kubeadm进行kubernetes证书管理

检查证书是否过期

kubeadm certs check-expiration

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 15, 2023 01:59 UTC   362d            ca                      no      
apiserver                  Mar 15, 2023 01:58 UTC   362d            ca                      no      
apiserver-etcd-client      Mar 15, 2023 01:59 UTC   362d            etcd-ca                 no      
apiserver-kubelet-client   Mar 15, 2023 01:59 UTC   362d            ca                      no      
controller-manager.conf    Mar 15, 2023 01:59 UTC   362d            ca                      no      
etcd-healthcheck-client    Mar 15, 2023 01:59 UTC   362d            etcd-ca                 no      
etcd-peer                  Mar 15, 2023 01:59 UTC   362d            etcd-ca                 no      
etcd-server                Mar 15, 2023 01:59 UTC   362d            etcd-ca                 no      
front-proxy-client         Mar 15, 2023 01:59 UTC   362d            front-proxy-ca          no      
scheduler.conf             Mar 15, 2023 01:59 UTC   362d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 12, 2032 01:58 UTC   9y              no      
etcd-ca                 Mar 12, 2032 01:59 UTC   9y              no      
front-proxy-ca          Mar 12, 2032 01:59 UTC   9y              no

手动更新证书

kubeadm certs renew -h

This command is not meant to be run on its own. See list of available subcommands.

Usage:
  kubeadm certs renew [flags]
  kubeadm certs renew [command]

Available Commands:
  admin.conf               Renew the certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself
  all                      Renew all available certificates
  apiserver                Renew the certificate for serving the Kubernetes API
  apiserver-etcd-client    Renew the certificate the apiserver uses to access etcd
  apiserver-kubelet-client Renew the certificate for the API server to connect to kubelet
  controller-manager.conf  Renew the certificate embedded in the kubeconfig file for the controller manager to use
  etcd-healthcheck-client  Renew the certificate for liveness probes to healthcheck etcd
  etcd-peer                Renew the certificate for etcd nodes to communicate with each other
  etcd-server              Renew the certificate for serving etcd
  front-proxy-client       Renew the certificate for the front proxy client
  scheduler.conf           Renew the certificate embedded in the kubeconfig file for the scheduler manager to use

Flags:
  -h, --help   help for renew

Global Flags:
      --add-dir-header           If true, adds the file directory to the header of the log messages
      --log-file string          If non-empty, use this log file
      --log-file-max-size uint   Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --one-output               If true, only write logs to their native severity level (vs also writing to each lower severity level)
      --rootfs string            [EXPERIMENTAL] The path to the 'real' host root filesystem.
      --skip-headers             If true, avoid header prefixes in the log messages
      --skip-log-headers         If true, avoid headers when opening log files
  -v, --v Level                  number for the log level verbosity

kubeadm certs renew all

[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

kubeadm certs check-expiration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 17, 2023 05:38 UTC   364d            ca                      no      
apiserver                  Mar 17, 2023 05:38 UTC   364d            ca                      no      
apiserver-etcd-client      Mar 17, 2023 05:38 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Mar 17, 2023 05:38 UTC   364d            ca                      no      
controller-manager.conf    Mar 17, 2023 05:38 UTC   364d            ca                      no      
etcd-healthcheck-client    Mar 17, 2023 05:38 UTC   364d            etcd-ca                 no      
etcd-peer                  Mar 17, 2023 05:38 UTC   364d            etcd-ca                 no      
etcd-server                Mar 17, 2023 05:38 UTC   364d            etcd-ca                 no      
front-proxy-client         Mar 17, 2023 05:38 UTC   364d            front-proxy-ca          no      
scheduler.conf             Mar 17, 2023 05:38 UTC   364d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 12, 2032 01:58 UTC   9y              no      
etcd-ca                 Mar 12, 2032 01:59 UTC   9y              no      
front-proxy-ca          Mar 12, 2032 01:59 UTC   9y              no