout=15m0s": x509: certificate signed by unknown authority

2023/05/10 02:45:06 [INFO] Rancher version v2.5.0 (65f3525cd) is starting

2023/05/10 02:45:06 [INFO] Rancher arguments {ACMEDomains:[] AddLocal:true Embedded:false BindHost: HTTPListenPort:80 HTTPSListenPort:443 K8sMode:auto Debug:false Trace:false NoCACerts:false AuditLogPath:/var/log/auditlog/rancher-api-audit.log AuditLogMaxage:10 AuditLogMaxsize:100 AuditLogMaxbackup:10 AuditLevel:0 Agent:false Features:}

2023/05/10 02:45:06 [INFO] Listening on /tmp/log.sock

2023/05/10 02:45:06 [INFO] Running etcd --data-dir=management-state/etcd --heartbeat-interval=500 --election-timeout=5000

2023/05/10 02:45:10 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": dial tcp 127.0.0.1:6443: connect: connection refused

2023/05/10 02:45:12 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate signed by unknown authority

2023/05/10 02:45:14 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate signed by unknown authority

2023/05/10 02:45:16 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate signed by unknown authority

2023/05/10 02:45:18 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate signed by unknown authority

2023/05/10 02:45:20 [INFO] Waiting for server to become available: Get "https://127.0.0.1:6443/version?timeout=15m0s": x509: certificate signed by unknown authority

可以先检查所有证书过期时间（7f773c5d1d2a 为相应的rancher容器id）

docker exec -it 7f773c5d1d2a /bin/bash

root@7f773c5d1d2a:/var/lib/rancher# cd k3s/server/tls

root@7f773c5d1d2a:/var/lib/rancher/k3s/server/tls# for i in `ls *.crt`; do openssl x509 -in $i -noout -dates ; done