单节点k8s证书更新

实验环境

• 单节点
• k8s版本：1.23.0
• 命令执行节点 master节点

执行操作

• step1：查看当前证书过期时间

[root@master kubernetes]# kubeadm certs check-expiration                                                                                                                                    
[check-expiration] Reading configuration from the cluster...                                                                                                                                
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'                                                                        
                                                                                                                                                                                            
CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED                                                                              
admin.conf                 Nov 26, 2024 08:35 UTC   364d                                    no                                                                                              
apiserver                  Nov 26, 2024 08:32 UTC   364d            ca                      no                                                                                              
apiserver-etcd-client      Nov 26, 2024 08:32 UTC   364d            etcd-ca                 no                                                                                              
apiserver-kubelet-client   Nov 26, 2024 08:32 UTC   364d            ca                      no                                                                                              
controller-manager.conf    Nov 26, 2024 08:32 UTC   364d                                    no                                                                                              
etcd-healthcheck-client    Nov 26, 2024 08:32 UTC   364d            etcd-ca                 no                                                                                              
etcd-peer                  Nov 26, 2024 08:32 UTC   364d            etcd-ca                 no                                                                                              
etcd-server                Nov 26, 2024 08:32 UTC   364d            etcd-ca                 no                                                                                              
front-proxy-client         Nov 26, 2024 08:32 UTC   364d            front-proxy-ca          no                                                                                              
scheduler.conf             Nov 26, 2024 08:32 UTC   364d                                    no                                                                                              
                                                                                                                                                                                            
CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED                                                                                                         
ca                      Oct 08, 2033 04:27 UTC   9y              no                                                                                                                         
etcd-ca                 Oct 08, 2033 04:27 UTC   9y              no                                                                                                                         
front-proxy-ca          Oct 08, 2033 04:27 UTC   9y              no     

• step2:备份证书

#使用kubeadm安装的k8s集群默认会使用/etc/kubernetes/pki保存ca证书
cp -r /etc/kubernetes/pki/ /etc/kubernetes/pki.bak

[root@master pki]# ls
apiserver.crt              apiserver-etcd-client.key  apiserver-kubelet-client.crt  ca.crt  etcd                front-proxy-ca.key      front-proxy-client.key  sa.pub
apiserver-etcd-client.crt  apiserver.key              apiserver-kubelet-client.key  ca.key  front-proxy-ca.crt  front-proxy-client.crt  sa.key

• step2：更新ca证书

kubeadm certs renew all          #新版本更新证书
kubeadm alpha certs renew all    #老版本更新证书
#更新完毕后检查证书更新状态
kubeadm certs check-expiration

执行命令后的结果如下：

[root@master pki]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

[root@master pki]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Nov 27, 2024 01:29 UTC   364d                                    no      
apiserver                  Nov 27, 2024 01:29 UTC   364d            ca                      no      
apiserver-etcd-client      Nov 27, 2024 01:29 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Nov 27, 2024 01:29 UTC   364d            ca                      no      
controller-manager.conf    Nov 27, 2024 01:29 UTC   364d                                    no      
etcd-healthcheck-client    Nov 27, 2024 01:29 UTC   364d            etcd-ca                 no      
etcd-peer                  Nov 27, 2024 01:29 UTC   364d            etcd-ca                 no      
etcd-server                Nov 27, 2024 01:29 UTC   364d            etcd-ca                 no      
front-proxy-client         Nov 27, 2024 01:29 UTC   364d            front-proxy-ca          no      
scheduler.conf             Nov 27, 2024 01:29 UTC   364d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Oct 08, 2033 04:27 UTC   9y              no      
etcd-ca                 Oct 08, 2033 04:27 UTC   9y              no      
front-proxy-ca          Oct 08, 2033 04:27 UTC   9y              no      

• step3:重启静态负载
  这一步需要重启kube-apiserver等kubelet托管的静态pod，静态pod配置文件所在目录是/etc/kubernetes/manifests/

#清除静态pod
mv /etc/kubernetes/manifests/ /etc/kubernetes/manifests.bak
sleep 20
mv  /etc/kubernetes/manifests.bak /etc/kubernetes/manifests/

注意：20是官网给的数值，真实等待时间应该看kubelet的监听配置

[root@master pki]# cat /var/lib/kubelet/config.yaml |grep fileCheckFrequency:
fileCheckFrequency: 0s

• step4： 更新kubeconfig

kubeadm init phase kubeconfig all
yes|cp -f  ~/.kube/config ~/.kube/config.bak
yes|cp -f /etc/kubernetes/admin.conf ~/.kube/config

• step5: 检验

[root@master .kube]# kubectl get node
NAME     STATUS   ROLES                  AGE   VERSION
master   Ready    control-plane,master   47d   v1.23.0

收尾步骤省略

参考文章：
使用 kubeadm 进行证书管理
k8s证书更新，kubeadm安装的K8S证书过期后无法使用后证书更新方法