kubeadm1.17安装的K8S集群证书续期

kubeadm 默认证书为一年，一年过期后，会导致api service不可用，使用过程中会出现：x509: certificate has expired or is not yet valid.

证书默认存放目录：/etc/kubernetes/pki

1，查询当前证书过期时间

kubeadm alpha certs check-expiration

 

也可以直接查看证书
for i in `ll /etc/kubernetes/pki | grep crt | awk '{print $9}'`;do echo $i && openssl x509 -in $i -noout -text |grep Not;done

 

 

2，备份

cp -R /etc/kubernetes/pki /etc/kubernetes/pki_bakup

 

3，生成集群当前配置文件

#kubeadm alpha phase kubeconfig all --config cluster.yaml  （后面用这个文件来续期证书）

apiServer:
extraArgs:
authorization-mode: Node,RBAC
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controlPlaneEndpoint: apiserver.shiji:6443
controllerManager: {}
dns:
type: CoreDNS
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.17.0
networking:
dnsDomain: cluster.local
podSubnet: 10.100.0.1/16
serviceSubnet: 10.96.0.0/16
scheduler: {}

 

4，续期证书

kubeadm alpha certs renew all --config=/root/cluster.yaml
也可以单个更新

 

5，再次查看证书有效期

 

 参考文档

https://www.cnblogs.com/skymyyang/p/11093686.html
https://www.cnblogs.com/dolphintwo/p/11388644.html