Kubernetes 证书有效期更改

最新推荐文章于 2025-05-06 17:15:39 发布

运维生涯记录

最新推荐文章于 2025-05-06 17:15:39 发布

阅读量598

点赞数

CC 4.0 BY-SA版权

分类专栏： Kubernetes 文章标签： kubernetes 容器云原生

本文链接：https://blog.youkuaiyun.com/qq_43164571/article/details/125655314

Kubernetes 专栏收录该内容

42 篇文章

订阅专栏

Kubernetes相关证书详细介绍：https://www.cnblogs.com/kuku0223/p/11867391.html

在更新证书之前先查看一下当前证书的过期时间

[root@k8s-master01 ~]# kubeadm alpha certs check-expiration
CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 07, 2023 02:22 UTC   364d                                    no      
apiserver                  Jul 07, 2023 02:22 UTC   364d            ca                      no      
apiserver-etcd-client      Jul 07, 2023 02:22 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Jul 07, 2023 02:22 UTC   364d            ca                      no      
controller-manager.conf    Jul 07, 2023 02:22 UTC   364d                                    no      
etcd-healthcheck-client    Jun 28, 2023 01:09 UTC   355d            etcd-ca                 no      
etcd-peer                  Jun 28, 2023 01:09 UTC   355d            etcd-ca                 no      
etcd-server                Jun 28, 2023 01:09 UTC   355d            etcd-ca                 no      
front-proxy-client         Jul 07, 2023 02:22 UTC   364d            front-proxy-ca          no      
scheduler.conf             Jul 07, 2023 02:22 UTC   364d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Apr 25, 2032 06:55 UTC   9y              no      
etcd-ca                 Apr 25, 2032 06:55 UTC   9y              no      
front-proxy-ca          Apr 25, 2032 06:55 UTC   9y              no

Go环境部署：https://studygolang.com/dl/

[root@k8s-master01 ~]# wget https://studygolang.com/dl/golang/go1.18.3.linux-amd64.tar.gz
[root@k8s-master01 ~]# tar -zxvf go1.18.3.linux-amd64.tar.gz -C /usr/local
[root@k8s-master01 ~]# vim /etc/profile
添加：
    export PATH=$PATH:/usr/local/go/bin
[root@k8s-master01 ~]# source /etc/profile

下载Kubernetes源码

[root@k8s-master01 ~]# cd /home && git clone https://github.com/kubernetes/kubernetes.git
[root@k8s-master01 ~]# git clone -b v1.18.5 --depth=1 https://github.com/kubernetes/kubernetes.git	#  下载执行版本
[root@k8s-master01 /home]# git checkout -b remotes/origin/release-1.18.5 v1.18.5	# 切换当前Kubernetes 版本

修改 Kubeadm 源码包更新证书策略

#证书的有效期是需要修改两个文件constants.go和cert.go
[root@k8s-master01 /home]# cd kubernetes
[root@localhost /home/kubernetes]# vim ./cmd/kubeadm/app/constants/constants.go
vim 下查找 CertificateValidity 字段
 39 const (
 40         // KubernetesDir is the directory Kubernetes owns for storing various configuration files
 41         KubernetesDir = "/etc/kubernetes"
 42         // ManifestsSubDirName defines directory name to store manifests
 43         ManifestsSubDirName = "manifests"
 44         // TempDirForKubeadm defines temporary directory for kubeadm
 45         // should be joined with KubernetesDir.
 46         TempDirForKubeadm = "tmp"
 47 
 48         // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
 49         CertificateValidity = time.Hour * 24 * 365 * 100 // 默认是1年，改为100年
 50 
 51         // CACertAndKeyBaseName defines certificate authority base name
 52         CACertAndKeyBaseName = "ca"
 53         // CACertName defines certificate name
 54         CACertName = "ca.crt"
 55         // CAKeyName defines certificate name
 56         CAKeyName = "ca.key"
 57 
 58         // APIServerCertAndKeyBaseName defines API's server certificate and key base name
 59         APIServerCertAndKeyBaseName = "apiserver"
 60         // APIServerCertName defines API's server certificate name
 61         APIServerCertName = "apiserver.crt"

修改cert.go文件

[root@localhost /home/kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go
 56 // NewSelfSignedCACert creates a CA certificate
 57 func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
 58         now := time.Now()
 59         tmpl := x509.Certificate{
 60                 SerialNumber: new(big.Int).SetInt64(0),
 61                 Subject: pkix.Name{
 62                         CommonName:   cfg.CommonName,
 63                         Organization: cfg.Organization,
 64                 },
 65                 NotBefore:             now.UTC(),
 66                 NotAfter:              now.Add(duration365d * 100).UTC(), // 默认是1年，改为100年
 67                 KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCe    rtSign,
 68                 BasicConstraintsValid: true,
 69                 IsCA:                  true,
 70         }
 71 
 72         certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key)
 73         if err != nil {
 74                 return nil, err
 75         }
 76         return x509.ParseCertificate(certDERBytes)
 77 }

编译源代码文件

[root@k8s-master01 /home/kubernetes]# make WHAT=cmd/kubeadm GOFLAGS=-v
[root@k8s-master01 /home/kubernetes]# cp _output/bin/kubeadm ~/kubeadm

更新 kubeadm

# 将 kubeadm 进行替换
[root@k8s-master01 /home/kubernetes]# cp /usr/bin/kubeadm /usr/bin/kubeadm.old
[root@k8s-master01 /home/kubernetes]# cp /root/kubeadm-new /usr/bin/kubeadm
[root@k8s-master01 /home/kubernetes]# chmod a+x /usr/bin/kubeadm

更新各节点证书至 Master 节点

[root@k8s-master01 /home/kubernetes]# cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old
[root@k8s-master01 /home/kubernetes]# cd /etc/kubernetes/pki
[root@k8s-master01 pki]# kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml

HA集群其余 mater 节点证书更新

#!/bin/bash
masterNode="192.168.66.20 192.168.66.21"
# for host in ${masterNode}; do
#    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}"${USER}"@$host:/etc/kubernetes/pki/
#    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd
#    scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/
#done
for host in${CONTROL_PLANE_IPS}; do
    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}"${USER}"@$host:/root/pki/
    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd
    scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/
done

再次再看证书过期时间

[root@k8s-master01 ~]# kubeadm alpha certs check-expiration
CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jun 13, 2122 03:11 UTC   99y                                     no      
apiserver                  Jun 13, 2122 03:11 UTC   99y             ca                      no      
apiserver-etcd-client      Jun 13, 2122 03:11 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Jun 13, 2122 03:11 UTC   99y             ca                      no      
controller-manager.conf    Jun 13, 2122 03:11 UTC   99y                                     no      
etcd-healthcheck-client    Jun 13, 2122 03:11 UTC   99y             etcd-ca                 no      
etcd-peer                  Jun 13, 2122 03:11 UTC   99y             etcd-ca                 no      
etcd-server                Jun 13, 2122 03:11 UTC   99y             etcd-ca                 no      
front-proxy-client         Jun 13, 2122 03:11 UTC   99y             front-proxy-ca          no      
scheduler.conf             Jun 13, 2122 03:11 UTC   99y                                     no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Apr 25, 2032 06:55 UTC   9y              no      
etcd-ca                 Apr 25, 2032 06:55 UTC   9y              no      
front-proxy-ca          Apr 25, 2032 06:55 UTC   9y              no