A record of repairing a cluster failure caused by an IP change. There are two clusters: one single-node (allinone) cluster, and one four-node cluster (3 masters, 1 node). 1. Update the Etcd Certificates [On every Etcd node] Back up the Etcd certificates 1 cp -R /etc/ssl/etcd/ssl /etc/ssl/etcd/ssl-bak View the domains

1. Installation Method 1 2 kubectl apply -f https://openebs.github.io/charts/openebs-operator.yaml kubectl patch storageclass openebs-hostpath -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}' OpenEBS is mainly used as the default storage for Tekton pipelines. I had also tried Longhorn before, but it could not hold up during peak hours and the pipelines went Pending. And after uninstalling Longhorn there were leftovers, which caused kube-apiserver to keep reporting errors, and in the end it took a great deal of effort to remove.

By default, Kubernetes certificates need to be renewed once a year. Below is a record of one certificate renewal process. 1. Check the Certificates Check the certificate expiration time on a master node: 1 kubeadm certs check-expiration On older cluster versions this command errors out; use: kubeadm alpha certs check-expiration

1. How to Access a Remote Cluster Locally During development, you often need to connect directly to a remote Kubernetes cluster. The usual approach is to copy /etc/kubernetes/admin.conf to your local ~/.kube/kubeconfig. But the kubeconfig’s server address is kubernetes.default.svc. So we need to configure a hosts entry: 1 1.1.1.1 kubernetes.default.svc If you need to switch between different clusters, you not only have to swap the kubeconfig but also modify hosts.

In an earlier post, Installing Harbor with Helm, I described in detail how to install Ingress and Harbor and finally push an image successfully. There the domain was publicly reachable and the certificate was issued by a certificate authority. In an intranet environment, however, we need to use an internal domain name for access.