kubernetes之证书更新

证书更新

kubernetes的证书存放在/etc/kubernetes/pki目录下,使用kubeadm alpha certs check-expiration，可查看证书有效时间

可以看出apiserver等证书有效期为一年，ca等证书有效期是10年.

重新编译kubeadm

部署go环境

打开Go下载 - Go语言中文网 - Golang中文社区（https://studygolang.com/dl）网站，下载一个最新版的。

或者linux服务器上执行

$ wget https://studygolang.com/dl/golang/go1.18.1.linux-amd64.tar.gz
$ tar -zxvf go1.18.1.linux-amd64.tar.gz -C /usr/local/
$ cp /usr/local/go/bin/go  /usr/local/bin/
$ cp /usr/local/go/bin/gofmt /usr/local/bin/
$ chown a+x /usr/local/bin/go
$ chown a+x /usr/local/bin/gofmt
#测试安装是否正常
$ go version
go version go1.18.1 linux/amd64

下载对应kubernetes源码

查看安装kubernetes版本

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.6", GitCommit:"dff82dc0de47299ab66c83c626e08b245ab19037", GitTreeState:"clean", BuildDate:"2020-07-15T16:58:53Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.6", GitCommit:"dff82dc0de47299ab66c83c626e08b245ab19037", GitTreeState:"clean", BuildDate:"2020-07-15T16:51:04Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}

kuberneted版本为1.18.6，所以下载源码，下载地址https://github.com/kubernetes/kubernetes

$ unzip kubernetes-1.18.6.zip
$ cd kubernetes-1.18.6
#修改文件
$ vim ./cmd/kubeadm/app/constants/constants.go
const (
......
        // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
        CertificateValidity = time.Hour * 24 * 365 * 100
.......

$ vim ./staging/src/k8s.io/client-go/util/cert/cert.go
func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
      ....
                NotAfter:              now.Add(duration365d * 100).UTC(),
      ....
}
#编译文件
$ make WHAT=cmd/kubeadm GOFLAGS=-v
#编译完成后生成的kubeadm在/opt/kubernetes-1.18.6/_output/bin目录下
$  ll /opt/kubernetes-1.18.6/_output/bin/
total 65656
-rwxr-xr-x. 1 root root  6115328 May 10 11:12 conversion-gen
-rwxr-xr-x. 1 root root  5849088 May 10 11:11 deepcopy-gen
-rwxr-xr-x. 1 root root  5840896 May 10 11:12 defaulter-gen
-rwxr-xr-x. 1 root root  3388281 May 10 11:11 go2make
-rwxr-xr-x. 1 root root  1744896 May 10 11:14 go-bindata
-rwxr-xr-x. 1 root root 34365440 May 10 14:31 kubeadm
-rwxr-xr-x. 1 root root  9924608 May 10 11:13 openapi-gen

更新证书

$ mv  /usr/bin/kubeadm /usr/bin/kubeadmold
$ cp -R /etc/kubernetes/pki /etc/kubernetes/pkiold
#将重新编译好的kubeadm文件上传至/usr/bin/目录下，授权。
#更新证书
$ kubeadm alpha certs renew all
#再次查看证书信息
$ kubeadm alpha certs check-expiration