（1）、檢視當前的證書時間

# kubeadm alpha certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 22, 2021 14:59 UTC   360d                                    no      
apiserver                  Jul 22, 2021 14:59 UTC   360d            ca                      no      
apiserver-etcd-client      Jul 22, 2021 14:59 UTC   360d            etcd-ca                 no      
apiserver-kubelet-client   Jul 22, 2021 14:59 UTC   360d            ca                      no      
controller-manager.conf    Jul 22, 2021 14:59 UTC   360d                                    no      
etcd-healthcheck-client    Jul 22, 2021 14:59 UTC   360d            etcd-ca                 no      
etcd-peer                  Jul 22, 2021 14:59 UTC   360d            etcd-ca                 no      
etcd-server                Jul 22, 2021 14:59 UTC   360d            etcd-ca                 no      
front-proxy-client         Jul 22, 2021 14:59 UTC   360d            front-proxy-ca          no      
scheduler.conf             Jul 22, 2021 14:59 UTC   360d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 20, 2030 14:59 UTC   9y              no      
etcd-ca                 Jul 20, 2030 14:59 UTC   9y              no      
front-proxy-ca          Jul 20, 2030 14:59 UTC   9y              no      

（2）、下載原始碼

git clone https://github.com/kubernetes/kubernetes.git

（3）、切換到自己的版本，修改原始碼，比如我的是v1.17.2版本

cd kubernetes
git checkout v1.17.2

vim cmd/kubeadm/app/constants/constants.go，找到CertificateValidity，修改如下

....
const (
        // KubernetesDir is the directory Kubernetes owns for storing various configuration files
        KubernetesDir = "/etc/kubernetes"
        // ManifestsSubDirName defines directory name to store manifests
        ManifestsSubDirName = "manifests"
        // TempDirForKubeadm defines temporary directory for kubeadm
        // should be joined with KubernetesDir.
        TempDirForKubeadm = "tmp"

        // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
        CertificateValidity = time.Hour * 24 * 365 * 100
....

（4）、編譯kubeadm

make WHAT=cmd/kubeadm

編譯完生成如下目錄和二進位制檔案

# ll _output/bin/
total 76172
-rwxr-xr-x 1 root root  6799360 Jun 20 21:08 conversion-gen
-rwxr-xr-x 1 root root  6778880 Jun 20 21:08 deepcopy-gen
-rwxr-xr-x 1 root root  6750208 Jun 20 21:08 defaulter-gen
-rwxr-xr-x 1 root root  4883629 Jun 20 21:08 go2make
-rwxr-xr-x 1 root root  2109440 Jun 20 21:09 go-bindata
-rwxr-xr-x 1 root root 39256064 Jun 20 21:11 kubeadm
-rwxr-xr-x 1 root root 11419648 Jun 20 21:09 openapi-gen

（5）、備份原kubeadm和證書檔案

cp /usr/bin/kubeadm{,.bak20200620}
cp -r /etc/kubernetes/pki{,.bak20200620}

（6）、將新生成的kubeadm進行替換

cp _output/bin/kubeadm /usr/bin/kubeadm

（7）、生成新的證書

cd /etc/kubernetes/pki
kubeadm alpha certs renew all

輸出如下

[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

（8）、驗證結果

kubeadm alpha certs check-expiration

CERTIFICATEEXPIRESRESIDUALTIMECERTIFICATEAUTHORITYEXTERNALLYMANAGED
admin.confMay27,212013:25UTC99yno
apiserverMay27,212013:25UTC99ycano
apiserver-etcd-clientMay27,212013:25UTC99yetcd-cano
apiserver-kubelet-clientMay27,212013:25UTC99ycano
controller-manager.confMay27,212013:25UTC99yno
etcd-healthcheck-clientMay27,212013:25UTC99yetcd-cano
etcd-peerMay27,212013:25UTC99yetcd-cano
etcd-serverMay27,212013:25UTC99yetcd-cano
front-proxy-clientMay27,212013:25UTC99yfront-proxy-cano
scheduler.confMay27,212013:25UTC99yno

CERTIFICATEAUTHORITYEXPIRESRESIDUALTIMEEXTERNALLYMANAGED
caJun18,203011:21UTC9yno
etcd-caJun18,203011:21UTC9yno
front-proxy-caJun18,203011:21UTC9yno 

如果github上下載很慢的話可以到gitee上下載，地址：https://gitee.com/mirrors/Kubernetes/tree/master/