• k8s集群安装学习笔记九——证书有效期修改


    证书有效期修改

    证书可用时限

    查看证书信息

    openssl x509 -in aprserver.crt -text -noout

    1、go 环境部署
    wget https://dl.google.com/go/go1.12.7.linux-amd64.tar.gz 
    tar -zxvf go1.12.1.linux-amd64.tar.gz -C /usr/local 
    vim /etc/profile 
      export PATH=$PATH:/usr/local/go/bin 
    source /etc/profile
    2、下载源码
    cd /data && git clone https://github.com/kubernetes/kubernetes.git 
    查看版本

     切换版本

    git checkout -b remotes/origin/release-1.15.1 v1.15.1
    3、修改 Kubeadm 源码包更新证书策略
    vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14 版本之前 
    vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今 
        const duration365d = time.Hour * 24 * 365  #定义一个变量
        NotAfter: time.Now().Add(duration365d).UTC(), 
    
    make WHAT=cmd/kubeadm GOFLAGS=-v  #只编译kubeadm
    cp _output/bin/kubeadm /root/kubeadm-new
    4、更新 kubeadm
    # 将 kubeadm 进行替换 
    cp /usr/bin/kubeadm /usr/bin/kubeadm.old #备份
    cp /root/kubeadm-new /usr/bin/kubeadm  #替换
    chmod a+x /usr/bin/kubeadm
    5、更新各节点证书至 Master 节点
    cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old 
    cd /etc/kubernetes/pki 
    kubeadm alpha certs renew all --config=/usr/local/install-k8s/core/kubeadm-config.yaml 
    #查看新证书信息 openssl x509
    -in apiserver.crt -text -noout | grep Not
     
    6、HA集群其余 mater 节点证书更新
    #!/bin/bash 
    masterNode="192.168.66.20 192.168.66.21" 
    #for host in ${masterNode}; do 
    # scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} "${USER}"@$host:/etc/kubernetes/pki/ 
    # scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd 
    # scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/ 
    #done 
    for host in ${CONTROL_PLANE_IPS}; do 
        scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} 
    "${USER}"@$host:/root/pki/ 
        scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd 
        scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/ 
    done
    好记性不如烂笔头,最难不过坚持
  • 相关阅读:
    filter&map&reduce
    Linux通过进程ID查看文件路径
    PyCharm使用最多也最常用默认快捷键介绍
    Python中的深浅拷贝
    类加载器&反射
    Java web.xml 配置详解
    SpringMVC + Spring + MyBatis 整合 + Spring shrio + easyUI + 权限管理框架,带shrio session和shrio cache集群实现方案
    JAVA大数据数组排序
    高访问量WEB开发中的架构模式,学习从点滴开始
    WEB项目会话集群的三种办法
  • 原文地址:https://www.cnblogs.com/dannylinux/p/15421599.html
Copyright © 2020-2023  润新知