证书有效期修改
证书可用时限
查看证书信息
openssl x509 -in aprserver.crt -text -noout
1、go 环境部署
wget https://dl.google.com/go/go1.12.7.linux-amd64.tar.gz tar -zxvf go1.12.1.linux-amd64.tar.gz -C /usr/local vim /etc/profile export PATH=$PATH:/usr/local/go/bin source /etc/profile
2、下载源码
cd /data && git clone https://github.com/kubernetes/kubernetes.git
查看版本
切换版本
git checkout -b remotes/origin/release-1.15.1 v1.15.1
3、修改 Kubeadm 源码包更新证书策略
vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14 版本之前 vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今 const duration365d = time.Hour * 24 * 365 #定义一个变量 NotAfter: time.Now().Add(duration365d).UTC(), make WHAT=cmd/kubeadm GOFLAGS=-v #只编译kubeadm cp _output/bin/kubeadm /root/kubeadm-new
4、更新 kubeadm
# 将 kubeadm 进行替换 cp /usr/bin/kubeadm /usr/bin/kubeadm.old #备份 cp /root/kubeadm-new /usr/bin/kubeadm #替换 chmod a+x /usr/bin/kubeadm
5、更新各节点证书至 Master 节点
cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old cd /etc/kubernetes/pki kubeadm alpha certs renew all --config=/usr/local/install-k8s/core/kubeadm-config.yaml
#查看新证书信息 openssl x509 -in apiserver.crt -text -noout | grep Not
6、HA集群其余 mater 节点证书更新
#!/bin/bash masterNode="192.168.66.20 192.168.66.21" #for host in ${masterNode}; do # scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} "${USER}"@$host:/etc/kubernetes/pki/ # scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd # scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/ #done for host in ${CONTROL_PLANE_IPS}; do scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} "${USER}"@$host:/root/pki/ scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/ done