Unable to connect to the server: x509: certificate is valid for xxx.xxx.xxx.xxx not yyy.yyy.yyy.yyy

环境

安装方式：kubeadm
内网 IP：xxx.xxx.xxx.xxx
外网 IP：yyy.yyy.yyy.yyy
证书目录：/etc/kubernetes/pki
kubeadm 配置文件目录：/etc/kubernetes/kubeadm-config.yaml

生成证书

先备份

cp -r /etc/kubernetes /etc/kubernetes.bak

再操作

找到 ClusterConfiguration 中的 certSANs 并添加 yyy.yyy.yyy.yyy

vim  /etc/kubernetes/kubeadm-config.yaml

apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
etcd:
  external:
    endpoints:
    - https://xxx.xxx.xxx.xxx:6443
apiServer:
  extraArgs:
    authorization-mode: Node,RBAC
  timeoutForControlPlane: 4m0s
  certSANs:
    - xxx.xxx.xxx.xxx
    - yyy.yyy.yyy.yyy

kubeadm init phase certs apiserver --config /etc/kubernetes/kubeadm-config.yaml
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [xxx.xxx.xxx.xxx  yyy.yyy.yyy.yyy]

再重启

登录所有的master主机，kill kube-apiserver 进程就能全部重新运行了

检测

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep yyy.yyy.yyy.yyy