云原生|kubernetes|kubeadm部署的集群的100年证书

最新推荐文章于 2024-07-27 23:40:41 发布

晚风_END

最新推荐文章于 2024-07-27 23:40:41 发布

阅读量1k

点赞数 2

分类专栏： kubernetes 文章标签： kubernetes 云原生容器

本文链接：https://blog.csdn.net/alwaysbefine/article/details/128194904

版权

kubernetes 专栏收录该内容

87 篇文章 47 订阅

订阅专栏

前言：

首先，先看看minikube这样的开发或者测试使用的kubernetes集群的证书时间：

[root@node3 ~]# kubeadm  certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Dec 04, 2023 12:07 UTC   363d            ca                      no      
apiserver                  Dec 03, 2025 12:02 UTC   2y              ca                      no      
apiserver-etcd-client      Dec 04, 2023 12:07 UTC   363d            etcd-ca                 no      
apiserver-kubelet-client   Dec 04, 2023 12:07 UTC   363d            ca                      no      
controller-manager.conf    Dec 04, 2023 13:00 UTC   363d            ca                      no      
etcd-healthcheck-client    Dec 04, 2023 12:07 UTC   363d            etcd-ca                 no      
etcd-peer                  Dec 04, 2023 12:07 UTC   363d            etcd-ca                 no      
etcd-server                Dec 04, 2023 12:07 UTC   363d            etcd-ca                 no      
front-proxy-client         Dec 04, 2023 12:07 UTC   363d            front-proxy-ca          no      
scheduler.conf             Dec 04, 2023 13:00 UTC   363d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Dec 01, 2032 12:02 UTC   9y              no      
etcd-ca                 Dec 01, 2032 12:07 UTC   9y              no      
front-proxy-ca          Dec 01, 2032 12:07 UTC   9y              no

OK，我们可以看到，这些证书的时间大部分都是一年期的。对于minikube这样的集群，无所谓喽，集群本来就是测试性质的，大不了重新部署了，也是非常快的，但，在生产环境下，我们追求的是稳定高效，当然可以使用kubeadm certs renew all来续订证书，但是证书更新了那些服务如果要重启就很麻烦，并且如果不是一个集群的证书要续订，而是有N个集群的证书续订，那可就有得忙了。

因此，我们在生产环境部署集群的时候，如果提前就把证书的时间修改为10年或者更长的100年，会规避掉一些麻烦，也算是提前解决一个可能会对生产造成影响的问题。

那么，如何在部署阶段就修改证书的时间呢？

其实也比较简单，在部署前就利用kubernetes的源码编译出一个新的kubeadm即可了。

实操：

工具原材料：

1，kubernetes的源码

2，go语言环境

目标：

假设生产环境使用的kubernetes版本是1.23.12版本，通过go语言环境，利用kubernetes-1.23.12的源码，重新编译出一个新的kubeadm程序，在kubeadm init 初始化前，用新的kubeadm替换原有的kubeadm，使得kubernetes的证书期限是100年。

一，

go语言环境的安装部署

首先申明，其它版本的编译安装没有试过，反正1.23.12版本的kubernetes需要go-1.17版本以上，否则不能正常编译，会报错：

[root@node4 kubernetes-1.23.12]# make all WHAT=cmd/kubeadm GOFLAGS=-v

Detected go version: go version go1.16.12 linux/amd64.
Kubernetes requires go1.17.0 or greater.
Please install go1.17.0 or later.

!!! [1205 23:21:50] Call tree:
!!! [1205 23:21:50]  1: hack/run-in-gopath.sh:31 kube::golang::setup_env(...)

Detected go version: go version go1.16.12 linux/amd64.
Kubernetes requires go1.17.0 or greater.
Please install go1.17.0 or later.

!!! [1205 23:21:50] Call tree:
!!! [1205 23:21:50]  1: /root/kubernetes-1.23.12/hack/lib/golang.sh:794 kube::golang::setup_env(...)
!!! [1205 23:21:50]  2: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1205 23:21:50] Call tree:
!!! [1205 23:21:50]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make[1]: *** [_output/bin/prerelease-lifecycle-gen] Error 1
make: *** [generated_files] Error 2

因此，go语言版本选择的是1.17.1，部署步骤如下；

1，

下载go语言安装包

wget https://studygolang.com/dl/golang/go1.17.1.linux-amd64.tar.gz

2，

解压，解压后的文件移动到/usr/local/目录下：

tar zxf go1.17.1.linux-amd64.tar.gz
mv go /usr/local/

3，

设置环境变量并激活变量

编辑/etc/profile 文件，在末尾添加如下内容：

export GOROOT=/usr/local/go
export PATH=$PATH:/usr/local/go/bin
export GOPATH=/go

激活环境变量：

source /etc/profile

4，

验证go语言环境

[root@node3 ~]# go version
go version go1.17.1 linux/amd64

二，

下载kubernetes-1.23.12源码

https://codeload.github.com/kubernetes/kubernetes/zip/refs/tags/v1.23.12

下载下来的文件上传到服务器解压后，进入解压目录：

[root@node3 kubernetes-1.23.12]# pwd
/root/kubernetes-1.23.12
[root@node3 kubernetes-1.23.12]# ls
api    CHANGELOG     cluster  code-of-conduct.md  docs    go.sum  LICENSE   logo      Makefile.generated_files  OWNERS          pkg     README.md          staging     test         vendor
build  CHANGELOG.md  cmd      CONTRIBUTING.md     go.mod  hack    LICENSES  Makefile  _output                   OWNERS_ALIASES  plugin  SECURITY_CONTACTS  SUPPORT.md  third_party

三，

修改源码的证书相关文件（两个文件）：

vim cmd/kubeadm/app/constants/constants.go

以关键字time.Hour 搜索，修改成如下（加个100，原来是只有time.Hour * 24 * 365）：

        // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
        CertificateValidity = time.Hour * 24 * 365 * 100

vim staging/src/k8s.io/client-go/util/cert/cert.go

以关键字KeyUsageDigitalSignatur 搜索，修改成如下（10改成100，原来是now.Add(duration365d * 10)）：

func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
        now := time.Now()
        tmpl := x509.Certificate{
                SerialNumber: new(big.Int).SetInt64(0),
                Subject: pkix.Name{
                        CommonName:   cfg.CommonName,
                        Organization: cfg.Organization,
                },
                DNSNames:              []string{cfg.CommonName},
                NotBefore:             now.UTC(),
                NotAfter:              now.Add(duration365d * 100).UTC(),
                KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
                BasicConstraintsValid: true,
                IsCA:                  true,
        }

以上修改请务必以关键字准确定位。

四，

重新编译kubeadm

make all WHAT=cmd/kubeadm GOFLAGS=-v

输出如下：

k8s.io/kubernetes/vendor/github.com/spf13/pflag
k8s.io/kubernetes/hack/make-rules/helpers/go2make
+++ [1205 23:50:42] Building go targets for linux/amd64:
    ./vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen
> non-static build: k8s.io/kubernetes/./vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen
k8s.io/kubernetes/vendor/golang.org/x/mod/semver
k8s.io/kubernetes/vendor/golang.org/x/sys/execabs
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/event/label
k8s.io/kubernetes/vendor/golang.org/x/xerrors/internal
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/event/keys
k8s.io/kubernetes/vendor/golang.org/x/xerrors
k8s.io/kubernetes/vendor/golang.org/x/mod/module
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/event/core
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/event
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/gocommand
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/typeparams
k8s.io/kubernetes/vendor/golang.org/x/tools/go/ast/astutil
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/fastwalk
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/gopathwalk
k8s.io/kubernetes/vendor/k8s.io/gengo/types
k8s.io/kubernetes/vendor/k8s.io/gengo/namer
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/imports
k8s.io/kubernetes/vendor/github.com/go-logr/logr
k8s.io/kubernetes/vendor/k8s.io/klog/v2
k8s.io/kubernetes/vendor/k8s.io/gengo/parser
k8s.io/kubernetes/vendor/k8s.io/gengo/examples/set-gen/sets
k8s.io/kubernetes/vendor/golang.org/x/tools/imports
k8s.io/kubernetes/vendor/golang.org/x/tools/go/internal/gcimporter
k8s.io/kubernetes/vendor/k8s.io/gengo/generator
k8s.io/kubernetes/vendor/k8s.io/gengo/args
k8s.io/kubernetes/vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators
k8s.io/kubernetes/vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args
k8s.io/kubernetes/vendor/golang.org/x/tools/go/internal/packagesdriver
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/packagesinternal
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/typesinternal
k8s.io/kubernetes/vendor/golang.org/x/tools/go/gcexportdata
k8s.io/kubernetes/vendor/golang.org/x/tools/go/packages
k8s.io/kubernetes/vendor/k8s.io/code-generator/pkg/util
k8s.io/kubernetes/vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen
Generating prerelease lifecycle code for 28 targets
+++ [1205 23:50:52] Building go targets for linux/amd64:
    ./vendor/k8s.io/code-generator/cmd/deepcopy-gen
后面的略略略

这个编译还是比较快的，等编译完成后，echo $? 看看有没有报错，如果是0，表示编译完成了。

那么，编译出的kubeadm在 _output/bin 目录下：

/root/kubernetes-1.23.12/_output/bin
[root@node4 bin]# ll
total 79020
-rwxr-xr-x 1 root root  6270976 Dec  5 23:51 conversion-gen
-rwxr-xr-x 1 root root  5996544 Dec  5 23:50 deepcopy-gen
-rwxr-xr-x 1 root root  6000640 Dec  5 23:51 defaulter-gen
-rwxr-xr-x 1 root root  3375951 Dec  5 23:50 go2make
-rwxr-xr-x 1 root root 45191168 Dec  5 23:56 kubeadm
-rwxr-xr-x 1 root root  8114176 Dec  5 23:52 openapi-gen
-rwxr-xr-x 1 root root  5963776 Dec  5 23:50 prerelease-lifecycle-gen

五，

测试编程出来的kubeadm 初始化集群，集群的证书是否变为了100年

将以上生成的kubeadm文件拷贝到一个新的服务器上，随便怎么拷贝吧，scp也好，直接lsrzs也可以。

添加yum源，安装kubeadm：

 cat >/etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

安装命令：

yum install kubeadm-1.23.12 kubelet-1.23.12 kubectl-1.23.12 -y

安装完毕后，将原来的kubeadm备份一哈；

cp /usr/bin/kubeadm{,.bak}

将新的kubeadm拷贝到/usr/bin/下：

cp -f kubeadm /usr/bin/

因为是测试性质，因此，随便初始化一下：

 kubeadm init \
--image-repository registry.aliyuncs.com/google_containers  \
--apiserver-advertise-address=192.168.217.24  \
--service-cidr=10.96.0.0/16   \
--pod-network-cidr=10.244.0.0/16  \
--kubernetes-version=1.23.12

等待初始化完成后，再次查看证书期限：

[root@node4 yum.repos.d]# kubeadm  certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Nov 11, 2122 14:48 UTC   99y             ca                      no      
apiserver                  Nov 11, 2122 14:48 UTC   99y             ca                      no      
apiserver-etcd-client      Nov 11, 2122 14:48 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Nov 11, 2122 14:48 UTC   99y             ca                      no      
controller-manager.conf    Nov 11, 2122 14:48 UTC   99y             ca                      no      
etcd-healthcheck-client    Nov 11, 2122 14:48 UTC   99y             etcd-ca                 no      
etcd-peer                  Nov 11, 2122 14:48 UTC   99y             etcd-ca                 no      
etcd-server                Nov 11, 2122 14:48 UTC   99y             etcd-ca                 no      
front-proxy-client         Nov 11, 2122 14:48 UTC   99y             front-proxy-ca          no      
scheduler.conf             Nov 11, 2122 14:48 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Nov 11, 2122 14:48 UTC   99y             no      
etcd-ca                 Nov 11, 2122 14:48 UTC   99y             no      
front-proxy-ca          Nov 11, 2122 14:48 UTC   99y             no

OK，证书的过期时间都是100年了，说明前面的编译工作是有效果的，可行的。

如果是在生产上，在也不用担心证书过期的问题了，也算是提前解决了一个暴雷问题。