Kubernetes v1.21集群证书更新后kubectl认证失败如何解决？

我按照以下步骤更新Kubernetes v1.21集群证书：

[root@k8smasterone ~]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

随后执行systemctl restart kubelet重启master节点kubelet，但执行kubectl get pods获取Pod信息时出现如下错误：

[root@k8smasterone ~]# kubectl get pods
E0804 14:18:49.784346    9986 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E0804 14:18:49.785400    9986 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E0804 14:18:49.786149    9986 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E0804 14:18:49.787951    9986 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E0804 14:18:49.789820    9986 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
error: You must be logged in to the server (the server has asked for the client to provide credentials)

请问我是否遗漏了步骤？该如何解决此问题？是否需要重新生成新的token？

遗漏的核心步骤 #

你确实遗漏了两个关键操作：

• 未重启控制面核心组件：kubeadm明确提示需要重启kube-apiserver、kube-controller-manager、kube-scheduler和etcd，但你仅重启了kubelet。这些组件以静态Pod形式运行，必须触发重建才能加载新证书。
• 未同步admin kubeconfig文件：kubeadm更新了/etc/kubernetes/admin.conf中的证书，但kubectl默认使用~/.kube/config，两者未同步导致客户端认证失败。

具体解决步骤 #

1. 重启控制面静态Pod #

如果kubectl还能执行命令，直接删除对应Pod，kubelet会自动重建：

# 删除kube-apiserver Pod
kubectl delete pods -n kube-system -l component=kube-apiserver
# 删除kube-controller-manager Pod
kubectl delete pods -n kube-system -l component=kube-controller-manager
# 删除kube-scheduler Pod
kubectl delete pods -n kube-system -l component=kube-scheduler
# 删除etcd Pod
kubectl delete pods -n kube-system -l component=etcd

若kubectl已无法执行，直接删除静态Pod的manifest文件触发重建：

rm -f /etc/kubernetes/manifests/kube-apiserver.yaml
rm -f /etc/kubernetes/manifests/kube-controller-manager.yaml
rm -f /etc/kubernetes/manifests/kube-scheduler.yaml
rm -f /etc/kubernetes/manifests/etcd.yaml

2. 同步admin kubeconfig到用户目录 #

将更新后的证书配置同步到kubectl默认使用的文件：

cp -f /etc/kubernetes/admin.conf ~/.kube/config
chown $(id -u):$(id -g) ~/.kube/config

3. 验证修复效果 #

执行以下命令确认集群恢复正常：

kubectl get nodes
kubectl get pods -n kube-system

是否需要重新生成token？ #

不需要。token仅用于节点加入集群，当前问题是客户端认证凭证不匹配，和token无关，完成上述步骤即可解决。

内容的提问来源于stack exchange，提问作者Dolphin