By default, Kubernetes certificates need to be renewed once a year. Below is a record of one certificate renewal process. 1. Check the Certificates Check the certificate expiration time on a master node: 1 kubeadm certs check-expiration On older cluster versions this command errors out; use: kubeadm alpha certs check-expiration

1. The container’s ulimit is set too low Error message: 1 2 3 4 5 6 7 CheckpointDir: /root/.obsutil_checkpoint OutputDir: /root/.obsutil_output runtime: mlock of signal stack failed: 12 runtime: increase the mlock limit (ulimit -l) or runtime: update your kernel to 5.3.15+, 5.4.2+, or 5.5+ fatal error: mlock failed Under Docker, you can add the ulimit parameter at startup 1 docker run -it --ulimit memlock=-1 .

1. Steps to Add a Key 1.1 Generate an SSH Key on the Client There are two key formats: Old format, the private key begins with -----BEGIN RSA PRIVATE KEY----- 1 ssh-keygen -m PEM -t rsa -b 4096 -C "mail@chenshaowen.com" New format, the private key begins with -----BEGIN OPENSSH PRIVATE KEY----- 1 ssh-keygen -t rsa -b 4096 -C "mail@chenshaowen.

The idea of the upgrade is: drain the workloads and take the traffic off, then upgrade the control plane nodes first and the worker nodes afterwards. 1. Check the cluster version 1 2 3 4 kubectl version Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.4", GitCommit:"e87da0bd6e03ec3fea7933c4b5263d151aafd07c", GitTreeState:"clean", BuildDate:"2021-02-18T16:12:00Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.

1. Formatting the Disk Check the new disk 1 fdisk -l Usually, the second disk is named /dev/sdb. Partition the disk 1 fdisk /dev/sdb You will be prompted to enter parameters: command (m for help):n Partition number(1-4):1 First cylinder (1-22800,default 1):Enter command (m for help):w Format the disk as ext4 1 mkfs.