Kubernetes---修改证书可用年限

kubeadm---修改apiserver证书有效期

1.查询证书可用时间

　　Kubernetes有两种机制去创建证书，有一部分是1年的，有一部分是10年的

[root@k8s-master ~]# cd /etc/kubernetes/pki/
[root@k8s-master pki]# ls
apiserver.crt apiserver-etcd-client.key apiserver-kubelet-client.crt ca.crt etcd front-proxy-ca.key front-proxy-client.key sa.pub
apiserver-etcd-client.crt apiserver.key apiserver-kubelet-client.key ca.key front-proxy-ca.crt front-proxy-client.crt sa.key

[root@k8s-master pki]# openssl x509 -in apiserver.crt -text -noout |grep Not
Not Before: Apr 5 05:33:55 2021 GMT
Not After : Apr 5 05:33:55 2022 GMT

2.部署Go语言环境

　　Go中文社区：https://study.golang.com/dl

　　Go官网：https://golang.org/dl/

cd /opt/src
wget https://studygolang.com/dl/golang/go1.16.3.linux-amd64.tar.gz
tar zxvf go1.16.3.linux-amd64.tar.gz -C /usr/local/

echo "export PATH=$PATH:/usr/local/go/bin" >> /etc/profile
source /etc/profile
go version

3.下载源码

cd /data && git clone https://github.com/kubernetes/kubernetes.git 
cd kubernetes
git checkout -b remotes/origin/release-1.19.0 v1.19.0  #切换当前版本(分支)   

4.修改 Kubeadm源码包更新证书策略

vim staging/src/k8s.io/client-go/util/cert/cert.go  # kubeadm 1.14 版本之前 
vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今 
    const duration365d = time.Hour * 24 * 365 * 20  #在文件中添加一行 设置为20年
    NotAfter: time.Now().Add(duration365d).UTC(),   #替换
make WHAT=cmd/kubeadm GOFLAGS=-v    #设置只编译kubeadm
cp _output/bin/kubeadm /root/kubeadm-new

5.更新 kubeadm

# 将kubeadm 进行替换
cp /usr/bin/kubeadm /usr/bin/kubeadm.old
cp /root/kubeadm-new /usr/bin/kubeadm
chmod a+x /usr/bin/kubeadm

6.更新各节点至Master节点

cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old 
cd /etc/kubernetes/pki 
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml 
openssl x509 -in apiserver.crt -text -noout | grep Not

7.HA集群其余 master节点证书更新

#!/bin/bash 
masterNode="192.168.33.157 192.168.33.167"
#for host in ${masterNode}; do
# scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}
# "${USER}"@$host:/etc/kubernetes/pki/ 
# scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd 
# scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/ 
#done 
for host in ${CONTROL_PLANE_IPS}; do 
    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} 
"${USER}"@$host:/root/pki/ 
    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd 
    scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/ 
done

 

标签：Kubernetes,kubernetes,ca,年限,---,etc,key,kubeadm,pki
来源： https://www.cnblogs.com/fengyuanfei/p/14628452.html