延長k8s master 證書時間
參考文檔： https://blog.51cto.com/11889458/2323328
- 下載源碼並切換分支
git clone https://github.com/kubernetes/kubernetes.git -b release-1.17 v1.17.3
- 安裝go
mkdir /data/soft
cd /data/soft/
wget https://dl.google.com/go/go1.13.6.linux-amd64.tar.gz
tar zxvf go1.13.6.linux-amd64.tar.gz -C /usr/local/
vim /etc/profile
export GOROOT=/usr/local/go
export PATH=$PATH:$GOROOT/bin
source /etc/profile
go version
- 修改源碼
vim /data/v1.17.3/staging/src/k8s.io/client-go/util/cert/cert.go
96 maxAge := time.Hour * 24 * 365 * 10 // one year self-signed certs
vim /data/v1.17.3/cmd/kubeadm/app/constants/constants.go
47 CertificateValidity = time.Hour * 24 * 365 * 10
- 編譯
cd /data/v1.17.3/
KUBE_BUILD_PLATFORMS=linux/amd64 make WHAT=cmd/kubeadm GOFLAGS=-v GOGCFLAGS="-N -l"
- 將編譯出的二進制也執行文件替換到現有系統的kubeadm目錄
ls -l /data/v1.17.3/_output/bin/kubeadm
mv /usr/bin/kubeadm /usr/bin/kubeadm_backup
ln -s /data/v1.17.3/_output/bin/kubeadm /usr/bin/kubeadm
- 重新初始化集群(第一種方法)
kubeadm reset
kubeadm init --config=kubeadm-config.yaml --upload-certs | tee kubeadm-init.log
rm -rf $HOME/.kube
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
- 更新配置(第二種方法)
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml
- 驗證結果
cd /etc/kubernetes/pki/
openssl x509 -in front-proxy-client.crt -noout -text |grep Not
openssl x509 -in apiserver.crt -noout -text |grep Not
master重新生成token和證書key
-
master生成token
默認有效期24小時,若想久一些可以結合--ttl參數,設為0則用不過期
kubeadm token create --print-join-command
- master生成證書
kubeadm init phase upload-certs --upload-certs
-
如果是加入master, 需要拼接以上的token和證書的key
在其他從master上運行如下命令
kubeadm join 172.16.240.100:6443 --token abcdef.0123456789abcdef --discovery-token-ca-cert-hash sha256:765ed49fc560742ad9e83340bc1264e0caf33fcc0cc11a4d82ad292ceaed6ad7 --control-plane --certificate-key abe665cf4c25f5f9b3f234ca7ac36264dd88aafe2fb337feb32a5e048782daaa
- 查看token
kubeadm token list
