kubeadm v1.21.13编译修改证书到期时间-工具盒子

项目上默认的k8s证书有效期仅一年，然而项目上频繁renew并不现实。
本文档环境为Red Hat Enterprise Linux 8.6 (Ootpa)，每台master节点均需操作。

[root@lolicp amd64]# ./kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' W0812 21:38:13.168647 72514 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.42.0.10]; the provided value is: [10.42.0.3] CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Dec 21, 2024 01:50 UTC 130d ca no apiserver Dec 21, 2024 01:50 UTC 130d ca no apiserver-etcd-client Dec 21, 2024 01:50 UTC 130d etcd-ca no apiserver-kubelet-client Dec 21, 2024 01:50 UTC 130d ca no controller-manager.conf Dec 21, 2024 01:50 UTC 130d ca no etcd-healthcheck-client Dec 21, 2024 01:50 UTC 130d etcd-ca no etcd-peer Dec 21, 2024 01:50 UTC 130d etcd-ca no etcd-server Dec 21, 2024 01:50 UTC 130d etcd-ca no front-proxy-client Dec 21, 2024 01:50 UTC 130d front-proxy-ca no scheduler.conf Dec 21, 2024 01:50 UTC 130d ca no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Dec 19, 2033 01:50 UTC 9y no etcd-ca Dec 19, 2033 01:50 UTC 9y no front-proxy-ca Dec 19, 2033 01:50 UTC 9y no

查询kubeadm及go版本

检查kubeadm服务版本及go版本。

[root@lolicp kubeadm_update]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.13", GitCommit:"80ec6572b15ee0ed2e6efa97a4dcd30f57e68224", GitTreeState:"clean", BuildDate:"2022-05-24T12:39:27Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"}

安装依赖

在操作前，提前安装编译时会使用到的依赖。

[root@lolicp kubeadm_update]# yum install -y gcc make rsync jq git wget

git拉取源码

拉取指定版本的kubernetes源码，中国境内需要使用代理。

[root@lolicp ~]# mkdir kubeadm_update [root@lolicp ~]# cd kubeadm_update/ [root@lolicp kubeadm_update]# git clone --branch v1.21.13 --single-branch --depth 1 https://github.com/kubernetes/kubernetes Cloning into 'kubernetes'... remote: Enumerating objects: 23617, done. remote: Counting objects: 100% (23617/23617), done. remote: Compressing objects: 100% (18596/18596), done. Receiving objects: 100% (23617/23617), 34.73 MiB | 10.03 MiB/s, done. remote: Total 23617 (delta 6342), reused 11128 (delta 3401), pack-reused 0 Resolving deltas: 100% (6342/6342), done. Note: switching to '80ec6572b15ee0ed2e6efa97a4dcd30f57e68224'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by switching back to a branch. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -c with the switch command. Example: git switch -c <new-branch-name> Or undo this operation with: git switch -

Turn off this advice by setting config variable advice.detachedHead to false [root@lolicp kubeadm_update]# cd kubernetes/

安装Golang

[root@node1 kubeadm_update]# wget https://dl.google.com/go/go1.16.15.linux-amd64.tar.gz
[root@node1 kubeadm_update]# tar zxf go1.16.15.linux-amd64.tar.gz -C /usr/local/
[root@node1 kubeadm_update]# vi /etc/profile
export GOROOT=/usr/local/go
export GOPATH=/usr/local/gopath
export PATH=$PATH:$GOROOT/bin
`[root@node1 kubeadm_update]# source /etc/profile
[root@node1 kubeadm_update]# go version
go version go1.16.15 linux/amd64`

修改证书时间

修改CA证书时间

CERTIFICATE AUTHORITY,修改第38行，默认为10年，*10则为100年。

[root@lolicp kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go
const duration365d = time.Hour * 24 * 365 * 10
                NotAfter:              now.Add(duration365d * 10).UTC(),

修改其他证书时间

CERTIFICATE，修改第49行，默认为1年，*100则为100年。

[root@lolicp kubernetes]# vim cmd/kubeadm/app/constants/constants.go
        CertificateValidity = time.Hour * 24 * 365 * 100

编译kubeadm

[root@lolicp kubernetes]# make all WHAT=cmd/kubeadm GOFLAGS=-v VERBOSE=1

报错信息

遇到该报错则表示cert.go中的时间设置过久，超出范围。

[root@lolicp kubernetes]# make all WHAT=cmd/kubeadm GOFLAGS=-v VERBOSE=1
Generating deepcopy code for 1 targets
+++ [0812 21:33:05] Building go targets for linux/amd64:
    cmd/kubeadm
k8s.io/kubernetes/vendor/k8s.io/client-go/util/cert
# k8s.io/kubernetes/vendor/k8s.io/client-go/util/cert
vendor/k8s.io/client-go/util/cert/cert.go:66:47: constant 31536000000000000000 overflows time.Duration
!!! [0812 21:33:06] Call tree:
!!! [0812 21:33:06]  1: /root/kubeadm_update/kubernetes/hack/lib/golang.sh:715 kube::golang::build_some_binaries(...)
!!! [0812 21:33:06]  2: /root/kubeadm_update/kubernetes/hack/lib/golang.sh:870 kube::golang::build_binaries_for_platform(...)
!!! [0812 21:33:06]  3: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [0812 21:33:06] Call tree:
!!! [0812 21:33:06]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [0812 21:33:06] Call tree:
!!! [0812 21:33:06]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make: *** [Makefile:92: all] Error 1

renew证书

备份配置

cp -rf /etc/kubernetes{,.20240814}
cp /root/.kube/config{,.20240814}

renew所有证书

[root@lolicp kubernetes]# cd ./_output/local/bin/linux/amd64/ [root@lolicp amd64]# ./kubeadm version kubeadm version: &version.Info{Major:"1", Minor:"21+", GitVersion:"v1.21.13-dirty", GitCommit:"80ec6572b15ee0ed2e6efa97a4dcd30f57e68224", GitTreeState:"dirty", BuildDate:"2024-08-12T14:14:05Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"} [root@lolicp amd64]# ./kubeadm certs renew all [renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' W0812 22:18:29.979838 119523 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.42.0.10]; the provided value is: [10.42.0.3] certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.

更新config

[root@lolicp ~]# cp -a /etc/kubernetes/admin.conf $HOME/.kube/config
[root@lolicp ~]# chown $(id -u):$(id -g) $HOME/.kube/config

验证

[root@lolicp amd64]# ./kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' W0812 22:19:56.425166 122855 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.42.0.10]; the provided value is: [10.42.0.3] CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Jul 19, 2124 14:19 UTC 99y ca no apiserver Jul 19, 2124 14:19 UTC 99y ca no apiserver-etcd-client Jul 19, 2124 14:19 UTC 99y etcd-ca no apiserver-kubelet-client Jul 19, 2124 14:19 UTC 99y ca no controller-manager.conf Jul 19, 2124 14:19 UTC 99y ca no etcd-healthcheck-client Jul 19, 2124 14:19 UTC 99y etcd-ca no etcd-peer Jul 19, 2124 14:19 UTC 99y etcd-ca no etcd-server Jul 19, 2124 14:19 UTC 99y etcd-ca no front-proxy-client Jul 19, 2124 14:19 UTC 99y front-proxy-ca no scheduler.conf Jul 19, 2124 14:19 UTC 99y ca no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Dec 19, 2033 01:50 UTC 9y no etcd-ca Dec 19, 2033 01:50 UTC 9y no front-proxy-ca Dec 19, 2033 01:50 UTC 9y no

参考文档：
https://www.youqiqi.cn/archives/kubernetesxiu-gai-kubeadmzheng-shu
https://www.asjin.com/2021/08/20/kubernetes/kubernetes%E8%AF%81%E4%B9%A6%E4%BF%AE%E5%A4%8D/