k8s证书到期实际操作

文章目录

  • 1. 百年的kubeadm
    • 1.1 源码修改
    • 1.2 准备镜像
    • 1.3 编译
    • 1.4 成品备份
  • 2. 生成证书
    • 2.1 master主节点
    • 2.2 其他master节点

1. 百年的kubeadm

1.1 源码修改

  • 源码下载
cd /usr/local/src/
git clone -b release-1.15 https://github.com/kubernetes/kubernetes.git
  • 再次确认分支
cd  kubernetes
git branch -a
  • 修改cert.go
vim ./staging/src/k8s.io/client-go/util/cert/cert.go
                NotBefore:             now.UTC(),
                #修改下边的10为100
                NotAfter:              now.Add(duration365d * 10).UTC(),
                KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
                BasicConstraintsValid: true,
                IsCA:  
  • 修改constants.go
vim ./cmd/kubeadm/app/constants/constants.go
        // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
        #将下边time.Hour * 100
        CertificateValidity = time.Hour * 24 * 365

修改后如下:

vim ./cmd/kubeadm/app/constants/constants.go
        // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
        CertificateValidity = time.Hour * 24 * 365 * 100

1.2 准备镜像

docker pull mirrorgooglecontainers/kube-cross:v1.12.10-1

官方提供的编译镜像,无论如何弄到服务器上就行了

1.3 编译

docker run --rm -it -v /usr/local/src/k8s.io/kubernetes:/go/src/k8s.io/kubernetes \
mirrorgooglecontainers/kube-cross:v1.12.10-1 bash

cd /go/src/k8s.io/kubernetes
make all WHAT=cmd/kubeadm GOFLAGS=-v
exit

1.4 成品备份

  • 成品位置
    编译好的成品在: _output/local/bin/linux/amd64/kubeadm

  • 成品测试

cp _output/local/bin/linux/amd64/kubeadm /usr/bin/
chmod a+x /usr/bin/kubeadm
kubeadm version
  • 成本保存
    已上传至ftp服务器,ftp://10.252.97.213/soft/kubeadm

2. 生成证书

2.1 master主节点

  • 将前边准备的kubeadm 拷贝到服务器
cd /usr/local/src
wget  ftp://10.252.97.213/soft/kubeadm
  • 替换原来kubeadm文件
cp /usr/bin/kubeadm /usr/bin/kubeadm_back
cp /usr/local/src/kubeadm /usr/bin/kubeadm
chmod 755 /usr/bin/kubeadm
  • 备份配置文件和证书
cp -ra /etc/kubernetes /etc/kubernetes_back
  • 查看证书到期时间
kubeadm alpha certs check-expiration
  • 更新证书和配置文件
 kubeadm alpha certs renew all
  • 确认证书到期时间
[root@AiK8sM2 ~]# kubeadm alpha certs check-expiration
CERTIFICATE                EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
admin.conf                 Apr 03, 2120 06:46 UTC   99y             no
apiserver                  Apr 03, 2120 09:36 UTC   99y             no
apiserver-etcd-client      Apr 03, 2120 09:36 UTC   99y             no
apiserver-kubelet-client   Apr 03, 2120 09:36 UTC   99y             no
controller-manager.conf    Apr 03, 2120 09:36 UTC   99y             no
etcd-healthcheck-client    Apr 03, 2120 09:36 UTC   99y             no
etcd-peer                  Apr 03, 2120 09:36 UTC   99y             no
etcd-server                Apr 03, 2120 09:36 UTC   99y             no
front-proxy-client         Apr 03, 2120 06:47 UTC   99y             no
scheduler.conf             Apr 03, 2120 09:36 UTC   99y             no

  • 重启docker

说明:主要为了重启proxy和etcd

service docker restart
  • 重启kubelet
service kubelet restart

2.2 其他master节点

  • 拷贝100年的kubeadmin 文件
  • 将前边准备的kubeadm 拷贝到服务器
cd /usr/local/src
wget  ftp://10.252.97.213/soft/kubeadm
  • 替换原来kubeadm文件
cp /usr/bin/kubeadm /usr/bin/kubeadm_back
cp /usr/local/src/kubeadm /usr/bin/kubeadm
chmod 755 /usr/bin/kubeadm
  • 备份配置文件和证书
cp -ra /etc/kubernetes /etc/kubernetes_back
  • 查看证书到期时间
kubeadm alpha certs check-expiration
  • 更新证书和配置文件
 kubeadm alpha certs renew all
  • 确认证书到期时间
[root@AiK8sM2 ~]# kubeadm alpha certs check-expiration
CERTIFICATE                EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
admin.conf                 Apr 03, 2120 06:46 UTC   99y             no
apiserver                  Apr 03, 2120 09:36 UTC   99y             no
apiserver-etcd-client      Apr 03, 2120 09:36 UTC   99y             no
apiserver-kubelet-client   Apr 03, 2120 09:36 UTC   99y             no
controller-manager.conf    Apr 03, 2120 09:36 UTC   99y             no
etcd-healthcheck-client    Apr 03, 2120 09:36 UTC   99y             no
etcd-peer                  Apr 03, 2120 09:36 UTC   99y             no
etcd-server                Apr 03, 2120 09:36 UTC   99y             no
front-proxy-client         Apr 03, 2120 06:47 UTC   99y             no
scheduler.conf             Apr 03, 2120 09:36 UTC   99y             no

  • 从master-01 上拷贝证书文件
    从master01 上拷贝证书
ssh 10.251.137.187 "mkdir -p /etc/kubernetes/pki/etcd"
ssh 10.251.137.188 "mkdir -p /etc/kubernetes/pki/etcd"

scp -r /etc/kubernetes/admin.conf 10.251.137.187:/etc/kubernetes/admin.conf
scp -r /etc/kubernetes/admin.conf 10.251.137.188:/etc/kubernetes/admin.conf

scp -r /etc/kubernetes/pki/{ca.*,sa.*,front*}  10.251.137.187:/etc/kubernetes/pki/
scp -r /etc/kubernetes/pki/{ca.*,sa.*,front*}  10.251.137.188:/etc/kubernetes/pki/

scp -r /etc/kubernetes/pki/etcd/ca.*  10.251.137.187:/etc/kubernetes/pki/etcd/ 
scp -r /etc/kubernetes/pki/etcd/ca.*  10.251.137.188:/etc/kubernetes/pki/etcd/

  • 重启docker

说明:主要为了重启proxy和etcd

service docker restart
  • 重启kubelet
service kubelet restart

你可能感兴趣的:(#,04-k8s集群进阶操作,kubernetes,k8s,证书,长期证书,百年证书)