kubernetes實戰(十七)：k8s證書過期處理
阿新 • • 發佈：2019-01-05
1、說明
一般正常安裝k8s叢集，叢集證書的有效期是一年，包括以下證書：
- apiserver
- apiserver-kubelet-client
- apiserver-etcd-client
- front-proxy-client
- etcd/server
- etcd/peer
- etcd/healthcheck-client
2、證書過期問題解決辦法
對於手動生成的證書
手動安裝過程中，只需指定證書的過期時間為N天即可對於kubeadm
方式一：升級K8S叢集，自動更新證書 方式二：修改kubeadm並重新編譯 方式三：重新生成證書
3、過期處理
報錯資訊
[[email protected] ~]# kubectl get po
Unable to connect to the server: x509: certificate has expired or is not yet valid日誌資訊
The currently active client certificate has expired, but the server is not responsive. A restart may be necessary to retrieve new initial credentials.
證書備份
cp -rp /etc/kubernetes /etc/kubernetes.bakapiserver證書
[[email protected] ~]# rm -f /etc/kubernetes/pki/apiserver*front-proxy-client證書
[[email protected] ~]# rm -f /etc/kubernetes/pki/front-proxy-client.*etcd證書
rm -rf /etc/kubernetes/pki/etcd/healthcheck-client.* rm -rf /etc/kubernetes/pki/etcd/server.* rm -rf /etc/kubernetes/pki/etcd/peer.*
重新生成證書
[[email protected] ~]# /opt/kubeadm alpha phase certs all --config kubeadm-config.yaml
[certificates] Generated apiserver-kubelet-client certificate and key.
[certificates] Generated apiserver certificate and key.
[certificates] apiserver serving cert is signed for DNS names [k8s-master02 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local k8s-master01 k8s-master02 k8s-master03 k8s-master-lb] and IPs [10.96.0.1 192.168.20.21 192.168.20.10 192.168.20.20 192.168.20.21 192.168.20.22 192.168.20.10]
[certificates] Generated front-proxy-client certificate and key.
[certificates] Generated etcd/healthcheck-client certificate and key.
[certificates] Generated apiserver-etcd-client certificate and key.
[certificates] Generated etcd/server certificate and key.
[certificates] etcd/server serving cert is signed for DNS names [k8s-master02 localhost k8s-master02] and IPs [127.0.0.1 ::1 192.168.20.21]
[certificates] Generated etcd/peer certificate and key.
[certificates] etcd/peer serving cert is signed for DNS names [k8s-master02 localhost k8s-master02] and IPs [192.168.20.21 127.0.0.1 ::1 192.168.20.21]
[certificates] valid certificates and keys now exist in "/etc/kubernetes/pki"
[certificates] Using the existing sa key.
重新生成配置檔案
[[email protected] ~]# mv /etc/kubernetes/
admin.conf kubelet.conf pki/ scheduler.conf
controller-manager.conf manifests/ pki.bak/ tmp/
[[email protected] ~]# mv /etc/kubernetes/*.conf /tmp/
[[email protected] ~]# /opt/kubeadm alpha phase kubeconfig all --config kubeadm-config.yaml
[endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"重啟kubelet
[[email protected] ~]# systemctl restart kubelet
4、叢集確認
證書過期時間確認
# 注意：cfssl需要自行安裝
[[email protected] ~]# cfssl-certinfo -cert /etc/kubernetes/pki/etcd/server.crt | grep not
"not_before": "2018-11-30T07:45:08Z",
"not_after": "2117-11-16T06:07:00Z",叢集狀態確認
[[email protected] ~]# kubectl get no
NAME STATUS ROLES AGE VERSION
k8s-master01 Ready master 6d22h v1.12.3
k8s-master02 Ready master 6d22h v1.12.3
k8s-master03 Ready master 6d22h v1.12.3
k8s-node01 Ready <none> 6d21h v1.12.3
k8s-node02 Ready <none> 6d21h v1.12.3