kubernetes集群证书延期

查看集群当前证书到期时间：

[root@k8s001 ~]# kubeadm alpha certs check-expiration   # 部分老版本可能需要用此命令查看
[root@k8s001 ~]# kubeadm  certs check-expiration     
CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Oct 15, 2021 07:58 UTC   364d                                    no      
apiserver                  Oct 15, 2021 07:58 UTC   364d            ca                      no      
apiserver-etcd-client      Oct 15, 2021 07:58 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Oct 15, 2021 07:58 UTC   364d            ca                      no      
controller-manager.conf    Oct 15, 2021 07:58 UTC   364d                                    no      
etcd-healthcheck-client    Oct 15, 2021 07:58 UTC   364d            etcd-ca                 no      
etcd-peer                  Oct 15, 2021 07:58 UTC   364d            etcd-ca                 no      
etcd-server                Oct 15, 2021 07:58 UTC   364d            etcd-ca                 no      
front-proxy-client         Oct 15, 2021 07:58 UTC   364d            front-proxy-ca          no      
scheduler.conf             Oct 15, 2021 07:58 UTC   364d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Oct 13, 2030 07:58 UTC   9y              no      
etcd-ca                 Oct 13, 2030 07:58 UTC   9y              no      
front-proxy-ca          Oct 13, 2030 07:58 UTC   9y              no  

单个证书查看

[root@k8s001 ~]#  cd /etc/kubernetes/pki/   #单个证书期限查看
[root@k8s001 ~]#  openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -text  |grep Not
        Not Before: Oct 15 07:58:40 2020 GMT
        Not After : Oct 13 07:58:40 2030 GMT
#通过上面信息可看到ca证书有效期是10年，从2020到2030年		
[root@k8s001 ~]#  openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text  |grep Not		
        Not Before: Oct 15 07:58:40 2020 GMT
        Not After : Oct 15 07:58:41 2021 GMT		
#通过上面可看到apiserver证书有效期是1年，从2020到2021年
[root@k8s001 ~]#  openssl x509 -in /etc/kubernetes/pki/apiserver-etcd-client.crt  -noout -text  |grep Not  #一年
        Not Before: Oct 15 07:58:43 2020 GMT
        Not After : Oct 15 07:58:45 2021 GMT
[root@k8s001 ~]#   openssl x509 -in /etc/kubernetes/pki/front-proxy-ca.crt  -noout -text  |grep Not         #十年
        Not Before: Oct 15 07:58:41 2020 GMT
        Not After : Oct 13 07:58:41 2030 GMT

安装证书更新依赖工具

首先下载go环境支撑

[root@k8s001 ~]#   wget https://gomirrors.org/dl/go/go1.18.3.linux-amd64.tar.gz
[root@k8s001 ~]#  tar xf go1.18.3.linux-amd64.tar.gz -C /usr/local/
[root@k8s001 ~]#   ls /usr/local/go
[root@k8s001 ~]#  vim /etc/profile
...
export PATH=$PATH:/usr/local/go/bin
...
[root@k8s001 ~]# source /etc/profile
[root@k8s001 ~]# go version
go version go1.18.3 linux/amd64

克隆k8s项目到本地

[root@k8s001 ~]#  git clone https://github.com/kubernetes/kubernetes.git    # 克隆整个仓库
[root@k8s001 ~]#  git clone --branch release-1.18 https://github.com/kubernetes/kubernetes.git  #单独只克隆单个对应版本分支​
[root@k8s001 ~]#  cd kubernetes
[root@k8s001 kubernetes]#  kubeadm version  # 查看当前集群安装版本
[root@k8s001 kubernetes]#  git checkout -b remotes/origin/release-1.18.8 v1.18.8 
切换到一个新分支 'remotes/origin/release-1.18.8'

修改证书期限：

 [root@k8s001 kubernetes]#  vim cmd/kubeadm/app/constants/constants.go
 CertificateValidity = time.Hour * 24 * 365 * 10    #改为 time.Hour * 24 * 365 * 10  #修改为*10即改成10年到期
 [root@k8s001 kubernetes]#  make WHAT=cmd/kubeadm GOFLAGS=-v  #编译，新生成的二进制在_output/bin/目录下

利用新生成的二进制文件替换当前集群的文件

# 替换之前先进去备份
[root@k8s001 kubernetes]#  \cp /usr/bin/kubeadm /usr/bin/kubeadm.backup
[root@k8s001 kubernetes]#  \cp _output/bin/kubeadm /usr/bin/kubeadm
[root@k8s001 kubernetes]#  \cp -r /etc/kubernetes/pki /etc/kubernetes/pki.backup​
[root@k8s001 kubernetes]#  cd /etc/kubernetes/pki
[root@k8s001 pki]#  kubeadm alpha certs renew all # 老版本可能需要使用此命令
[root@k8s001 pki]#  kubeadm  certs renew all  # 新版本对应此命令

查看结果

[root@k8s001 ~]#   kubeadm  certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Oct 15, 2030 02:36 UTC   9y                                      no      
apiserver                  Oct 15, 2030 02:36 UTC   9y              ca                      no      
apiserver-etcd-client      Oct 15, 2030 02:36 UTC   9y              etcd-ca                 no      
apiserver-kubelet-client   Oct 15, 2030 02:36 UTC   9y              ca                      no      
controller-manager.conf    Oct 15, 2030 02:36 UTC   9y                                      no      
etcd-healthcheck-client    Oct 15, 2030 02:36 UTC   9y              etcd-ca                 no      
etcd-peer                  Oct 15, 2030 02:36 UTC   9y              etcd-ca                 no      
etcd-server                Oct 15, 2030 02:36 UTC   9y              etcd-ca                 no      
front-proxy-client         Oct 15, 2030 02:36 UTC   9y              front-proxy-ca          no      
scheduler.conf             Oct 15, 2030 02:36 UTC   9y                                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Oct 13, 2030 07:58 UTC   9y              no      
etcd-ca                 Oct 13, 2030 07:58 UTC   9y              no      
front-proxy-ca          Oct 13, 2030 07:58 UTC   9y              no 

高可用集群证书更新：

另外几台的master，只需要把新生成的kubeadm文件，从第一台更新过的scp过去，然后按上面步骤，重新生成新的证书文件就可以了。记住更新过需要重启一下服务或者服务器。

[root@k8s001 ~]#   scp  _output/bin/kubeadm   k8s002:/usr/bin/kubeadm
[root@k8s002 ~]#  kubeadm  certs renew all
[root@k8s002 ~]#  kubeadm certs check-expiration