可参考文档：http://www.bubuko.com/infodetail-3104985.html
证书可用年限修改
创建工作目录
[root@master ~]# mkdir /data
下载go环境(搜索go 中文网既可下载)
[root@master data]# wget https://studygolang.com/dl/golang/go1.13.5.linux-amd64.tar.gz
[root@master data]# tar -xf go1.13.5.linux-amd64.tar.gz -C /usr/local/
设置环境变量
[root@master data]# vim /etc/profile
加入路劲内容 export PATH=$PATH:/usr/local/go/bin
[root@master data]# source /etc/profile /生效
1、下载kubernetes源码(提前安装git)
[root@master data]# git clone https://github.com/kubernetes/kubernetes.git
2、切换当前集群的版本
[root@master data]# git checkout -b remotes/origin/release-1.14.1 v1.14.1
3、修改kubeadm源码包更新策略
进入到下载的源码包目录下
[root@master kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go 1.14版本之前修改此目录内容
[root@master kubernetes]# vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go 1.14版本至今修改此目录下内容
在// NewSignedCert creates a signed certificate using the given CA certificate and key
func NewSignedCert(cfg *certutil.Config, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer) (*x50
9.Certificate, error) {这个里面加入你要修改的年限
内容： const duration3650d = time.Hour * 24 * 365 * 10(注意前面空格处是tab键)
再在certTmpl := x509.Certificate{模板下加入你刚刚创建的名称duration3650d
开始编译kubeadm
make WHAT=cmd/kubeadm GOFLAGS=-v(如果编译失败 请检查配置文件)
cp _output/bin/kubeadm /root(将编译出的文件拷贝到root目录下)
cp /usr/bin/kubeadm /usr/bin/kubeadm.back （备份之前的文件以免失败）
cp /root/kubeadm /usr/bin/ （将编译出来的kubeadm文件拷贝到/usr/bin下）
chmod a+x /usr/bin/kubeadm
cp /etc/kubernetes/pki /etc/kubernetes/pki.back （将pki目录备份）
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml(如果当时不是根据kubeadm-config.yaml文件模式编写的 请重新编写也可以生效)
kubeadm-config.yaml内容如下
[root@master ~]# cat kubeadm-config.yaml
apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.14.1
networking:
podSubnet: 10.244.0.0/16
apiServer:
certSANs:
- 192.168.241.127
- 192.168.241.128
- 192.168.241.129
进入到/etc/kubernetes/pki目录下 开始验证
[root@master pki]# openssl x509 -in apiserver.crt -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1237419101905230892 (0x112c321df7581c2c)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=kubernetes
Validity
Not Before: Dec 10 01:56:18 2019 GMT
Not After : Jan 7 08:16:29 2030 GMT
启用自动轮换kubelet 证书
kubelet证书分为server和client两种， k8s 1.9默认启用了client证书的自动轮换，但server证书自动轮换需要用户开启
1、增加 kubelet 参数
在/usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf 增加如下参数
Environment="KUBELET_EXTRA_ARGS=--feature-gates=RotateKubeletServerCertificate=true"
2、增加 controller-manager 参数
在/etc/kubernetes/manifests/kube-controller-manager.yaml 添加如下参数
- command:
- kube-controller-manager
- --experimental-cluster-signing-duration=87600h0m0s
- --feature-gates=RotateKubeletServerCertificate=true
3、创建 rbac 对象
创建rbac对象，允许节点轮换kubelet server证书：
cat > ca-update.yaml << EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeserver
rules:
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/selfnodeserver
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubeadm:node-autoapprove-certificate-server
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeserver
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:nodes
EOF
kubectl create -f ca-update.yaml
如果证书已经过期，如何进行重新签发证书
针对kubeadm 1.13.x 及以上处理
1、准备kubeadm.conf 配置文件一份
apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.14.1 #-->这里改成你集群对应的版本
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
#这里使用国内的镜像仓库，否则在重新签发的时候会报错：could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt"
2、重新签发命令
kubeadm alpha certs renew all --config=/root/kubeadm.conf
运行如上命令会重新生成以下证书
#-- /etc/kubernetes/pki/apiserver.key
#-- /etc/kubernetes/pki/apiserver.crt
#-- /etc/kubernetes/pki/apiserver-etcd-client.key
#-- /etc/kubernetes/pki/apiserver-etcd-client.crt
#-- /etc/kubernetes/pki/apiserver-kubelet-client.key
#-- /etc/kubernetes/pki/apiserver-kubelet-client.crt
#-- /etc/kubernetes/pki/front-proxy-client.key
#-- /etc/kubernetes/pki/front-proxy-client.crt
#-- /etc/kubernetes/pki/etcd/healthcheck-client.key
#-- /etc/kubernetes/pki/etcd/healthcheck-client.crt
#-- /etc/kubernetes/pki/etcd/peer.key
#-- /etc/kubernetes/pki/etcd/peer.crt
#-- /etc/kubernetes/pki/etcd/server.key
#-- /etc/kubernetes/pki/etcd/server.crt
完成后重启kube-apiserver,kube-controller,kube-scheduler,etcd这4个容器
针对kubeadm 1.13.0（不包含1.13.0） 以下处理
移动证书和配置【注意！必须移动，不然会使用现有的证书，不会重新生成】
cd /etc/kubernetes
mkdir ./pki_bak
mkdir ./pki_bak/etcd
mkdir ./conf_bak
mv pki/apiserver* ./pki_bak/
mv pki/front-proxy-client.* ./pki_bak/
mv pki/etcd/healthcheck-client.* ./pki_bak/etcd/
mv pki/etcd/peer.* ./pki_bak/etcd/
mv pki/etcd/server.* ./pki_bak/etcd/
mv ./admin.conf ./conf_bak/
mv ./kubelet.conf ./conf_bak/
mv ./controller-manager.conf ./conf_bak/
mv ./scheduler.conf ./conf_bak/
3、创建证书
kubeadm alpha phase certs all --apiserver-advertise-address=${MASTER_API_SERVER_IP} --apiserver-cert-extra-sans=主机内网ip,主机公网ip
运行如上命令会重新生成以下证书
#-- /etc/kubernetes/pki/apiserver.key
#-- /etc/kubernetes/pki/apiserver.crt
#-- /etc/kubernetes/pki/apiserver-etcd-client.key
#-- /etc/kubernetes/pki/apiserver-etcd-client.crt
#-- /etc/kubernetes/pki/apiserver-kubelet-client.key
#-- /etc/kubernetes/pki/apiserver-kubelet-client.crt
#-- /etc/kubernetes/pki/front-proxy-client.key
#-- /etc/kubernetes/pki/front-proxy-client.crt
#-- /etc/kubernetes/pki/etcd/healthcheck-client.key
#-- /etc/kubernetes/pki/etcd/healthcheck-client.crt
#-- /etc/kubernetes/pki/etcd/peer.key
#-- /etc/kubernetes/pki/etcd/peer.crt
#-- /etc/kubernetes/pki/etcd/server.key
#-- /etc/kubernetes/pki/etcd/server.crt
不移动证书会有如下提示
#[certificates] Using the existing apiserver certificate and key.
#[certificates] Using the existing apiserver-kubelet-client certificate and key.
#[certificates] Using the existing front-proxy-client certificate and key.
#[certificates] Using the existing etcd/server certificate and key.
#[certificates] Using the existing etcd/peer certificate and key.
#[certificates] Using the existing etcd/healthcheck-client certificate and key.
#[certificates] Using the existing apiserver-etcd-client certificate and key.
#[certificates] valid certificates and keys now exist in "/etc/kubernetes/pki"
#[certificates] Using the existing sa key.
4、生成新配置文件
kubeadm alpha phase kubeconfig all --apiserver-advertise-address=${MASTER_API_SERVER_IP}
5、将新生成的admin配置文件覆盖掉原本的admin文件
mv $HOME/.kube/config $HOME/.kube/config.old
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
sudo chmod 777 $HOME/.kube/config