kubernetes集群证书延期
查看集群当前证书到期时间：
[root@k8s001 ~]# kubeadm alpha certs check-expiration # 部分老版本可能需要用此命令查看
[root@k8s001 ~]# kubeadm certs check-expiration
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Oct 15, 2021 07:58 UTC 364d no
apiserver Oct 15, 2021 07:58 UTC 364d ca no
apiserver-etcd-client Oct 15, 2021 07:58 UTC 364d etcd-ca no
apiserver-kubelet-client Oct 15, 2021 07:58 UTC 364d ca no
controller-manager.conf Oct 15, 2021 07:58 UTC 364d no
etcd-healthcheck-client Oct 15, 2021 07:58 UTC 364d etcd-ca no
etcd-peer Oct 15, 2021 07:58 UTC 364d etcd-ca no
etcd-server Oct 15, 2021 07:58 UTC 364d etcd-ca no
front-proxy-client Oct 15, 2021 07:58 UTC 364d front-proxy-ca no
scheduler.conf Oct 15, 2021 07:58 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Oct 13, 2030 07:58 UTC 9y no
etcd-ca Oct 13, 2030 07:58 UTC 9y no
front-proxy-ca Oct 13, 2030 07:58 UTC 9y no
单个证书查看
[root@k8s001 ~]# cd /etc/kubernetes/pki/ #单个证书期限查看
[root@k8s001 ~]# openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -text |grep Not
Not Before: Oct 15 07:58:40 2020 GMT
Not After : Oct 13 07:58:40 2030 GMT
#通过上面信息可看到ca证书有效期是10年，从2020到2030年
[root@k8s001 ~]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep Not
Not Before: Oct 15 07:58:40 2020 GMT
Not After : Oct 15 07:58:41 2021 GMT
#通过上面可看到apiserver证书有效期是1年，从2020到2021年
[root@k8s001 ~]# openssl x509 -in /etc/kubernetes/pki/apiserver-etcd-client.crt -noout -text |grep Not #一年
Not Before: Oct 15 07:58:43 2020 GMT
Not After : Oct 15 07:58:45 2021 GMT
[root@k8s001 ~]# openssl x509 -in /etc/kubernetes/pki/front-proxy-ca.crt -noout -text |grep Not #十年
Not Before: Oct 15 07:58:41 2020 GMT
Not After : Oct 13 07:58:41 2030 GMT
安装证书更新依赖工具
首先下载go环境支撑
[root@k8s001 ~]# wget https://gomirrors.org/dl/go/go1.18.3.linux-amd64.tar.gz
[root@k8s001 ~]# tar xf go1.18.3.linux-amd64.tar.gz -C /usr/local/
[root@k8s001 ~]# ls /usr/local/go
[root@k8s001 ~]# vim /etc/profile
...
export PATH=$PATH:/usr/local/go/bin
...
[root@k8s001 ~]# source /etc/profile
[root@k8s001 ~]# go version
go version go1.18.3 linux/amd64
克隆k8s项目到本地
[root@k8s001 ~]# git clone https://github.com/kubernetes/kubernetes.git # 克隆整个仓库
[root@k8s001 ~]# git clone --branch release-1.18 https://github.com/kubernetes/kubernetes.git #单独只克隆单个对应版本分支
[root@k8s001 ~]# cd kubernetes
[root@k8s001 kubernetes]# kubeadm version # 查看当前集群安装版本
[root@k8s001 kubernetes]# git checkout -b remotes/origin/release-1.18.8 v1.18.8
切换到一个新分支 'remotes/origin/release-1.18.8'
修改证书期限：
[root@k8s001 kubernetes]# vim cmd/kubeadm/app/constants/constants.go
CertificateValidity = time.Hour * 24 * 365 * 10 #改为 time.Hour * 24 * 365 * 10 #修改为*10即改成10年到期
[root@k8s001 kubernetes]# make WHAT=cmd/kubeadm GOFLAGS=-v #编译，新生成的二进制在_output/bin/目录下
利用新生成的二进制文件替换当前集群的文件
# 替换之前先进去备份
[root@k8s001 kubernetes]# \cp /usr/bin/kubeadm /usr/bin/kubeadm.backup
[root@k8s001 kubernetes]# \cp _output/bin/kubeadm /usr/bin/kubeadm
[root@k8s001 kubernetes]# \cp -r /etc/kubernetes/pki /etc/kubernetes/pki.backup
[root@k8s001 kubernetes]# cd /etc/kubernetes/pki
[root@k8s001 pki]# kubeadm alpha certs renew all # 老版本可能需要使用此命令
[root@k8s001 pki]# kubeadm certs renew all # 新版本对应此命令
查看结果
[root@k8s001 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Oct 15, 2030 02:36 UTC 9y no
apiserver Oct 15, 2030 02:36 UTC 9y ca no
apiserver-etcd-client Oct 15, 2030 02:36 UTC 9y etcd-ca no
apiserver-kubelet-client Oct 15, 2030 02:36 UTC 9y ca no
controller-manager.conf Oct 15, 2030 02:36 UTC 9y no
etcd-healthcheck-client Oct 15, 2030 02:36 UTC 9y etcd-ca no
etcd-peer Oct 15, 2030 02:36 UTC 9y etcd-ca no
etcd-server Oct 15, 2030 02:36 UTC 9y etcd-ca no
front-proxy-client Oct 15, 2030 02:36 UTC 9y front-proxy-ca no
scheduler.conf Oct 15, 2030 02:36 UTC 9y no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Oct 13, 2030 07:58 UTC 9y no
etcd-ca Oct 13, 2030 07:58 UTC 9y no
front-proxy-ca Oct 13, 2030 07:58 UTC 9y no
高可用集群证书更新：
另外几台的master，只需要把新生成的kubeadm文件，从第一台更新过的scp过去，然后按上面步骤，重新生成新的证书文件就可以了。记住更新过需要重启一下服务或者服务器。
[root@k8s001 ~]# scp _output/bin/kubeadm k8s002:/usr/bin/kubeadm
[root@k8s002 ~]# kubeadm certs renew all
[root@k8s002 ~]# kubeadm certs check-expiration