Kubernets (k3s): expired certs on cluster

user_2215740 0
Viewed 2173

I just lost access to my k3s.

I had the certs check this week to if if they had been auto-updated... and it seen so:

[root@vmpkube001 tls]# for crt in *.crt; do      printf '%s: %s\n'      "$(date --date="$(openssl x509 -enddate -noout -in "$crt"|cut -d= -f 2)" --iso-8601)"      "$crt"; done | sort
2021-09-18: client-admin.crt
2021-09-18: client-auth-proxy.crt
2021-09-18: client-cloud-controller.crt
2021-09-18: client-controller.crt
2021-09-18: client-k3s-controller.crt
2021-09-18: client-kube-apiserver.crt
2021-09-18: client-kube-proxy.crt
2021-09-18: client-scheduler.crt
2021-09-18: serving-kube-apiserver.crt
2029-11-03: client-ca.crt
2029-11-03: request-header-ca.crt
2029-11-03: server-ca.crt

but the cli is broken: image

Same goes to the dashboard:

image

The cluster "age" was about 380~something days. I am running a "v1.18.12+k3s1" in a centos7 cluster.

I change the date on the server to be able to execute kubectl again... enter image description here The secrets are wrong... how to update this?

Node logs:

Nov 18 16:34:17 pmpnode001.agrotis.local k3s[6089]: time="2020-11-18T16:34:17.400604478-03:00" level=error msg="server https://127.0.0.1:33684/cacerts is not trusted: Get https://127.0.0.1:33684/cacerts: x509: certificate has expired or is not yet valid"

Not only that but every case of this problem in the internet says somethings about kubeadm alpha certs. There is no kubeadm, and the only "alpha" feature i have in kubeclt is debug.

k3s kubernetes ssl-certificate
2 Answers

I got it working.

it turn out that there is some bug in the auto-renew process. It has been patch up but they forgot to backport it to the 1.18 branch. I Had to update it to 1.19.4 to get it working.

user_22157400

To ignore this error, follow these steps:

Step 1. Stop k3s

systemctl stop k3s.service

Step 2. Stop time sync

hwclock --debug
    
timedatectl set-ntp 0
  
systemctl stop ntp.service 
    
systemctl status systemd-timesyncd.service

Step 3. Update date to <90 days from expiration

date $(date "+%m%d%H%M%Y" --date="90 days ago")

Step 4. Restart k3s

systemctl start k3s.service

Just run this to test cluster!

kubectl get nodes
user_6590770
Related