k8s证书有效期修改

 

证书可用时限

go 环境部署

 

wget https://dl.google.com/go/go1.12.7.linux-amd64.tar.gz
tar -zxvf go1.12.1.linux-amd64.tar.gz -C /usr/local
vi /etc/profile
export PATH=$PATH:/usr/local/go/bin
source /etc/profile
​

 

 

[root@k8s-master01 ~]# cd /etc/kubernetes/
[root@k8s-master01 kubernetes]# cd /etc/kubernetes/pki/
[root@k8s-master01 pki]# ls
apiserver.crt              apiserver.key                 ca.crt       devuser-key.pem  front-proxy-ca.crt      front-proxy-client.key
apiserver-etcd-client.crt  apiserver-kubelet-client.crt  ca.key       devuser.pem      front-proxy-ca.key      sa.key
apiserver-etcd-client.key  apiserver-kubelet-client.key  devuser.csr  etcd             front-proxy-client.crt  sa.pub

 

 [root@k8s-master01 pki]# openssl x509 -in apiserver.crt -text -noout

 

 

 

[root@k8s-master01 pki]# openssl x509 -in ca.crt -text -noout

 

 

 

去Go语言中文网下载Go源码

Go下载 - Go语言中文网 - Golang中文社区 (studygolang.com)

 

[root@k8s-master01 ~]# mkdir /data
[root@k8s-master01 ~]# cd /data

把Go源码包传输上来

[root@k8s-master01 data]# tar -zxvf go1.18.4.linux-amd64.tar.gz -C /usr/local/^C
[root@k8s-master01 data]# ls /usr/local/go/
api  AUTHORS  bin  codereview.cfg  CONTRIBUTING.md  CONTRIBUTORS  doc  lib  LICENSE  misc  PATENTS  pkg  README.md  SECURITY.md  src  test  VERSION
[root@k8s-master01 data]#

 

[root@k8s-master01 data]# vim /etc/profile

 

 

 

[root@k8s-master01 data]# source /etc/profile
[root@k8s-master01 data]# go version
go version go1.18.4 linux/amd64
[root@k8s-master01 data]#

 

 

 

下载源码

 

cd /data && git clone https://github.com/kubernetes/kubernetes.git
git checkout -b remotes/origin/release-1.15.1 v1.15.1
​

 

[root@k8s-master01 data]#  git clone git://github.com/kubernetes/kubernetes.git

[root@k8s-master01 data]# git config --global url.“https://”.insteadOf git://

 

 

 

修改 Kubeadm 源码包更新证书策略

 

vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14 版本之前
vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今
const duration365d = time.Hour * 24 * 365
NotAfter: time.Now().Add(duration365d).UTC(),
make WHAT=cmd/kubeadm GOFLAGS=-v
cp _output/bin/kubeadm /root/kubeadm-new

 

更新 kubeadm

 

# 将 kubeadm 进行替换
cp /usr/bin/kubeadm /usr/bin/kubeadm.old
cp /root/kubeadm-new /usr/bin/kubeadm
chmod a+x /usr/bin/kubeadm
​

 

更新各节点证书至 Master 节点

 

cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old
cd /etc/kubernetes/pki
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml
openssl x509 -in apiserver.crt -text -noout | grep Not

 

HA集群其余 mater 节点证书更新

 

#!/bin/bash
masterNode="192.168.66.20 192.168.66.21"
#for host in ${masterNode}; do
# scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}
"${USER}"@$host:/etc/kubernetes/pki/
# scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd
# scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/
#done
for host in ${CONTROL_PLANE_IPS}; do
    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}
"${USER}"@$host:/root/pki/
    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd
    scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/
done