1. 百年的kubeadm
1.1 源碼修改
- 源碼下載
cd /usr/local/src/
git clone -b release-1.15 https://github.com/kubernetes/kubernetes.git
- 再次確認(rèn)分支
cd kubernetes
git branch -a
- 修改cert.go
vim ./staging/src/k8s.io/client-go/util/cert/cert.go
NotBefore: now.UTC(),
#修改下邊的10為100
NotAfter: now.Add(duration365d * 10).UTC(),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
BasicConstraintsValid: true,
IsCA:
- 修改constants.go
vim ./cmd/kubeadm/app/constants/constants.go
// CertificateValidity defines the validity for all the signed certificates generated by kubeadm
#將下邊time.Hour * 100
CertificateValidity = time.Hour * 24 * 365
修改后如下：
vim ./cmd/kubeadm/app/constants/constants.go
// CertificateValidity defines the validity for all the signed certificates generated by kubeadm
CertificateValidity = time.Hour * 24 * 365 * 100
1.2 準(zhǔn)備鏡像
docker pull mirrorgooglecontainers/kube-cross:v1.12.10-1
官方提供的編譯鏡像，無論如何弄到服務(wù)器上就行了
1.3 編譯
docker run --rm -it -v /usr/local/src/k8s.io/kubernetes:/go/src/k8s.io/kubernetes \
mirrorgooglecontainers/kube-cross:v1.12.10-1 bash
cd /go/src/k8s.io/kubernetes
make all WHAT=cmd/kubeadm GOFLAGS=-v
exit
1.4 成品備份
-
成品位置
編譯好的成品在： _output/local/bin/linux/amd64/kubeadm -
成品測試
cp _output/local/bin/linux/amd64/kubeadm /usr/bin/
chmod a+x /usr/bin/kubeadm
kubeadm version
- 成本保存
已上傳至ftp服務(wù)器，ftp://10.252.97.213/soft/kubeadm
2. 生成證書
2.1 master主節(jié)點
- 將前邊準(zhǔn)備的kubeadm 拷貝到服務(wù)器
cd /usr/local/src
wget ftp://10.252.97.213/soft/kubeadm
- 替換原來kubeadm文件
cp /usr/bin/kubeadm /usr/bin/kubeadm_back
cp /usr/local/src/kubeadm /usr/bin/kubeadm
chmod 755 /usr/bin/kubeadm
- 備份配置文件和證書
cp -ra /etc/kubernetes /etc/kubernetes_back
- 查看證書到期時間
kubeadm alpha certs check-expiration
- 更新證書和配置文件
kubeadm alpha certs renew all
- 確認(rèn)證書到期時間
[root@AiK8sM2 ~]# kubeadm alpha certs check-expiration
CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
admin.conf Apr 03, 2120 06:46 UTC 99y no
apiserver Apr 03, 2120 09:36 UTC 99y no
apiserver-etcd-client Apr 03, 2120 09:36 UTC 99y no
apiserver-kubelet-client Apr 03, 2120 09:36 UTC 99y no
controller-manager.conf Apr 03, 2120 09:36 UTC 99y no
etcd-healthcheck-client Apr 03, 2120 09:36 UTC 99y no
etcd-peer Apr 03, 2120 09:36 UTC 99y no
etcd-server Apr 03, 2120 09:36 UTC 99y no
front-proxy-client Apr 03, 2120 06:47 UTC 99y no
scheduler.conf Apr 03, 2120 09:36 UTC 99y no
- 重啟docker
說明：主要為了重啟proxy和etcd文章來源：http://www.zghlxwxcb.cn/news/detail-582189.html
service docker restart
- 重啟kubelet
service kubelet restart
2.2 其他master節(jié)點
- 拷貝100年的kubeadmin 文件
- 將前邊準(zhǔn)備的kubeadm 拷貝到服務(wù)器
cd /usr/local/src
wget ftp://10.252.97.213/soft/kubeadm
- 替換原來kubeadm文件
cp /usr/bin/kubeadm /usr/bin/kubeadm_back
cp /usr/local/src/kubeadm /usr/bin/kubeadm
chmod 755 /usr/bin/kubeadm
- 備份配置文件和證書
cp -ra /etc/kubernetes /etc/kubernetes_back
- 查看證書到期時間
kubeadm alpha certs check-expiration
- 更新證書和配置文件
kubeadm alpha certs renew all
- 確認(rèn)證書到期時間
[root@AiK8sM2 ~]# kubeadm alpha certs check-expiration
CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
admin.conf Apr 03, 2120 06:46 UTC 99y no
apiserver Apr 03, 2120 09:36 UTC 99y no
apiserver-etcd-client Apr 03, 2120 09:36 UTC 99y no
apiserver-kubelet-client Apr 03, 2120 09:36 UTC 99y no
controller-manager.conf Apr 03, 2120 09:36 UTC 99y no
etcd-healthcheck-client Apr 03, 2120 09:36 UTC 99y no
etcd-peer Apr 03, 2120 09:36 UTC 99y no
etcd-server Apr 03, 2120 09:36 UTC 99y no
front-proxy-client Apr 03, 2120 06:47 UTC 99y no
scheduler.conf Apr 03, 2120 09:36 UTC 99y no
- 從master-01 上拷貝證書文件
從master01 上拷貝證書
ssh 10.251.137.187 "mkdir -p /etc/kubernetes/pki/etcd"
ssh 10.251.137.188 "mkdir -p /etc/kubernetes/pki/etcd"
scp -r /etc/kubernetes/admin.conf 10.251.137.187:/etc/kubernetes/admin.conf
scp -r /etc/kubernetes/admin.conf 10.251.137.188:/etc/kubernetes/admin.conf
scp -r /etc/kubernetes/pki/{ca.*,sa.*,front*} 10.251.137.187:/etc/kubernetes/pki/
scp -r /etc/kubernetes/pki/{ca.*,sa.*,front*} 10.251.137.188:/etc/kubernetes/pki/
scp -r /etc/kubernetes/pki/etcd/ca.* 10.251.137.187:/etc/kubernetes/pki/etcd/
scp -r /etc/kubernetes/pki/etcd/ca.* 10.251.137.188:/etc/kubernetes/pki/etcd/
- 重啟docker
說明：主要為了重啟proxy和etcd文章來源地址http://www.zghlxwxcb.cn/news/detail-582189.html
service docker restart
- 重啟kubelet
service kubelet restart
到了這里，關(guān)于k8s證書到期實際操作的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
