Rancher Server 证书更新

最新推荐文章于 2024-07-03 09:22:47 发布

daydayup9527

最新推荐文章于 2024-07-03 09:22:47 发布

阅读量552

点赞数

分类专栏： kubenetes 文章标签： rancher docker 运维

本文链接：https://blog.csdn.net/weixin_60092693/article/details/129017788

版权

kubenetes 专栏收录该内容

39 篇文章 4 订阅

订阅专栏

集群安装

yum update -y
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo && yum makecache

mkfs.ext4 /dev/sdb
mount /dev/sdb /mnt/
mount -t nfs -o vers=3,nolock 10.1.0.7:/ /app

curl https://releases.rancher.com/install-docker/19.03.sh | sh
docker ps
systemctl stop docker
mv  /var/lib/docker   /mnt/docker
ln -s /mnt/docker /var/lib/docker
systemctl start docker
docker ps
docker info

curl -L https://github.com/docker/compose/releases/download/1.21.0/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
chmod 755 docker-compose

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo && yum makecache
yum -y install nfs-utils
yum update -y

curl https://releases.rancher.com/install-docker/19.03.sh | sh
systemctl stop docker
mv /var/lib/docker /mnt/docker
/dev/sdb        493G  3.4G  464G   1% /mnt
ln -s /mnt/docker /var/lib/docker
cat /etc/docker/daemon.json
{
"max-concurrent-downloads": 3,
"max-concurrent-uploads": 5,
"insecure-registries":["10.1.0.24:8888"],
"log-driver": "json-file",
"log-opts": {
    "max-size": "100m",
    "max-file": "3"
    }
}
systemctl daemon-reload
systemctl restart docker
docker info

rancher

mkdir /mnt/rancher
docker run -d --restart=unless-stopped   -p 80:80 -p 443:443   --privileged   -v /mnt/rancher:/var/lib/rancher   rancher/rancher:v2.5.9
#Kubernetes 版本  v1.20.11
[root@dev-rancher ~]# docker images
REPOSITORY          TAG         IMAGE ID            CREATED             SIZE
rancher/rancher     v2.5.9      d7329a56a8e4        17 months ago       1.06GB

master/etcd

sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run  rancher/rancher-agent:v2.5.9 --server https://10.1.0.31 --token tkvs7c5bztn6cqjb6mlnp6m4vl2qcffsvt7jb7h5skmbrq6llkmrz6 --ca-checksum 90e166c7a46d1c40470dee6143f850e875e457bece96a4768dc7c0fe75a1f854 --etcd --controlplane

[root@dev-master ~]# docker images
REPOSITORY                                   TAG                 IMAGE ID            CREATED             SIZE
rancher/hyperkube                            v1.20.11-rancher1   bf745e45cbc3        15 months ago       1.87GB
rancher/rke-tools                            v0.1.78             6eeaa0b8da2c        17 months ago       264MB
rancher/rancher-agent                        v2.5.9              ebd5d4b8d7aa        17 months ago       536MB
rancher/rke-tools                            v0.1.75             f27a7e64b68c        18 months ago       196MB
rancher/mirrored-coreos-etcd                 v3.4.15-rancher1    87c4f81d8822        22 months ago       83.8MB
rancher/mirrored-calico-node                 v3.17.2             5a3c598c81d5        22 months ago       165MB
rancher/mirrored-calico-pod2daemon-flexvol   v3.17.2             e2608e41ac3d        22 months ago       21.7MB
rancher/mirrored-calico-cni                  v3.17.2             81860c306a8d        22 months ago       128MB
rancher/mirrored-calico-kube-controllers     v3.17.2             59b927df412f        22 months ago       52.1MB
rancher/coreos-flannel                       v0.13.0-rancher1    0bfefe9f649b        2 years ago         57.5MB
rancher/kube-api-auth                        v0.1.4              96148b821282        2 years ago         37.3MB
rancher/mirrored-pause                       3.2                 80d28bedfe5d        2 years ago         683kB

node

sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run  rancher/rancher-agent:v2.5.9 --server https://10.1.0.31 --token tkvs7c5bztn6cqjb6mlnp6m4vl2qcffsvt7jb7h5skmbrq6llkmrz6 --ca-checksum 90e166c7a46d1c40470dee6143f850e875e457bece96a4768dc7c0fe75a1f854 --worker

[root@dev-node ~]# docker images
REPOSITORY                                         TAG                     IMAGE ID            CREATED             SIZE
nginx                                              latest                  605c77e624dd        11 months ago       141MB
rancher/hyperkube                                  v1.20.11-rancher1       bf745e45cbc3        15 months ago       1.87GB
rancher/rke-tools                                  v0.1.78                 6eeaa0b8da2c        17 months ago       264MB
rancher/rancher-agent                              v2.5.9                  ebd5d4b8d7aa        17 months ago       536MB
rancher/fleet-agent                                v0.3.5                  2a0c55d5db35        19 months ago       163MB
rancher/nginx-ingress-controller                   nginx-0.43.0-rancher3   d62950c1bfa1        20 months ago       296MB
rancher/mirrored-calico-node                       v3.17.2                 5a3c598c81d5        22 months ago       165MB
rancher/mirrored-calico-pod2daemon-flexvol         v3.17.2                 e2608e41ac3d        22 months ago       21.7MB
rancher/mirrored-calico-cni                        v3.17.2                 81860c306a8d        22 months ago       128MB
rancher/mirrored-metrics-server                    v0.4.1                  9759a41ccdf0        2 years ago         60.5MB
rancher/mirrored-coredns-coredns                   1.8.0                   296a6d5035e2        2 years ago         42.5MB
rancher/coreos-flannel                             v0.13.0-rancher1        0bfefe9f649b        2 years ago         57.5MB
rancher/mirrored-cluster-proportional-autoscaler   1.8.1                   4f1064cf7caf        2 years ago         40.7MB
rancher/mirrored-pause                             3.2                     80d28bedfe5d        2 years ago         683kB

节点添加集群仪表盘–kubeconfig旁点击，进入registation CMD，添加节点

独立容器 Rancher Server 证书更新

https://docs.rancher.cn/docs/rancher2/trending-topics/certificate-rotation/_index/

查看证书，浏览器里点证书当前 11:06

1、exec 到 rancher server
kubectl --insecure-skip-tls-verify -n kube-system delete secrets k3s-serving
kubectl --insecure-skip-tls-verify delete secret serving-cert -n cattle-system
rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json

2、重启 rancher-server
docker restart <rancher_server_id>
3、执行以下命令刷新参数
curl --insecure -sfL https://10.1.0.31/v3  # Rancher Server 的访问地址
docker restart <rancher_server_id>

浏览器查看证书，签发时间没有变，但是有效时间延长了

颁发日期	2022年12月21日星期三 11:06:38
截止日期	2023年12月21日星期四 13:43:57

颁发日期	2022年12月21日星期三 11:06:38
截止日期	2023年12月21日星期四 13:49:21

RKE 轮换证书

[root@dev-rancher ~]# docker exec -it e66494c60479  bash

root@e66494c60479:/var/lib/rancher# for i in ls /var/lib/rancher/k3s/server/tls/*.crt; do echo $i; openssl x509 -enddate -noout -in $i; done
ls
...
/var/lib/rancher/k3s/server/tls/client-admin.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-ca.crt
notAfter=Dec 18 03:06:10 2032 GMT
/var/lib/rancher/k3s/server/tls/client-cloud-controller.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-controller.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-k3s-controller.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-kube-proxy.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-scheduler.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/request-header-ca.crt
notAfter=Dec 18 03:06:10 2032 GMT
/var/lib/rancher/k3s/server/tls/server-ca.crt
notAfter=Dec 18 03:06:10 2032 GMT
/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt
notAfter=Dec 21 03:06:10 2023 GMT

openssl x509 -in /etc/kubernetes/ssl/kube-apiserver.pem -noout -dates
notBefore=Dec 21 03:26:12 2022 GMT
notAfter=Dec 18 06:07:55 2032 GMT
#默认证书有效期10年

修改本机的系统时间，提前触发集群证书过期时间

[root@dev-rancher ~]# timedatectl set-ntp false
[root@dev-rancher ~]# timedatectl set-time '2025-07-11 18:02:20'
[root@rancher01 ~]# kubectl get nodes
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-07-20T13:57:29+08:00 is after 2022-07-12T16:33:11Z

rke cert rotate		#批量更新所有服务证书(CA 证书不变)
rke cert rotate --service kubelet	#更新某个指定服务(CA 证书不变)
rke cert rotate --rotate-ca		#轮换 CA 和所有服务证书

daydayup9527

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
Rancher Server 证书更新

实验测试
复制链接

扫一扫

专栏目录