51工具盒子项目上默认的k8s证书有效期仅一年，然而项目上频繁renew并不现实。
本文档环境为Red Hat Enterprise Linux 8.6 (Ootpa)，每台master节点均需操作。
[root@lolicp amd64]# ./kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W0812 21:38:13.168647 72514 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.42.0.10]; the provided value is: [10.42.0.3]
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Dec 21, 2024 01:50 UTC 130d ca no
apiserver Dec 21, 2024 01:50 UTC 130d ca no
apiserver-etcd-client Dec 21, 2024 01:50 UTC 130d etcd-ca no
apiserver-kubelet-client Dec 21, 2024 01:50 UTC 130d ca no
controller-manager.conf Dec 21, 2024 01:50 UTC 130d ca no
etcd-healthcheck-client Dec 21, 2024 01:50 UTC 130d etcd-ca no
etcd-peer Dec 21, 2024 01:50 UTC 130d etcd-ca no
etcd-server Dec 21, 2024 01:50 UTC 130d etcd-ca no
front-proxy-client Dec 21, 2024 01:50 UTC 130d front-proxy-ca no
scheduler.conf Dec 21, 2024 01:50 UTC 130d ca no
`CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Dec 19, 2033 01:50 UTC 9y no
etcd-ca Dec 19, 2033 01:50 UTC 9y no
front-proxy-ca Dec 19, 2033 01:50 UTC 9y no`
查询kubeadm及go版本
检查kubeadm服务版本及go版本。
[root@lolicp kubeadm_update]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.13", GitCommit:"80ec6572b15ee0ed2e6efa97a4dcd30f57e68224", GitTreeState:"clean", BuildDate:"2022-05-24T12:39:27Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"}
安装依赖
在操作前，提前安装编译时会使用到的依赖。
[root@lolicp kubeadm_update]# yum install -y gcc make rsync jq git wget
git拉取源码
拉取指定版本的kubernetes源码，中国境内需要使用代理。
[root@lolicp ~]# mkdir kubeadm_update
[root@lolicp ~]# cd kubeadm_update/
[root@lolicp kubeadm_update]# git clone --branch v1.21.13 --single-branch --depth 1 https://github.com/kubernetes/kubernetes
Cloning into 'kubernetes'...
remote: Enumerating objects: 23617, done.
remote: Counting objects: 100% (23617/23617), done.
remote: Compressing objects: 100% (18596/18596), done.
Receiving objects: 100% (23617/23617), 34.73 MiB | 10.03 MiB/s, done.
remote: Total 23617 (delta 6342), reused 11128 (delta 3401), pack-reused 0
Resolving deltas: 100% (6342/6342), done.
Note: switching to '80ec6572b15ee0ed2e6efa97a4dcd30f57e68224'.
You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
git switch -c \<new-branch-name\>
Or undo this operation with:
git switch -
`Turn off this advice by setting config variable advice.detachedHead to false
[root@lolicp kubeadm_update]# cd kubernetes/`
安装Golang
[root@node1 kubeadm_update]# wget https://dl.google.com/go/go1.16.15.linux-amd64.tar.gz
[root@node1 kubeadm_update]# tar zxf go1.16.15.linux-amd64.tar.gz -C /usr/local/
[root@node1 kubeadm_update]# vi /etc/profile
export GOROOT=/usr/local/go
export GOPATH=/usr/local/gopath
export PATH=$PATH:$GOROOT/bin
`[root@node1 kubeadm_update]# source /etc/profile
[root@node1 kubeadm_update]# go version
go version go1.16.15 linux/amd64`
修改证书时间
修改CA证书时间
CERTIFICATE AUTHORITY,修改第38行，默认为10年，*10则为100年。
[root@lolicp kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go
const duration365d = time.Hour * 24 * 365 * 10
NotAfter: now.Add(duration365d * 10).UTC(),
修改其他证书时间
CERTIFICATE，修改第49行，默认为1年，*100则为100年。
[root@lolicp kubernetes]# vim cmd/kubeadm/app/constants/constants.go
CertificateValidity = time.Hour * 24 * 365 * 100
编译kubeadm
[root@lolicp kubernetes]# make all WHAT=cmd/kubeadm GOFLAGS=-v VERBOSE=1
报错信息
遇到该报错则表示cert.go中的时间设置过久，超出范围。
[root@lolicp kubernetes]# make all WHAT=cmd/kubeadm GOFLAGS=-v VERBOSE=1
Generating deepcopy code for 1 targets
+++ [0812 21:33:05] Building go targets for linux/amd64:
cmd/kubeadm
k8s.io/kubernetes/vendor/k8s.io/client-go/util/cert
# k8s.io/kubernetes/vendor/k8s.io/client-go/util/cert
vendor/k8s.io/client-go/util/cert/cert.go:66:47: constant 31536000000000000000 overflows time.Duration
!!! [0812 21:33:06] Call tree:
!!! [0812 21:33:06] 1: /root/kubeadm_update/kubernetes/hack/lib/golang.sh:715 kube::golang::build_some_binaries(...)
!!! [0812 21:33:06] 2: /root/kubeadm_update/kubernetes/hack/lib/golang.sh:870 kube::golang::build_binaries_for_platform(...)
!!! [0812 21:33:06] 3: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [0812 21:33:06] Call tree:
!!! [0812 21:33:06] 1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [0812 21:33:06] Call tree:
!!! [0812 21:33:06] 1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make: *** [Makefile:92: all] Error 1
renew证书
备份配置
cp -rf /etc/kubernetes{,.20240814}
cp /root/.kube/config{,.20240814}
renew所有证书
[root@lolicp kubernetes]# cd ./_output/local/bin/linux/amd64/
[root@lolicp amd64]# ./kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"21+", GitVersion:"v1.21.13-dirty", GitCommit:"80ec6572b15ee0ed2e6efa97a4dcd30f57e68224", GitTreeState:"dirty", BuildDate:"2024-08-12T14:14:05Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"}
[root@lolicp amd64]# ./kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W0812 22:18:29.979838 119523 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.42.0.10]; the provided value is: [10.42.0.3]
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
`Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.`
更新config
[root@lolicp ~]# cp -a /etc/kubernetes/admin.conf $HOME/.kube/config
[root@lolicp ~]# chown $(id -u):$(id -g) $HOME/.kube/config
验证
[root@lolicp amd64]# ./kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W0812 22:19:56.425166 122855 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.42.0.10]; the provided value is: [10.42.0.3]
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Jul 19, 2124 14:19 UTC 99y ca no
apiserver Jul 19, 2124 14:19 UTC 99y ca no
apiserver-etcd-client Jul 19, 2124 14:19 UTC 99y etcd-ca no
apiserver-kubelet-client Jul 19, 2124 14:19 UTC 99y ca no
controller-manager.conf Jul 19, 2124 14:19 UTC 99y ca no
etcd-healthcheck-client Jul 19, 2124 14:19 UTC 99y etcd-ca no
etcd-peer Jul 19, 2124 14:19 UTC 99y etcd-ca no
etcd-server Jul 19, 2124 14:19 UTC 99y etcd-ca no
front-proxy-client Jul 19, 2124 14:19 UTC 99y front-proxy-ca no
scheduler.conf Jul 19, 2124 14:19 UTC 99y ca no
`CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Dec 19, 2033 01:50 UTC 9y no
etcd-ca Dec 19, 2033 01:50 UTC 9y no
front-proxy-ca Dec 19, 2033 01:50 UTC 9y no`
参考文档：
https://www.youqiqi.cn/archives/kubernetesxiu-gai-kubeadmzheng-shu
https://www.asjin.com/2021/08/20/kubernetes/kubernetes%E8%AF%81%E4%B9%A6%E4%BF%AE%E5%A4%8D/
