Kubernetes相关证书详细介绍:https://www.cnblogs.com/kuku0223/p/11867391.html
在更新证书之前先查看一下当前证书的过期时间
[root@k8s-master01 ~]# kubeadm alpha certs check-expiration
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Jul 07, 2023 02:22 UTC 364d no
apiserver Jul 07, 2023 02:22 UTC 364d ca no
apiserver-etcd-client Jul 07, 2023 02:22 UTC 364d etcd-ca no
apiserver-kubelet-client Jul 07, 2023 02:22 UTC 364d ca no
controller-manager.conf Jul 07, 2023 02:22 UTC 364d no
etcd-healthcheck-client Jun 28, 2023 01:09 UTC 355d etcd-ca no
etcd-peer Jun 28, 2023 01:09 UTC 355d etcd-ca no
etcd-server Jun 28, 2023 01:09 UTC 355d etcd-ca no
front-proxy-client Jul 07, 2023 02:22 UTC 364d front-proxy-ca no
scheduler.conf Jul 07, 2023 02:22 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Apr 25, 2032 06:55 UTC 9y no
etcd-ca Apr 25, 2032 06:55 UTC 9y no
front-proxy-ca Apr 25, 2032 06:55 UTC 9y no
Go环境部署:https://studygolang.com/dl/
[root@k8s-master01 ~]# wget https://studygolang.com/dl/golang/go1.18.3.linux-amd64.tar.gz
[root@k8s-master01 ~]# tar -zxvf go1.18.3.linux-amd64.tar.gz -C /usr/local
[root@k8s-master01 ~]# vim /etc/profile
添加:
export PATH=$PATH:/usr/local/go/bin
[root@k8s-master01 ~]# source /etc/profile
下载Kubernetes源码
[root@k8s-master01 ~]# cd /home && git clone https://github.com/kubernetes/kubernetes.git
[root@k8s-master01 ~]# git clone -b v1.18.5 --depth=1 https://github.com/kubernetes/kubernetes.git # 下载执行版本
[root@k8s-master01 /home]# git checkout -b remotes/origin/release-1.18.5 v1.18.5 # 切换当前Kubernetes 版本
修改 Kubeadm 源码包更新证书策略
#证书的有效期是需要修改两个文件constants.go和cert.go
[root@k8s-master01 /home]# cd kubernetes
[root@localhost /home/kubernetes]# vim ./cmd/kubeadm/app/constants/constants.go
vim 下查找 CertificateValidity 字段
39 const (
40 // KubernetesDir is the directory Kubernetes owns for storing various configuration files
41 KubernetesDir = "/etc/kubernetes"
42 // ManifestsSubDirName defines directory name to store manifests
43 ManifestsSubDirName = "manifests"
44 // TempDirForKubeadm defines temporary directory for kubeadm
45 // should be joined with KubernetesDir.
46 TempDirForKubeadm = "tmp"
47
48 // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
49 CertificateValidity = time.Hour * 24 * 365 * 100 // 默认是1年,改为100年
50
51 // CACertAndKeyBaseName defines certificate authority base name
52 CACertAndKeyBaseName = "ca"
53 // CACertName defines certificate name
54 CACertName = "ca.crt"
55 // CAKeyName defines certificate name
56 CAKeyName = "ca.key"
57
58 // APIServerCertAndKeyBaseName defines API's server certificate and key base name
59 APIServerCertAndKeyBaseName = "apiserver"
60 // APIServerCertName defines API's server certificate name
61 APIServerCertName = "apiserver.crt"
修改cert.go文件
[root@localhost /home/kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go
56 // NewSelfSignedCACert creates a CA certificate
57 func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
58 now := time.Now()
59 tmpl := x509.Certificate{
60 SerialNumber: new(big.Int).SetInt64(0),
61 Subject: pkix.Name{
62 CommonName: cfg.CommonName,
63 Organization: cfg.Organization,
64 },
65 NotBefore: now.UTC(),
66 NotAfter: now.Add(duration365d * 100).UTC(), // 默认是1年,改为100年
67 KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCe rtSign,
68 BasicConstraintsValid: true,
69 IsCA: true,
70 }
71
72 certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key)
73 if err != nil {
74 return nil, err
75 }
76 return x509.ParseCertificate(certDERBytes)
77 }
编译源代码文件
[root@k8s-master01 /home/kubernetes]# make WHAT=cmd/kubeadm GOFLAGS=-v
[root@k8s-master01 /home/kubernetes]# cp _output/bin/kubeadm ~/kubeadm
更新 kubeadm
# 将 kubeadm 进行替换
[root@k8s-master01 /home/kubernetes]# cp /usr/bin/kubeadm /usr/bin/kubeadm.old
[root@k8s-master01 /home/kubernetes]# cp /root/kubeadm-new /usr/bin/kubeadm
[root@k8s-master01 /home/kubernetes]# chmod a+x /usr/bin/kubeadm
更新各节点证书至 Master 节点
[root@k8s-master01 /home/kubernetes]# cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old
[root@k8s-master01 /home/kubernetes]# cd /etc/kubernetes/pki
[root@k8s-master01 pki]# kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml
HA集群其余 mater 节点证书更新
#!/bin/bash
masterNode="192.168.66.20 192.168.66.21"
# for host in ${masterNode}; do
# scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}"${USER}"@$host:/etc/kubernetes/pki/
# scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd
# scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/
#done
for host in${CONTROL_PLANE_IPS}; do
scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}"${USER}"@$host:/root/pki/
scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd
scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/
done
再次再看证书过期时间
[root@k8s-master01 ~]# kubeadm alpha certs check-expiration
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Jun 13, 2122 03:11 UTC 99y no
apiserver Jun 13, 2122 03:11 UTC 99y ca no
apiserver-etcd-client Jun 13, 2122 03:11 UTC 99y etcd-ca no
apiserver-kubelet-client Jun 13, 2122 03:11 UTC 99y ca no
controller-manager.conf Jun 13, 2122 03:11 UTC 99y no
etcd-healthcheck-client Jun 13, 2122 03:11 UTC 99y etcd-ca no
etcd-peer Jun 13, 2122 03:11 UTC 99y etcd-ca no
etcd-server Jun 13, 2122 03:11 UTC 99y etcd-ca no
front-proxy-client Jun 13, 2122 03:11 UTC 99y front-proxy-ca no
scheduler.conf Jun 13, 2122 03:11 UTC 99y no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Apr 25, 2032 06:55 UTC 9y no
etcd-ca Apr 25, 2032 06:55 UTC 9y no
front-proxy-ca Apr 25, 2032 06:55 UTC 9y no