kubeadm 部署k8s v1.21版本集群证书更新

kubeadm 部署k8s v1.21版本集群证书更新

---

Date: 20231101 By topxia

针对 kubeadm部署的kubernetes，通过重新编译kubeadm将证书有效期改为99年。实际工作建议改为10年以下，因为ca时效是10年，下面可见。

一、准备工作

1、查看证书有效期

kubeadm安装默认证书只有一年时间。

1）kubeadm命令

]# kubeadm certs check-expiration

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 May 24, 2024 02:23 UTC   204d            ca                      no      
apiserver                  May 24, 2024 02:23 UTC   204d            ca                      no      
apiserver-etcd-client      May 24, 2024 02:23 UTC   204d            etcd-ca                 no      
apiserver-kubelet-client   May 24, 2024 02:23 UTC   204d            ca                      no      
controller-manager.conf    May 24, 2024 02:23 UTC   204d            ca                      no      
etcd-healthcheck-client    May 24, 2024 02:23 UTC   204d            etcd-ca                 no      
etcd-peer                  May 24, 2024 02:23 UTC   204d            etcd-ca                 no      
etcd-server                May 24, 2024 02:23 UTC   204d            etcd-ca                 no      
front-proxy-client         May 24, 2024 02:23 UTC   204d            front-proxy-ca          no      
scheduler.conf             May 24, 2024 02:23 UTC   204d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      May 22, 2033 02:23 UTC   9y              no      
etcd-ca                 May 22, 2033 02:23 UTC   9y              no      
front-proxy-ca          May 22, 2033 02:23 UTC   9y              no  

2）openssl查看文件

]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text  |grep Not

            Not Before: May 25 02:23:20 2023 GMT
            Not After : May 24 02:23:20 2024 GMT

2、查看当前版本

确认当前 kubeadm 版本和 go 的版本

命令： kubeadm version

]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.8", GitCommit:"4a3b558c52eb6995b3c5c1db5e54111bd0645a64", GitTreeState:"clean", BuildDate:"2021-12-15T14:50:58Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/amd64"}

模块	版本
kubeadm	v1.21.8
go	1.16.12

3、准备go环境

# go 语言下载地址
https://studygolang.com/dl

# 找到对应版本 go1.16.12，下载Linux，x86-64架构版本
# 文件名： go1.16.12.linux-amd64.tar.gz
# 下载地址
]# wget https://studygolang.com/dl/golang/go1.16.12.linux-amd64.tar.gz

# 解压
]# tar zxvf go1.16.12.linux-amd64.tar.gz
# 做软连接
]# ln -s /root/code-k8s-v1.21.8/go/bin/go /usr/bin/
]# ln -s /root/code-k8s-v1.21.8/go/bin/gofmt /usr/bin/

# 查看版本，测试通过
]# go version
go version go1.16.12 linux/amd64

4、下载k8s源码

（1）下载对应的版本

# 官网
https://github.com/kubernetes/kubernetes

# 通过 release 的 tags 找到对应的版本 v1.21.8
https://github.com/kubernetes/kubernetes/releases/tag/v1.21.8

# 下载 zip 和 tar.gz 均可
]# wget https://github.com/kubernetes/kubernetes/archive/refs/tags/v1.21.8.zip

# 解压下载好的源码
]# unzip kubernetes-1.21.8.zip 

（2）修改代码时间

]# cd kubernetes-1.21.8/cmd/kubeadm/app/constants/

# 修改默认证书时间
]# vim constants.go
CertificateValidity = time.Hour * 24 * 365
改为
CertificateValidity = time.Hour * 24 * 365 * 100

（3）编译

# 回到解压目录进行编译
# cd kubernetes-1.21.8

# 编译
]# make WHAT=cmd/kubeadm   或者
]# make WHAT=cmd/kubeadm GOFLAGS=-v

（4）查看编译好的版本

[root@master kubernetes-1.21.8]# ll _output/bin/
total 81160
-rwxr-xr-x 1 root root  5951488 Nov  1 13:24 conversion-gen
-rwxr-xr-x 1 root root  5697536 Nov  1 13:24 deepcopy-gen
-rwxr-xr-x 1 root root  5718016 Nov  1 13:24 defaulter-gen
-rwxr-xr-x 1 root root  3559199 Nov  1 13:24 go2make
-rwxr-xr-x 1 root root  1970176 Nov  1 13:24 go-bindata
-rwxr-xr-x 1 root root 44888064 Nov  1 13:26 kubeadm
-rwxr-xr-x 1 root root  9662464 Nov  1 13:24 openapi-gen
-rwxr-xr-x 1 root root  5660672 Nov  1 13:24 prerelease-lifecycle-gen

二、替换kubeadm、更新证书

1、备份

# 备份原来的kubeadm和证书文件
]# mv /usr/bin/kubeadm /usr/bin/kubeadm-original.bak

# 不能通过mv备份
]# cp -r /etc/kubernetes/pki /etc/kubernetes/pki-20231101-bak

2、更新kubeadm

]# cp -f _output/bin/kubeadm  /usr/bin/kubeadm

# 根据 BuildDate 验证版本是否是新编译版本
]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.8", GitCommit:"4a3b558c52eb6995b3c5c1db5e54111bd0645a64", GitTreeState:"archive", BuildDate:"2023-11-01T05:25:37Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/amd64"}

3、更新证书

]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

旧版本使用：kubeadm alpha certs renew all

4、更新kubeconfig

# 可使用新证书生成新的kubeconfig文件
[root@master ~]# kubeadm init phase kubeconfig all

I1101 14:30:31.313451 1645983 version.go:254] remote version is much newer: v1.28.3; falling back to: stable-1.21
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/admin.conf"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/kubelet.conf"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/controller-manager.conf"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/scheduler.conf"

5、替换 cofig 文件

# 替换文件
[root@master ~]# cp -f /etc/kubernetes/admin.conf ~/.kube/config

# 重启服务器，一般要重启下服务器，不然有的部署不能使用

# 查看节点
[root@master ~]# kubectl get node
NAME   STATUS   ROLES                  AGE    VERSION
master   Ready    control-plane,master   420d   v1.21.8

6、查看新证书

[root@master kubernetes-1.21.8]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Oct 08, 2123 06:29 UTC   99y             ca                      no      
apiserver                  Oct 08, 2123 06:29 UTC   99y             ca                      no      
apiserver-etcd-client      Oct 08, 2123 06:29 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Oct 08, 2123 06:29 UTC   99y             ca                      no      
controller-manager.conf    Oct 08, 2123 06:29 UTC   99y             ca                      no      
etcd-healthcheck-client    Oct 08, 2123 06:29 UTC   99y             etcd-ca                 no      
etcd-peer                  Oct 08, 2123 06:29 UTC   99y             etcd-ca                 no      
etcd-server                Oct 08, 2123 06:29 UTC   99y             etcd-ca                 no      
front-proxy-client         Oct 08, 2123 06:29 UTC   99y             front-proxy-ca          no      
scheduler.conf             Oct 08, 2123 06:29 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      May 22, 2033 02:23 UTC   9y              no      
etcd-ca                 May 22, 2033 02:23 UTC   9y              no      
front-proxy-ca          May 22, 2033 02:23 UTC   9y              no      
[root@master kubernetes-1.21.8]#