Kubernetes---修改證書可用年限

⒈查詢證書可用時間

openssl x509 -in apiserver.crt -text -noout

　　*在Vallidity節點下

　　Kubernetes有兩種機制去創建證書，有一部分是1年的，有1部分是10年的

⒉部署Go語言環境

　　Go中文社區：https://studygolang.com/dl

　　https://studygolang.com/dl/golang/go1.14.2.linux-amd64.tar.gz

 

　　Go官網：https://golang.org/dl/

　　https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz

 

wget https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz 
tar -zxvf go1.14.2.linux-amd64.tar.gz -C /usr/local
vi /etc/profile 
    export PATH=$PATH:/usr/local/go/bin 
source /etc/profile
go version

⒊下載源碼

cd /data && git clone https://github.com/kubernetes/kubernetes.git 
cd kubernetes
git checkout -b remotes/origin/release-1.15.1 v1.15.1  #切換當前版本(分支)    

⒋修改 Kubeadm源碼包更新證書策略

vim staging/src/k8s.io/client-go/util/cert/cert.go  # kubeadm 1.14 版本之前 
vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今 
    const duration365d = time.Hour * 24 * 365 * 10  #設置為10年
    NotAfter: time.Now().Add(duration365d).UTC(),   #替換
make WHAT=cmd/kubeadm GOFLAGS=-v    #設置只編譯kubeadm
cp _output/bin/kubeadm /root/kubeadm-new

⒌更新 kubeadm 

#將kubeadm 進行替換 
cp /usr/bin/kubeadm /usr/bin/kubeadm.old 
cp /root/kubeadm-new /usr/bin/kubeadm 
chmod a+x /usr/bin/kubeadm

⒍更新各節點證書至Master節點

cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old 
cd /etc/kubernetes/pki 
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml 
openssl x509 -in apiserver.crt -text -noout | grep Not

⒎HA集群其余 mater節點證書更新

#!/bin/bash 
masterNode="192.168.66.20 192.168.66.21"
#for host in ${masterNode}; do
# scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}
# "${USER}"@$host:/etc/kubernetes/pki/ 
# scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd 
# scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/ 
#done 
for host in ${CONTROL_PLANE_IPS}; do 
    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} 
"${USER}"@$host:/root/pki/ 
    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd 
    scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/ 
done