1、查看证书过期时间

kubeadm certs check-expiration

2、更新所有证书

kubeadm certs renew all

3、停止、删除所有pod

for i in $(crictl ps -a|awk '{print $1}');do crictl stop $i;done

for i in $(crictl ps -a|awk '{print $1}');do crictl rm $i;done

4、等待pod更新，如etcd提示证书过期、还是加载的老证书那就更新一下master节点的etcd证书

#下面的操作需要在每个master节点单独执行

cd  /etc/kubernetes/pki/etcd

mkdir bak

mv server.* bak/

mv peer.* bak/

kubeadm init phase certs etcd-server  #更新本机证书

kubeadm init phase certs etcd-peer #更新本机证书

#删除pod新建

for i in $(crictl ps -a|awk '{print $1}');do crictl stop $i;done

for i in $(crictl ps -a|awk '{print $1}');do crictl rm $i;done