自建k8s集群证书到期的更换

1、说明

    一般正常安装k8s集群，集群证书的有效期是一年，包括以下证书：
    - apiserver
    - apiserver-kubelet-client
    - apiserver-etcd-client
    - front-proxy-client
    - etcd/server
    - etcd/peer
    - etcd/healthcheck-client

2、证书过期问题解决办法
对于手动生成的证书
    手动安装过程中，只需指定证书的过期时间为N天即可
对于kubeadm
    方式一：升级K8S集群，自动更新证书
    方式二：修改kubeadm并重新编译
    方式三：重新生成证书
3、过期处理
报错信息
    [root@k8s-master03 ~]# kubectl get po
    Unable to connect to the server: x509: certificate has expired or is not yet valid
日志信息
    The currently active client certificate has expired, but the server is not responsive. A restart may be necessary to retrieve new initial credentials.
证书备份
    cp -rp /etc/kubernetes /etc/kubernetes.bak
apiserver证书
    [root@k8s-master03 ~]# rm -f /etc/kubernetes/pki/apiserver*
front-proxy-client证书
    [root@k8s-master03 ~]# rm -f /etc/kubernetes/pki/front-proxy-client.*
etcd证书
    rm -rf /etc/kubernetes/pki/etcd/healthcheck-client.*
    rm -rf /etc/kubernetes/pki/etcd/server.*
    rm -rf /etc/kubernetes/pki/etcd/peer.*
重新生成证书
[root@k8s-master02 ~]# /opt/kubeadm alpha phase certs all --config kubeadm-config.yaml 
[certificates] Generated apiserver-kubelet-client certificate and key.
[certificates] Generated apiserver certificate and key.
[certificates] apiserver serving cert is signed for DNS names [k8s-master02 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local k8s-master01 k8s-master02 k8s-master03 k8s-master-lb] and IPs [10.96.0.1 192.168.20.21 192.168.20.10 192.168.20.20 192.168.20.21 192.168.20.22 192.168.20.10]
[certificates] Generated front-proxy-client certificate and key.
[certificates] Generated etcd/healthcheck-client certificate and key.
[certificates] Generated apiserver-etcd-client certificate and key.
[certificates] Generated etcd/server certificate and key.
[certificates] etcd/server serving cert is signed for DNS names [k8s-master02 localhost k8s-master02] and IPs [127.0.0.1 ::1 192.168.20.21]
[certificates] Generated etcd/peer certificate and key.
[certificates] etcd/peer serving cert is signed for DNS names [k8s-master02 localhost k8s-master02] and IPs [192.168.20.21 127.0.0.1 ::1 192.168.20.21]
[certificates] valid certificates and keys now exist in "/etc/kubernetes/pki"
[certificates] Using the existing sa key.

重新生成配置文件
[root@k8s-master02 ~]# mv /etc/kubernetes/
admin.conf               kubelet.conf             pki/                     scheduler.conf
controller-manager.conf  manifests/               pki.bak/                 tmp/
[root@k8s-master02 ~]# mv /etc/kubernetes/*.conf /tmp/
[root@k8s-master02 ~]# /opt/kubeadm alpha phase kubeconfig all --config kubeadm-config.yaml 
[endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"
重启kubelet
    [root@k8s-master01 ~]# systemctl restart kubelet

4、集群确认
证书过期时间确认
    # 注意：cfssl需要自行安装
    [root@k8s-master01 ~]# cfssl-certinfo -cert /etc/kubernetes/pki/etcd/server.crt | grep not
      "not_before": "2018-11-30T07:45:08Z",
      "not_after": "2117-11-16T06:07:00Z",
集群状态确认
    [root@k8s-master01 ~]# kubectl get no
    NAME           STATUS   ROLES    AGE     VERSION
    k8s-master01   Ready    master   6d22h   v1.12.3
    k8s-master02   Ready    master   6d22h   v1.12.3
    k8s-master03   Ready    master   6d22h   v1.12.3
    k8s-node01     Ready    <none>   6d21h   v1.12.3
    k8s-node02     Ready    <none>   6d21h   v1.12.3
    
检查证书到期时间
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '
openssl x509 -in /etc/kubernetes/pki/apiserver-etcd-client.crt -noout -text |grep ' Not '
openssl x509 -in /etc/kubernetes/pki/apiserver-kubelet-client.crt -noout -text |grep ' Not '
openssl x509 -in /etc/kubernetes/pki/front-proxy-client.crt -noout -text |grep ' Not '
openssl x509 -in /etc/kubernetes/pki/etcd/healthcheck-client.crt -noout -text |grep ' Not '
openssl x509 -in /etc/kubernetes/pki/etcd/peer.crt -noout -text |grep ' Not '
openssl x509 -in /etc/kubernetes/pki/etcd/server.crt -noout -text |grep ' Not '