Kubeadm 證書過期處理

以下內容參考瞭如下連結：https://www.cnblogs.com/skymyyang/p/11093686.html

一、處理證書已過期的叢集

使用 kubeadm 搭建的叢集，預設證書有效期是 1 年。如果沒有在證書過期前續期，那麼叢集會無法執行，使用的過程中會報如下錯誤：

x509: certificate has expired or is not yet valid.

檢視當前 kubeadm 搭建的叢集證書有效期資訊，命令如下：

[@master74-53 ~]#  for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done
/etc/kubernetes/pki/apiserver.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 23 03:10:01 2020 GMT
-----------
/etc/kubernetes/pki/apiserver-etcd-client.crt
            Not Before: Oct 24 03:10:03 2019 GMT
            Not After : Oct 23 03:10:04 2020 GMT
-----------
/etc/kubernetes/pki/apiserver-kubelet-client.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 23 03:10:02 2020 GMT
-----------
/etc/kubernetes/pki/ca.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 21 03:10:01 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-ca.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 21 03:10:02 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-client.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 23 03:10:03 2020 GMT
-----------
 

可以看到證書的有效期是截止到 2020 年 10 月份，在證書過期後，使用如下步驟進行處理。

1. 針對 kubeadm 1.13.x 及以上版本

首先在伺服器上建立一個 kubeadm.yaml 的檔案，內容如下：

apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.16.2 				# 這裡修改成叢集對應的版本
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers 
#這裡使用國內的映象倉庫，否則在重新簽發的時候會報錯：could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt"
 

將 /etc/kubernetes/pki 中的證書檔案進行備份，然後使用如下命令重新生成證書：

[@master74-53 /opt]# kubeadm alpha certs renew all --config=/opt/kubeadm.yaml
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
 

執行命令後後重新生成如下證書檔案：

#-- /etc/kubernetes/pki/apiserver.key
#-- /etc/kubernetes/pki/apiserver.crt

#-- /etc/kubernetes/pki/apiserver-etcd-client.key
#-- /etc/kubernetes/pki/apiserver-etcd-client.crt

#-- /etc/kubernetes/pki/apiserver-kubelet-client.key
#-- /etc/kubernetes/pki/apiserver-kubelet-client.crt

#-- /etc/kubernetes/pki/front-proxy-client.key
#-- /etc/kubernetes/pki/front-proxy-client.crt

#-- /etc/kubernetes/pki/etcd/healthcheck-client.key
#-- /etc/kubernetes/pki/etcd/healthcheck-client.crt

#-- /etc/kubernetes/pki/etcd/peer.key
#-- /etc/kubernetes/pki/etcd/peer.crt

#-- /etc/kubernetes/pki/etcd/server.key
#-- /etc/kubernetes/pki/etcd/server.crt

檢視新生成的證書有效期：

[@master74-53 /opt]#  for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done
/etc/kubernetes/pki/apiserver.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 26 06:41:43 2021 GMT
-----------
/etc/kubernetes/pki/apiserver-etcd-client.crt
            Not Before: Oct 24 03:10:03 2019 GMT
            Not After : Oct 26 06:41:44 2021 GMT
-----------
/etc/kubernetes/pki/apiserver-kubelet-client.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 26 06:41:44 2021 GMT
-----------
/etc/kubernetes/pki/ca.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 21 03:10:01 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-ca.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 21 03:10:02 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-client.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 26 06:41:46 2021 GMT
-----------

使用如下命令重新生成 kubeconfig 檔案，否則 kubectl 將無法使用：

kubeadm init phase kubeconfig all

然後將新生成的檔案拷貝到 ${HOME}/.kube 目錄下並重命名為 config：

cp -pr /etc/kubernetes/admin.conf /root/.kube/config

重啟 apiserver、kube-controller、kube-scheduler、etcd 容器即可。