IP

修改 etcd 证书 备份旧的 etcd 证书 [root@enxe etcd]# cd /etc/ssl/etcd/ [root@enxe etcd]# ls ssl [root@enxe etcd]# cp -r ssl ssl-bak [root@enxe etcd]# [root@enxe etcd]# ls ssl ssl-bak 查看旧的etcd中包含的IP及DNS [root@enxe etcd]# openssl x509 -in /etc/ssl/etcd/ssl/node-enxe.pem -noout -text|grep DNS DNS:enxe, DNS:etcd, DNS:etcd.kube-system, DNS:etcd.kube-system.svc, DNS:etcd.kube-system.svc.cluster.local, DNS:lb.kubesphere.local, DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, IP Address:192.168.31.4 删除旧的证书 rm -f /etc/ssl/etcd/ssl/* 编写配置文件 cat > /etc/ssl/etcd/ssl/openssl.conf <<EOF [req] req_extensions = v3_req distinguished_name = req_distinguished_name [req_distinguished_name] [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [ ssl_client ] extendedKeyUsage = clientAuth, serverAuth basicConstraints = CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer subjectAltName = @alt_names [ v3_ca ] basicConstraints = CA:TRUE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names authorityKeyIdentifier=keyid:always,issuer [alt_names] DNS....