kubeadm初始化k8s-延長證書過期時間

一、檢視證書過期時間

# ca證書有效期是10年，從2021到2031年
[root@k8s-master1 ~]# openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -text  |grep Not
            Not Before: Jul  8 02:55:00 2021 GMT
            Not After : Jul  6 02:55:00 2031 GMT

# apiserver證書有效期是1年，從2021到2022年
[root@k8s-master1 ~]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text  |grep Not
            Not Before: Jul  8 02:55:00 2021 GMT
            Not After : Jul  8 02:55:00 2022 GMT
 

二、延長證書過期時間

1）把update-kubeadm-cert.sh檔案上傳到k8s-master1、k8s-master2節點

指令碼下載地址：https://github.com/yuyicai/update-kube-cert

2）在每個節點都執行如下命令

# 1）給update-kubeadm-cert.sh證書授權可執行許可權
[root@k8s-master1 ~]# chmod +x update-kubeadm-cert.sh
[root@k8s-master2 ~]# chmod +x update-kubeadm-cert.sh

# 2）執行下面命令，修改證書過期時間，把時間延長到10年
[root@k8s-master1 ~]# ./update-kubeadm-cert.sh all
[root@k8s-master2 ~]# ./update-kubeadm-cert.sh all
[2021-07-08T11:45:19.707677552+0800]: INFO: backup /etc/kubernetes to /etc/kubernetes.old-20210708
Signature ok
subject=/CN=etcd-server
Getting CA Private Key
[2021-07-08T11:45:19.772840987+0800]: INFO: generated /etc/kubernetes/pki/etcd/server.crt
Signature ok
subject=/CN=etcd-peer
Getting CA Private Key
[2021-07-08T11:45:19.809399855+0800]: INFO: generated /etc/kubernetes/pki/etcd/peer.crt
Signature ok
subject=/O=system:masters/CN=kube-etcd-healthcheck-client
Getting CA Private Key
[2021-07-08T11:45:19.831445526+0800]: INFO: generated /etc/kubernetes/pki/etcd/healthcheck-client.crt
Signature ok
subject=/O=system:masters/CN=kube-apiserver-etcd-client
Getting CA Private Key
[2021-07-08T11:45:19.853244272+0800]: INFO: generated /etc/kubernetes/pki/apiserver-etcd-client.crt
2e55581300ad
[2021-07-08T11:45:20.247350515+0800]: INFO: restarted etcd
Signature ok
subject=/CN=kube-apiserver
Getting CA Private Key
[2021-07-08T11:45:20.282054309+0800]: INFO: generated /etc/kubernetes/pki/apiserver.crt
Signature ok
subject=/O=system:masters/CN=kube-apiserver-kubelet-client
Getting CA Private Key
[2021-07-08T11:45:20.307074813+0800]: INFO: generated /etc/kubernetes/pki/apiserver-kubelet-client.crt
Signature ok
subject=/CN=system:kube-controller-manager
Getting CA Private Key
[2021-07-08T11:45:20.349848678+0800]: INFO: generated /etc/kubernetes/controller-manager.crt
[2021-07-08T11:45:20.355202936+0800]: INFO: generated new /etc/kubernetes/controller-manager.conf
Signature ok
subject=/CN=system:kube-scheduler
Getting CA Private Key
[2021-07-08T11:45:20.401409577+0800]: INFO: generated /etc/kubernetes/scheduler.crt
[2021-07-08T11:45:20.407255673+0800]: INFO: generated new /etc/kubernetes/scheduler.conf
Signature ok
subject=/O=system:masters/CN=kubernetes-admin
Getting CA Private Key
[2021-07-08T11:45:20.453035542+0800]: INFO: generated /etc/kubernetes/admin.crt
[2021-07-08T11:45:20.463892109+0800]: INFO: generated new /etc/kubernetes/admin.conf
[2021-07-08T11:45:20.470917866+0800]: INFO: copy the admin.conf to ~/.kube/config for kubectl
[2021-07-08T11:45:20.473552470+0800]: WARNING: does not need to update kubelet.conf
Signature ok
subject=/CN=front-proxy-client
Getting CA Private Key
[2021-07-08T11:45:20.494001710+0800]: INFO: generated /etc/kubernetes/pki/front-proxy-client.crt
86a98ff73131
[2021-07-08T11:45:24.268973792+0800]: INFO: restarted kube-apiserver
7c01cab842fa
[2021-07-08T11:45:24.812039934+0800]: INFO: restarted kube-controller-manager
59ed847ae4eb
[2021-07-08T11:45:25.765110177+0800]: INFO: restarted kube-scheduler
[2021-07-08T11:45:25.875676379+0800]: INFO: restarted kubelet

# 3）在k8s-master1節點查詢Pod是否正常,能查詢出資料說明證書籤發完成
[root@k8s-master1 ~]# kubectl  get pods 
NAME       READY   STATUS    RESTARTS   AGE
demo-pod   1/1     Running   0          15m
 

3）檢視證書的有效期

# 檢視apiserver證書
[root@k8s-master1 ~]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text  |grep Not
            Not Before: Jul  8 03:45:17 2021 GMT
            Not After : Jul  6 03:45:17 2031 GMT

# 檢視etcd證書
[root@k8s-master1 ~]# openssl x509 -in /etc/kubernetes/pki/apiserver-etcd-client.crt  -noout -text  |grep Not
            Not Before: Jul  8 03:45:16 2021 GMT
            Not After : Jul  6 03:45:16 2031 GMT
            
# 檢視fron-proxy證書
[root@k8s-master1 ~]# openssl x509 -in /etc/kubernetes/pki/front-proxy-ca.crt  -noout -text  |grep Not
            Not Before: Jul  8 02:55:00 2021 GMT
            Not After : Jul  6 02:55:00 2031 GMT
 

-------------------------------------------

個性簽名：獨學而無友，則孤陋而寡聞。做一個靈魂有趣的人！