k8s 更新证书

检查证书的过期时间

官网地址: https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

[root@master ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Nov 21, 2023 07:43 UTC   357d                                    no
apiserver                  Nov 21, 2023 07:43 UTC   357d            ca                      no
apiserver-etcd-client      Nov 21, 2023 07:43 UTC   357d            etcd-ca                 no
apiserver-kubelet-client   Nov 21, 2023 07:43 UTC   357d            ca                      no
controller-manager.conf    Nov 21, 2023 07:43 UTC   357d                                    no
etcd-healthcheck-client    Nov 21, 2023 07:43 UTC   357d            etcd-ca                 no
etcd-peer                  Nov 21, 2023 07:43 UTC   357d            etcd-ca                 no
etcd-server                Nov 21, 2023 07:43 UTC   357d            etcd-ca                 no
front-proxy-client         Nov 21, 2023 07:43 UTC   357d            front-proxy-ca          no
scheduler.conf             Nov 21, 2023 07:43 UTC   357d                                    no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Nov 18, 2032 07:43 UTC   9y              no
etcd-ca                 Nov 18, 2032 07:43 UTC   9y              no
front-proxy-ca          Nov 18, 2032 07:43 UTC   9y              no

更新所有证书

[root@master ~]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
[root@master ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Nov 29, 2023 02:41 UTC   364d                                    no
apiserver                  Nov 29, 2023 02:41 UTC   364d            ca                      no
apiserver-etcd-client      Nov 29, 2023 02:41 UTC   364d            etcd-ca                 no
apiserver-kubelet-client   Nov 29, 2023 02:41 UTC   364d            ca                      no
controller-manager.conf    Nov 29, 2023 02:41 UTC   364d                                    no
etcd-healthcheck-client    Nov 29, 2023 02:41 UTC   364d            etcd-ca                 no
etcd-peer                  Nov 29, 2023 02:41 UTC   364d            etcd-ca                 no
etcd-server                Nov 29, 2023 02:41 UTC   364d            etcd-ca                 no
front-proxy-client         Nov 29, 2023 02:41 UTC   364d            front-proxy-ca          no
scheduler.conf             Nov 29, 2023 02:41 UTC   364d                                    no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Nov 18, 2032 07:43 UTC   9y              no
etcd-ca                 Nov 18, 2032 07:43 UTC   9y              no
front-proxy-ca          Nov 18, 2032 07:43 UTC   9y              no