修改kubeadm v1.17.4 证书有效期为永久有效

1. 下载go二进制包并配置环境

[maaiqiang@localhost ~]$ cd /usr/local/src/
[maaiqiang@localhost ~]$ wget https://dl.google.com/go/go1.13.8.linux-amd64.tar.gz
[maaiqiang@localhost ~]$ tar -C /usr/local -xzf go1.13.8.linux-amd64.tar.gz
[maaiqiang@localhost ~]$ echo “export PATH=$PATH:/usr/local/go/bin” >> /etc/profile
[maaiqiang@localhost ~]$ source /etc/profile
[maaiqiang@localhost ~]$ go version

2. 下载kubernetes v1.17.4源码包

[maaiqiang@localhost ~]$ cd /usr/local/src/
[maaiqiang@localhost ~]$ wget https://github.com/kubernetes/kubernetes/archive/v1.17.4.tar.gz
[maaiqiang@localhost ~]$ tar -xf v1.17.4.tar.gz
[maaiqiang@localhost ~]$ cd kubernetes–1.17.4/

2.1 修改有效期限制为100年

[maaiqiang@localhost ~]$ vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go

NotAfter:     time.Now().Add(kubeadmconstants.CertificateValidity * 100).UTC()  # 修改成100年

2.2 修改有效期限制为100年

[maaiqiang@localhost ~]$ vim staging/src/k8s.io/client-go/util/cert/cert.go

NotAfter:              now.Add(duration365d * 100).UTC(),
NotAfter:  validFrom.Add(maxAge * 100)
NotAfter:  validFrom.Add(maxAge * 100),

3. 重新编译

[maaiqiang@localhost ~]$ make all WHAT=cmd/kubeadm GOFLAGS=-v

4. 使用编译后的 kubeadm文件替换官方原 kubeadm

# 获取kubeadm文件位置
[maaiqiang@localhost ~]$ which kubeadm

[maaiqiang@localhost ~]$ cp /usr/local/src/kubernetes–1.17.4/_output/local/bin/linux/amd64/kubeadm /usr/bin

5. 验证

[maaiqiang@localhost ~]$ kubeadm alpha certs check-expiration

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Apr 07, 2021 07:39 UTC   364d                                    no      
apiserver                  Apr 07, 2021 07:39 UTC   364d            ca                      no      
apiserver-etcd-client      Apr 07, 2021 07:39 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Apr 07, 2021 07:39 UTC   364d            ca                      no      
controller-manager.conf    Apr 07, 2021 07:40 UTC   364d                                    no      
etcd-healthcheck-client    Apr 07, 2021 07:40 UTC   364d            etcd-ca                 no      
etcd-peer                  Apr 07, 2021 07:40 UTC   364d            etcd-ca                 no      
etcd-server                Apr 07, 2021 07:40 UTC   364d            etcd-ca                 no      
front-proxy-client         Apr 07, 2021 07:40 UTC   364d            front-proxy-ca          no      
scheduler.conf             Apr 07, 2021 07:40 UTC   364d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 12, 2030 02:18 UTC   9y              no      
etcd-ca                 Mar 12, 2030 02:18 UTC   9y              no      
front-proxy-ca          Mar 12, 2030 02:18 UTC   9y              no      

[maaiqiang@localhost ~]$ kubeadm alpha certs renew all

[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

[root@k8s-master kubernetes-1.17.4]# kubeadm alpha certs check-expiration

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 14, 2120 08:29 UTC   99y                                     no      
apiserver                  Mar 14, 2120 08:29 UTC   99y             ca                      no      
apiserver-etcd-client      Mar 14, 2120 08:29 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Mar 14, 2120 08:29 UTC   99y             ca                      no      
controller-manager.conf    Mar 14, 2120 08:29 UTC   99y                                     no      
etcd-healthcheck-client    Mar 14, 2120 08:29 UTC   99y             etcd-ca                 no      
etcd-peer                  Mar 14, 2120 08:29 UTC   99y             etcd-ca                 no      
etcd-server                Mar 14, 2120 08:29 UTC   99y             etcd-ca                 no      
front-proxy-client         Mar 14, 2120 08:29 UTC   99y             front-proxy-ca          no      
scheduler.conf             Mar 14, 2120 08:29 UTC   99y                                     no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 12, 2030 02:18 UTC   9y              no      
etcd-ca                 Mar 12, 2030 02:18 UTC   9y              no      
front-proxy-ca          Mar 12, 2030 02:18 UTC   9y              no