kubeadm搭建的k8s集群证书过期处理

k8s 证书过期处理

---

注：kubeadm部署，k8s版本 1.18

[root@master ~]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.0", GitCommit:"af46c47ce925f4c4ad5cc8d1fca46c7b77d13b38", GitTreeState:"clean", BuildDate:"2020-12-08T17:57:36Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}

1 效果

[root@master ~]# kubectl get pod
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2021-12-12T17:03:08+08:00 is after 2021-12-12T04:54:46Z

1. 确认不是节点时间导致

2. 检查证书时间确实过期了

=

2 检查是否过期

kubeadm alpha certs check-expiration

[root@master ~]# kubeadm alpha certs check-expiration
Command "check-expiration" is deprecated, please use the same command under "kubeadm certs"
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Dec 12, 2021 04:54 UTC   <invalid>                               no      
apiserver                  Dec 12, 2021 04:54 UTC   <invalid>       ca                      no      
apiserver-etcd-client      Dec 12, 2021 04:54 UTC   <invalid>       etcd-ca                 no      
apiserver-kubelet-client   Dec 12, 2021 04:54 UTC   <invalid>       ca                      no      
controller-manager.conf    Dec 12, 2021 04:54 UTC   <invalid>                               no      
etcd-healthcheck-client    Dec 12, 2021 04:54 UTC   <invalid>       etcd-ca                 no      
etcd-peer                  Dec 12, 2021 04:54 UTC   <invalid>       etcd-ca                 no      
etcd-server                Dec 12, 2021 04:54 UTC   <invalid>       etcd-ca                 no      
front-proxy-client         Dec 12, 2021 04:54 UTC   <invalid>       front-proxy-ca          no      
scheduler.conf             Dec 12, 2021 04:54 UTC   <invalid>                               no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Dec 10, 2030 04:54 UTC   8y              no      
etcd-ca                 Dec 10, 2030 04:54 UTC   8y              no      
front-proxy-ca          Dec 10, 2030 04:54 UTC   8y              no

1. 可看到 CA 还有8年（十年有效期）
2. 其他全部证书已经过期（<invalid>）

=

3 一键更新

kubeadm alpha certs renew all

[root@master ~]# kubeadm alpha certs renew all
Command "all" is deprecated, please use the same command under "kubeadm certs"
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

# 由输出内容可知，更新的内容为：
Kubernetes API的证书；
apiserver的证书，用来访问etcd；
API server的证书，用来连接kubelet；
嵌入在kubeconfig文件中，用于controller manager的使用；
liveness probes的证书，用来对etcd作health check；
etcd节点的证书，用来互相访问；
前端代理服务的证书；
嵌入在kubeconfig文件中，用于scheduler manager的使用。

=

4 检查

RESIDUAL=364d，说明刚刚更新

[root@master ~]# kubeadm alpha certs check-expiration
Command "check-expiration" is deprecated, please use the same command under "kubeadm certs"
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Dec 12, 2022 09:46 UTC   364d                                    no      
apiserver                  Dec 12, 2022 09:46 UTC   364d            ca                      no      
apiserver-etcd-client      Dec 12, 2022 09:46 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Dec 12, 2022 09:46 UTC   364d            ca                      no      
controller-manager.conf    Dec 12, 2022 09:46 UTC   364d                                    no      
etcd-healthcheck-client    Dec 12, 2022 09:46 UTC   364d            etcd-ca                 no      
etcd-peer                  Dec 12, 2022 09:46 UTC   364d            etcd-ca                 no      
etcd-server                Dec 12, 2022 09:46 UTC   364d            etcd-ca                 no      
front-proxy-client         Dec 12, 2022 09:46 UTC   364d            front-proxy-ca          no      
scheduler.conf             Dec 12, 2022 09:46 UTC   364d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Dec 10, 2030 04:54 UTC   8y              no      
etcd-ca                 Dec 10, 2030 04:54 UTC   8y              no      
front-proxy-ca          Dec 10, 2030 04:54 UTC   8y              no

=wan