k3s rancher证书过期x509

问题现象

rancher管理页面打不开，节点操作报错
 

[root@rancher ~]# kubectl get pods
Unable to connect to the server: x509: certificate has expired or is not yet valid

查看rancher pod日志，证书已经过期

root@rancher ~]# docker logs --tail=200 f5116af932e3
2023/06/13 01:41:55 [INFO] Rancher version v2.5.8 (cf16ca13d) is starting
2023/06/13 01:41:55 [INFO] Listening on /tmp/log.sock
2023/06/13 01:41:55 [INFO] Rancher arguments {ACMEDomains:[] AddLocal:true Embedded:false BindHost: HTTPListenPort:80 HTTPSListenPort:443 K8sMode:auto Debug:false Trace:false NoCACerts:true AuditLogPath:/var/log/auditlog/rancher-api-audit.log AuditLogMaxage:10 AuditLogMaxsize:100 AuditLogMaxbackup:10 AuditLevel:0 Agent:false Features: ClusterRegistry:}
2023/06/13 01:41:55 [INFO] Waiting for server to become available: Get "https://10.43.0.1:443/version?timeout=15m0s": x509: certificate has expired or is not yet valid: current time 2023-06-13T01:41:55Z is after 2023-06-10T03:18:26Z
2023/06/13 01:41:57 [INFO] Waiting for server to become available: Get "https://10.43.0.1:443/version?timeout=15m0s": x509: certificate has expired or is not yet valid: current time 2023-06-13T01:41:57Z is after 2023-06-10T03:18:26Z

解决步骤（rancher V2.4/2.5）

如果是2.0 、2.1、2.2+、2.3+请参考链接， 轮换证书 | Rancher文档

[root@rancher ~]# kubectl --insecure-skip-tls-verify -n kube-system delete secrets k3s-serving
[root@rancher ~]# kubectl --insecure-skip-tls-verify delete secret serving-cert -n cattle-system
[root@rancher ~]# rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json

重启rancher服务

[root@rancher ~]# docker ps |grep rancher | awk -F ' ' '{print $1}' |xargs docker restart

如果还不生效，重启k3s

[root@rancher ~]# systemctl restart k3s

问题解决