-1

I have a single-node Kubernetes cluster that I need to change IP. I see that the current IP is within many configuration files, which is not a big problem. The bigger problem is that when I changed the address, I had an error that the certificate is valid only for the old IP, not the new one.

How should I perform the change? I assume that I can change the IPs in the config files to a DNS-recognizable hostname, so the configs will be valid for both IPs. Is it possible to regenerate the certificate for a hostname so it will also work regardless of the IP?

Edit:

I've found a command to regenerate the certificate:

kubeadm alpha phase certs selfsign --apiserver-advertise-address=0.0.0.0 --cert-altnames=10.161.233.80 --cert-altnames=114.215.201.87

Unfortunately, it doesn't work:

Error: unknown flag: --apiserver-advertise-address

I've also tried to run these commands:

sudo mv /etc/kubernetes/pki /etc/kubernetes/pki_bak
sudo kubeadm init phase certs all

It has recreated the certs with a correct ip address, but the /etc/kubernetes/admin.conf still has the wrong one. Any kubectl --kubeconfig=/etc/kubernetes/admin.conf without --insecure-skip-tls-verify fails. Same for kubeadm config view:

sudo kubeadm config view --v=5
I0330 04:32:11.754422   21907 config.go:296] [config] retrieving ClientSet from file
I0330 04:32:11.769423   21907 config.go:400] [config] getting the cluster configuration
Get https://10.202.91.41:6443/api/v1/namespaces/kube-system/configmaps/kubeadm-config: x509: certificate is valid for 10.96.0.1, 10.202.91.129, not 10.202.91.41

My cluster configuration is quite distributed so I'd like to avoid having to recreate the cluster from scratch as it will be quite hard to do that.

I'm currently on version 1.16.

Edit2:

I've removed the admin.conf file, and ran kubeadm init phase kubeconfig admin command. It recreated the admin.conf but again with wrong certificate.

2
  • 1
    How exactly did you set up your k8s cluster ?
    – mario
    Mar 25 at 15:40
  • kubeadm init, a few years ago
    – Djent
    Mar 27 at 15:44
0

Following steps from this article helped: https://blog.scottlowe.org/2019/07/30/adding-a-name-to-kubernetes-api-server-certificate/

1
  • Please provide some description, explaining what steps from the article you mentioned above (you can even quote the respective parts of it) solved your issue and how. Link-only answers should be avoided mainly because a link to the external resources they contain may become invalid after some period of time and then such answer becomes totally useless.
    – mario
    Apr 6 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.