kubernetes 二进制部署证书续签

目录

二进制部署方式

---

二进制部署方式

1.启用证书轮转

# vi /opt/kubernetes/cfg/kubelet-config.yml
...
rotateCertificates: true

# systemctl restart kubelet

2. 配置kubelet证书申请自动签发

#自动批准首次申请证书的 CSR 请求
kubectl create clusterrolebinding node-client-auto-approve-csr --clusterrole=system:certificates.k8s.io:certificatesigningrequests:nodeclient --user=kubelet-bootstrap
# 自动批准kubelet客户端证书续签
kubectl create clusterrolebinding node-client-auto-renew-crt --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeclient --group=system:nodes
# 自动批准kubelet服务端证书续签
kubectl create clusterrolebinding node-server-auto-renew-crt --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeserver --group=system:nodes