k8s kubeadm 源码编译

kubeadm 源码编译

当用 kubeadm 安装 k8s 时，其 api-server 证书有效期为1年，为了设置更长的证书有效期，我们可以修改译 kubeadm 源码，并重新编译；然后再用 kubeadm 安装 k8s 。

准备工作

准备好 Linux （CentOS） 虚拟机，并安装 Go 环境。

注意事项：

安装或重装 Go 之前，先通过 kubeadm version 查看对应的 Go 语言版本。

[root@k8sMaster1 kalami]#kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"17+", GitVersion:"v1.17.3-dirty", GitCommit:"06ad960bfd03b39c8310aaf92d1e7c12ce618213", GitTreeState:"dirty", BuildDate:"2022-01-26T04:41:39Z", GoVersion:"go1.13.6", Compiler:"gc", Platform:"linux/amd64"}

安装 Go 环境

下载 Go 安装包：

可以到 Go下载 - Go语言中文网 - Golang中文社区 (studygolang.com) 查看最新发布版本信息。

wget https://dl.google.com/go/go1.17.6.linux-amd64.tar.gz

解压到 /usr/local目录下：

rm -rf /usr/local/go
tar xvfz go1.17.6.linux-amd64.tar.gz -C /usr/local

设置环境变量:

vi /etc/profile

#golang env config
export GO111MODULE=on
export GOROOT=/usr/local/go 
export GOPATH=/home/gopath
export PATH=$PATH:$GOROOT/bin:$GOPATH/bin

执行环境变量：

source /etc/profile
go version

源码下载

git 下载 kubeadm 版本对应分支源码：

git clone https://github.com/kubernetes/kubernetes.git -b v1.18.2

[root@k8sWorker1 git]# git clone https://github.com/kubernetes/kubernetes.git -b v1.18.2
Cloning into 'kubernetes'...
remote: Enumerating objects: 1302084, done.
remote: Counting objects: 100% (217/217), done.
remote: Compressing objects: 100% (151/151), done.
Receiving objects:  12% (162281/1302084), 101.37 MiB | 1.63 MiB/s

修改源码

kubeadm 源码包证书期限策略代码在 kubernetes/cmd/kubeadm/app/util/pkiutil/pki_helpers.go 中。

vi cmd/kubeadm/app/util/pkiutil/pki_helpers.go

const duration3650d = time.Hour * 24 * 365 * 10
notAfter:    time.Now().Add(duration3650d).UTC()

源码查找 .UTC 关键字：

修改前源码：

    636 // NewSignedCert creates a signed certificate using the given CA certificate and key
    637 func NewSignedCert(cfg *CertConfig, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer, isCA bool) (*x     509.Certificate, error) {
    638         serial, err := cryptorand.Int(cryptorand.Reader, new(big.Int).SetInt64(math.MaxInt64))
    639         if err != nil {
    640                 return nil, err
    641         }
    642         if len(cfg.CommonName) == 0 {
    643                 return nil, errors.New("must specify a CommonName")
    644         }
    645
    646         keyUsage := x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature
    647         if isCA {
    648                 keyUsage |= x509.KeyUsageCertSign
    649         }
    650
    651         RemoveDuplicateAltNames(&cfg.AltNames)
    652
    653         notAfter := time.Now().Add(kubeadmconstants.CertificateValidity).UTC()
    654         if cfg.NotAfter != nil {
    655                 notAfter = *cfg.NotAfter
    656         }
    657
    658         certTmpl := x509.Certificate{
    659                 Subject: pkix.Name{
    660                         CommonName:   cfg.CommonName,
    661                         Organization: cfg.Organization,
    662                 },
    663                 DNSNames:              cfg.AltNames.DNSNames,
    664                 IPAddresses:           cfg.AltNames.IPs,
    665                 SerialNumber:          serial,
    666                 NotBefore:             caCert.NotBefore,
    667                 NotAfter:              notAfter,
    668                 KeyUsage:              keyUsage,
    669                 ExtKeyUsage:           cfg.Usages,
    670                 BasicConstraintsValid: true,
    671                 IsCA:                  isCA,
    672         }

修改后源码：

    637 func NewSignedCert(cfg *CertConfig, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer, isCA bool) (*x509.Certific        ate, error) {
    638         const duration3650d = time.Hour * 24 * 365 * 10  // mage add
    639         serial, err := cryptorand.Int(cryptorand.Reader, new(big.Int).SetInt64(math.MaxInt64))
    640         if err != nil {
    641                 return nil, err
    642         }
    643         if len(cfg.CommonName) == 0 {
    644                 return nil, errors.New("must specify a CommonName")
    645         }
    646
    647         keyUsage := x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature
    648         if isCA {
    649                 keyUsage |= x509.KeyUsageCertSign
    650         }
    651
    652         RemoveDuplicateAltNames(&cfg.AltNames)
    653
    654         // 码村长 modify
    655         //notAfter := time.Now().Add(kubeadmconstants.CertificateValidity).UTC()
    656         notAfter := time.Now().Add(duration3650d).UTC()
    657         if cfg.NotAfter != nil {
    658                 notAfter = *cfg.NotAfter
    659         }
    660
    661         certTmpl := x509.Certificate{
    662                 Subject: pkix.Name{
    663                         CommonName:   cfg.CommonName,
    664                         Organization: cfg.Organization,
    665                 },
    666                 DNSNames:              cfg.AltNames.DNSNames,
    667                 IPAddresses:           cfg.AltNames.IPs,
    668                 SerialNumber:          serial,
    669                 NotBefore:             caCert.NotBefore,
    670                 NotAfter:              notAfter,
    671                 KeyUsage:              keyUsage,
    672                 ExtKeyUsage:           cfg.Usages,

编译源码

make WHAT=cmd/kubeadm GOFLAGS=-v
cp _output/bin/kubeadm /root/kubeadm-new

开始编译，慢慢等待…

[root@k8sWorker1 kubernetes]# make WHAT=cmd/kubeadm GOFLAGS=-v
k8s.io/kubernetes/vendor/github.com/spf13/pflag
k8s.io/kubernetes/hack/make-rules/helpers/go2make
+++ [0126 11:08:04] Building go targets for linux/amd64:
    ./vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen
> non-static build: k8s.io/kubernetes/./vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen
k8s.io/kubernetes/vendor/golang.org/x/xerrors/internal
k8s.io/kubernetes/vendor/golang.org/x/mod/semver
k8s.io/kubernetes/vendor/golang.org/x/sys/execabs
k8s.io/kubernetes/vendor/golang.org/x/tools/internal/event/label
k8s.io/kubernetes/vendor/golang.org/x/mod/internal/lazyregexp
k8s.io/kubernetes/vendor/golang.org/x/xerrors

编译过程慢慢等待，无需中断！

更新 kubeadm

备份原来的 kubeadm 程序，并用新的 kubeadm 替换：

mv /usr/bin/kubeadm /usr/bin/kubeadm_old
cp /root/git/kubernetes/_output/bin/kubeadm /usr/bin/
chmod +x /usr/bin/kubeadm