[check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Aug 06, 2022 19:03 UTC 344d no apiserver Aug 06, 2022 19:03 UTC 344d ca no apiserver-etcd-client Aug 06, 2022 19:03 UTC 344d etcd-ca no apiserver-kubelet-client Aug 06, 2022 19:03 UTC 344d ca no controller-manager.conf Aug 06, 2022 19:03 UTC 344d no etcd-healthcheck-client Aug 06, 2022 19:03 UTC 344d etcd-ca no etcd-peer Aug 06, 2022 19:03 UTC 344d etcd-ca no etcd-server Aug 06, 2022 19:03 UTC 344d etcd-ca no front-proxy-client Aug 06, 2022 19:03 UTC 344d front-proxy-ca no scheduler.conf Aug 06, 2022 19:03 UTC 344d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Aug 04, 2031 19:03 UTC 9y no etcd-ca Aug 04, 2031 19:03 UTC 9y no front-proxy-ca Aug 04, 2031 19:03 UTC 9y no
API Server的Authentication环节支持多种身份校验方式：Client Cert、Bearer Token、Static Password Auth等，这些方式中只要有一种方式通过Authentication（Kubernetes API Server会逐个方式尝试），那么身份校验就会通过。
Available Commands: admin.conf Renew the certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself all Renew all available certificates apiserver Renew the certificate for serving the Kubernetes API apiserver-etcd-client Renew the certificate the apiserver uses to access etcd apiserver-kubelet-client Renew the certificate for the API server to connect to kubelet controller-manager.conf Renew the certificate embedded in the kubeconfig file for the controller manager to use etcd-healthcheck-client Renew the certificate for liveness probes to healthcheck etcd etcd-peer Renew the certificate for etcd nodes to communicate with each other etcd-server Renew the certificate for serving etcd front-proxy-client Renew the certificate for the front proxy client scheduler.conf Renew the certificate embedded in the kubeconfig file for the scheduler manager to use
Flags: -h, --helphelpfor renew
Global Flags: --add-dir-header If true, adds the file directory to the header of the log messages --log-file string If non-empty, use this log file --log-file-max-size uint Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) --one-output If true, only write logs to their native severity level (vs also writing to each lower severity level --rootfs string [EXPERIMENTAL] The path to the 'real' host root filesystem. --skip-headers If true, avoid header prefixes in the log messages --skip-log-headers If true, avoid headers when opening log files -v, --v Level number for the log level verbosity
Use "kubeadm certs renew [command] --help"for more information about a command.
说明 由HELP可知，证书更新可针对单个证书更新。
执行如下命令更新所有证书
说明 如果你运行了一个HA集群，这个命令需要在所有Master节点上执行。
1
kubeadm certs renew all
出现类似以下输出说明证书更新完成，并且最后一行Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.提示要求要重启kube-apiserver、kube-controller-manager、kube-scheduler和etcd使其使用新证书。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
[renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
# kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Aug 29, 2022 04:20 UTC 364d no apiserver Aug 29, 2022 04:20 UTC 364d ca no apiserver-etcd-client Aug 29, 2022 04:20 UTC 364d etcd-ca no apiserver-kubelet-client Aug 29, 2022 04:20 UTC 364d ca no controller-manager.conf Aug 29, 2022 04:20 UTC 364d no etcd-healthcheck-client Aug 29, 2022 04:20 UTC 364d etcd-ca no etcd-peer Aug 29, 2022 04:20 UTC 364d etcd-ca no etcd-server Aug 29, 2022 04:20 UTC 364d etcd-ca no front-proxy-client Aug 29, 2022 04:20 UTC 364d front-proxy-ca no scheduler.conf Aug 29, 2022 04:20 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Aug 04, 2031 19:03 UTC 9y no etcd-ca Aug 04, 2031 19:03 UTC 9y no front-proxy-ca Aug 04, 2031 19:03 UTC 9y no
vim /root/kubernetes/cmd/kubeadm/app/constants/constants.go
修改CertificateValidity的值为100年
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
... const ( // KubernetesDir is the directory Kubernetes owns for storing various configuration files KubernetesDir = "/etc/kubernetes" // ManifestsSubDirName defines directory name to store manifests ManifestsSubDirName = "manifests" // TempDirForKubeadm defines temporary directory for kubeadm // should be joined with KubernetesDir. TempDirForKubeadm = "tmp"
// CertificateValidity defines the validity for all the signed certificates generated by kubeadm // 修改time.Hour * 24 * 365为time.Hour * 24 * 365 * 100 CertificateValidity = time.Hour * 24 * 365 * 100
// CACertAndKeyBaseName defines certificate authority base name CACertAndKeyBaseName = "ca" ...
cd /root/kubernetes make clean KUBE_BUILD_PLATFORMS=linux/amd64 KUBE_GIT_VERSION=v1.20.0 ./build/run.sh make all WHAT=cmd/kubeadm GOFLAGS=-v GOGCFLAGS="-N -l"
cp -a /etc/kubernetes/ /etc/kubernetes-`date +%Y%m%d` kubectl get cm kubeadm-config -n kube-system -o yaml > /root/kubeadm-config.yaml
更新证书
执行如下命令更新所有证书
说明 如果你运行了一个HA集群，这个命令需要在所有Master节点上执行。
1
kubeadm certs renew all
出现类似以下输出说明证书更新完成，并且最后一行Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.提示要求要重启kube-apiserver、kube-controller-manager、kube-scheduler和etcd使其使用新证书。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
[renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
# kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Aug 05, 2121 04:15 UTC 99y no apiserver Aug 05, 2121 04:15 UTC 99y ca no apiserver-etcd-client Aug 05, 2121 04:15 UTC 99y etcd-ca no apiserver-kubelet-client Aug 05, 2121 04:15 UTC 99y ca no controller-manager.conf Aug 05, 2121 04:15 UTC 99y no etcd-healthcheck-client Aug 05, 2121 04:15 UTC 99y etcd-ca no etcd-peer Aug 05, 2121 04:15 UTC 99y etcd-ca no etcd-server Aug 05, 2121 04:15 UTC 99y etcd-ca no front-proxy-client Aug 05, 2121 04:15 UTC 99y front-proxy-ca no scheduler.conf Aug 05, 2121 04:15 UTC 99y no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Aug 04, 2031 19:03 UTC 9y no etcd-ca Aug 04, 2031 19:03 UTC 9y no front-proxy-ca Aug 04, 2031 19:03 UTC 9y no