kubeAdmin 升级证书

升级server端证书

kubeadm alpha  certs check-expiration

升级证书

kubeadm alpha  certs  renew all

kubelet 配置证书自动续期

1.配置kube-controller-manager组件

vi /etc/kubernetes/manifests/kube-controller-manager.yaml //文件中添加一下两行
spec:
  containers:
  - command:
  - kube-controller-manager
  --experimetal-cluster-signing-duration=87600h0m0s //为kubelet客户端证书颁发有效期10年
  --feature-gates=RotateKubeletServerCertificate=true //启用server证书颁发

2.配置kubelet组件

默认kubelet证书轮询已启用
vi /var/lib/kubelet/config.ymal
rotateCertificates:true

3.更换config文件

cp /etc/kubenetes/manifests/admin.conf ~/.kube/config
查看更新后证书时间
查看正式有效时间
openssl x509 -in kubelet-client-current.pem -noout -dates
打印证书信息
openssl x509 -in kubelet-client-current.pem -noout -text