k8s 證書過期解決

下載kubernetest 源碼

apt -get install git 

git clone https://github.com/kubernetes/kubernetes.git

切換分支

cd kubernetes && git checkout -b remotes/origin/release-1.13 v1.13.0

下載docker編譯環境

https://hub.docker.com/r/gcrcontainer/kube-cross/tags?page=2  在dockerhub 下載相應的版本

docker pull gcrcontainer/kube-cross:v1.13.1-1 

docker run --rm -v /root/kubernetes/:/go/src/k8s.io/kubernetes -it gcrcontainer/kube-cross:v1.13.1-1 bash

修改源碼

vim  /kubernetes/staging/src/k8s.io/client-go/util/cert/cert.go

maxAge := time.Hour * 24 * 365   #修改前       

NotAfter:     time.Now().Add(duration365d).UTC()

 maxAge := time.Hour * 24 * 365 * 50  #修改后   給證書期限為50年

NotAfter:     time.Now().Add(duration365d * 50).UTC()

 

編譯

cd /go/src/k8s.io/kubernetes

# 編譯kubeadm, 這里主要編譯kubeadm 即可
make all WHAT=cmd/kubeadm GOFLAGS=-v

拷貝編譯的文件
cp ./_output/local/bin/linux/amd64/kubeadm 

 

master  

備份證書和配置文件

cp -r  /etc/kubernetes/ ./

#!/usr/bin/env bash
set -e
sudo mv /etc/kubernetes/pki/apiserver.key /etc/kubernetes/pki/apiserver.key.old
sudo mv /etc/kubernetes/pki/apiserver.crt /etc/kubernetes/pki/apiserver.crt.old
sudo mv /etc/kubernetes/pki/apiserver-kubelet-client.crt /etc/kubernetes/pki/apiserver-kubelet-client.crt.old
sudo mv /etc/kubernetes/pki/apiserver-kubelet-client.key /etc/kubernetes/pki/apiserver-kubelet-client.key.old
sudo mv /etc/kubernetes/pki/front-proxy-client.crt /etc/kubernetes/pki/front-proxy-client.crt.old
sudo mv /etc/kubernetes/pki/front-proxy-client.key /etc/kubernetes/pki/front-proxy-client.key.old
sudo mv /etc/kubernetes/pki/front-proxy-ca.crt /etc/kubernetes/pki/front-proxy-ca.crt.old
sudo mv /etc/kubernetes/pki/front-proxy-ca.key /etc/kubernetes/pki/front-proxy-ca.key.old
sudo mv /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.old
sudo mv /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.old
sudo mv /etc/kubernetes/controller-manager.conf /etc/kubernetes/controller-manager.conf.old
sudo mv /etc/kubernetes/scheduler.conf /etc/kubernetes/scheduler.conf.old

 

拷貝編譯后的kubeadm

\cp kubeadm /usr/bin/

創建kubeadm-conf.yaml 文件

cat > /tmp/kubeadm-conf.yaml <<EOF
apiVersion: kubeadm.k8s.io/v1alpha1
kind: MasterConfiguration
networking:
  podSubnet: 192.169.0.0/16
  serviceSubnet: 10.96.0.0/12
#apiServerCertSANs:
#- master01
#- master02
#- master03
#- 172.16.2.1
#- 172.16.2.2
#- 172.16.2.3
#- 172.16.2.100
#etcd:
#  endpoints:
#     - http://192.168.188.160:2379
#     - http://192.168.188.161:2379
#     - http://192.168.188.162:2379
#token: 2wt8ap.ev8cvrpuzt81zwm7
#tokenTTL: "0"
kubernetesVersion: v1.11.5
#imageRepository:
api:
  advertiseAddress: 192.168.188.160
kubeletConfiguration:
  baseConfig:
    evictionHard:
      imagefs.available: 6Gi
      memory.available: 512Mi
      nodefs.available: 3Gi
EOF

sudo kubeadm alpha phase certs apiserver --config /tmp/kubeadm-conf.yaml
sudo kubeadm alpha phase certs front-proxy-ca --config /tmp/kubeadm-conf.yaml
sudo kubeadm alpha phase certs apiserver-kubelet-client --config /tmp/kubeadm-conf.yaml
sudo kubeadm alpha phase certs front-proxy-client --config /tmp/kubeadm-conf.yaml
sudo kubeadm alpha phase kubeconfig all --config /tmp/kubeadm-conf.yaml

sudo rm -rf $HOME/.kube
mkdir -p mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

查看證書時間

openssl x509 -in /etc/kubernetes/pki/front-proxy-client.crt -noout -dates

 

追加部分：

為了不要每年都更新客戶端證書可以在/etc/kubernetes/manifests/kube-controller-manager.yaml的26行左右添加下面內容（主要空格對其）：

     - --experimental-cluster-signing-duration=876000h0m0s

修改完成后，需要刪除/var/lib/kubelet/pki/下的文件，重新啟動kubelet服務就可以了

注意：如果為生成證書，請查看時間是否同步

 

 

創建永久token

kubeadm token create --ttl 0

kubeadm token list

systemctl restart kubelet

 

node

刪除/var/lib/kubelet/pki/下的所有文件

rm -rf /var/lib/kubelet/pki/*

 

 

替換/etc/kubernetes/bootstrap-kubelet.conf中的token（紅色框的部分）為上面創建的token值

sudo sed -i "s/56d5fi.18j8g4fgca4lf1a1/06cymx.d1vcolksn9uwthqz/g" /etc/kubernetes/bootstrap-kubelet.conf

 

 

重啟kubelet 服務，systemctl restart kubelet

 

 

檢測是否成功，ls /var/lib/kubelet/pki/

 

kubelet 自動續期

https://www.cnblogs.com/lvcisco/p/11912637.html 

 

 docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-cross:v1.7.5-2

https://www.cnblogs.com/skymyyang/p/11093686.html
https://www.cnblogs.com/kuku0223/p/10509637.html
https://hub.docker.com/r/gcrcontainer/kube-cross/tags?page=2