1.把etcd 里面由原来ip产生的ca 文件 改成新ip重新生成新ip ca 文件，启动etcd ,验证etcd 成功后再往下走
2.查看apiserver 证书,证书没有所需要的ip地址
openssl x509 -noout -text -in /etc/kubernetes/pki/apiserver.crt |grep DNS
DNS:k8s1, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, IP Address:10.96.0.1, IP Address:192.168.x.x, IP Address:192.168.x.x, IP Address:192.168.x.x, IP Address:192.168.x.x, IP Address:127.0.0.1
3.删除旧的apiserver 证书
rm /etc/kubernetes/pki/apiserver.* -f
4.生成所需要的apiserver 证书
kubeadm init phase certs apiserver --apiserver-advertise-address 192.168.x.x --apiserver-cert-extra-sans 192.168.x.x --apiserver-cert-extra-sans 192.168.x.x --apiserver-cert-extra-sans 192.168.x.x --apiserver-cert-extra-sans 127.0.0.1
5.把 /etc/kubernetes 目录下的文件的原来的ip全部替换成对应的新ip
查找：grep -ir 147 /etc/kubernetes/*
替换：sed -i 's/143/147/g' /etc/kubernetes/manifests/*
6.重启api server,并查看apiserver logs 日志是否有报错，再执行kubectl cluster-info 是否正常
docker ps -a|grep api
docker restart $(docker ps -a|grep api|awk '{print $1}')
7.修改kube-proxy configmap 文件server ip，重启所有kube-proxy，再创建pod 验证集群换ip 成功
标签：kubectl,certificate,kubernetes,ip,192.168,apiserver,valid,DNS,Address From： https://www.cnblogs.com/zbhlinux/p/16828031.html