如何修改Kubernetes的SSL证书有效期
主机配置规划
服务器名称(hostname) | 系统版本 | 配置 | 内网IP | 外网IP(模拟) |
---|---|---|---|---|
k8s-master | CentOS7.7 | 2C/4G/20G | 172.16.1.110 | 10.0.0.110 |
k8s-node01 | CentOS7.7 | 2C/4G/20G | 172.16.1.111 | 10.0.0.111 |
k8s-node02 | CentOS7.7 | 2C/4G/20G | 172.16.1.112 | 10.0.0.112 |
为什么要修改证书有效期
Kubernetes默认的证书有效期都是1年,因此需要我们每年都更新证书,显然这对我们实际生产环境来说是很不友好的;因此我们要对Kubernetes的SSL证书有效期进行修改。
证书有效期查看
[root@k8s-master pki]# pwd
/etc/kubernetes/pki
[root@k8s-master pki]# ll
total 56
-rw-r--r-- 1 root root 1224 May 12 15:51 apiserver.crt
-rw-r--r-- 1 root root 1090 May 12 15:51 apiserver-etcd-client.crt
-rw------- 1 root root 1675 May 12 15:51 apiserver-etcd-client.key
-rw------- 1 root root 1675 May 12 15:51 apiserver.key
-rw-r--r-- 1 root root 1099 May 12 15:51 apiserver-kubelet-client.crt
-rw------- 1 root root 1675 May 12 15:51 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1025 May 12 15:51 ca.crt
-rw------- 1 root root 1675 May 12 15:51 ca.key
drwxr-xr-x 2 root root 162 May 12 15:51 etcd
-rw-r--r-- 1 root root 1038 May 12 15:51 front-proxy-ca.crt
-rw------- 1 root root 1675 May 12 15:51 front-proxy-ca.key
-rw-r--r-- 1 root root 1058 May 12 15:51 front-proxy-client.crt
-rw------- 1 root root 1675 May 12 15:51 front-proxy-client.key
-rw------- 1 root root 1679 May 12 15:51 sa.key
-rw------- 1 root root 451 May 12 15:51 sa.pub
[root@k8s-master pki]#
[root@k8s-master pki]# for i in $(ls *.crt); do echo "===== $i ====="; openssl x509 -in $i -text -noout | grep -A 3 'Validity' ; done
===== apiserver.crt =====
Validity
Not Before: May 12 07:51:36 2020 GMT
Not After : May 12 07:51:36 2021 GMT
Subject: CN=kube-apiserver
===== apiserver-etcd-client.crt =====
Validity
Not Before: May 12 07:51:37 2020 GMT
Not After : May 12 07:51:38 2021 GMT
Subject: O=system:masters, CN=kube-apiserver-etcd-client
===