Kubernetes 之修改证书时限

# 证书存放在: /etc/kubernetes/pki 目录下
$ ls -lh /etc/kubernetes/pki
-rw-r--r-- 1 root root 1212 May 19 14:01 apiserver.crt
-rw-r--r-- 1 root root 1090 May 19 14:01 apiserver-etcd-client.crt
-rw------- 1 root root 1679 May 19 14:01 apiserver-etcd-client.key
-rw------- 1 root root 1675 May 19 14:01 apiserver.key
-rw-r--r-- 1 root root 1099 May 19 14:01 apiserver-kubelet-client.crt
-rw------- 1 root root 1679 May 19 14:01 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1025 May  17  2020 ca.crt
-rw------- 1 root root 1679 May  17  2020 ca.key
drwxr-xr-x 2 root root 4096 May  17  2020 etcd/
-rw-r--r-- 1 root root 1038 May  17  2020 front-proxy-ca.crt
-rw------- 1 root root 1679 May  17  2020 front-proxy-ca.key
-rw-r--r-- 1 root root 1058 May 19 14:01 front-proxy-client.crt
-rw------- 1 root root 1675 May 19 14:01 front-proxy-client.key
-rw------- 1 root root 1675 May  17  2020 sa.key
-rw------- 1 root root  451 May  17  2020 sa.pub

# 查看有效期
$ for i in $(ls *.crt); do \
    echo "===== $i ====="; \
    openssl x509 -in $i -text -noout | grep -A 3 'Validity'; done

# 除了ca根证书外其他证书有效期都是1年
===== apiserver.crt =====
        Validity
            Not Before: May 12 07:51:36 2020 GMT
            Not After : May 12 07:51:36 2021 GMT
        Subject: CN = kube-apiserver
===== apiserver-etcd-client.crt =====
        Validity
            Not Before: May 12 07:51:36 2020 GMT
            Not After : May 12 07:51:36 2021 GMT
        Subject: O = system:masters, CN = kube-apiserver-etcd-client
===== apiserver-kubelet-client.crt =====
        Validity
            Not Before: May 12 07:51:36 2020 GMT
            Not After : May 12 07:51:36 2021 GMT
        Subject: O = system:masters, CN = kube-apiserver-kubelet-client
===== ca.crt =====
        Validity
            Not Before: May 12 07:51:36 2020 GMT
            Not After : May 10 07:51:36 2029 GMT
        Subject: CN = kubernetes
===== front-proxy-ca.crt =====
        Validity
            Not Before: May 12 07:51:36 2019 GMT
            Not After : May 10 07:51:36 2029 GMT
        Subject: CN = front-proxy-ca
===== front-proxy-client.crt =====
        Validity
            Not Before: May 12 07:51:36 2020 GMT
            Not After : May 12 07:51:36 2021 GMT
        Subject: CN = front-proxy-client

# 安装Go语言
$ wget https://dl.google.com/go/go1.12.7.linux-amd64.tar.gz
$ tar -zxvf go1.12.1.linux-amd64.tar.gz -C /usr/local

# 加入到系统配置中
$ vi /etc/profile
export PATH=$PATH:/usr/local/go/bin
source /etc/profile

# 创建并下载代码
$ cd /data && mkdir -pv k8s_src
$ git clone https://github.com/kubernetes/kubernetes.git
$ git checkout -b remotes/origin/release-1.15.1 v1.15.

# kubeadm1.14版本之前
$ vim staging/src/k8s.io/client-go/util/cert/cert.go

# kubeadm1.14至今的版本
$ vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go

# 添加如下对应内容
    const duration365d = time.Hour * 24 * 365
    NotAfter: time.Now().Add(duration365d).UTC(),
make WHAT=cmd/kubeadm GOFLAGS=-v
cp _output/bin/kubeadm /root/kubeadm-new

# 将kubeadm进行替换
$ cp /usr/bin/kubeadm /usr/bin/kubeadm.old
$ cp /root/kubeadm-new /usr/bin/kubeadm
$ chmod a+x /usr/bin/kubeadm

# 备份证书
$ cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old

# 更新证书
$ cd /etc/kubernetes/pki
$ kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml
$ openssl x509 -in apiserver.crt -text -noout | grep Not

#!/bin/bash

masterNode="192.168.66.20 192.168.66.21"

# for host in ${masterNode}; do
#    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}
"${USER}"@$host:/etc/kubernetes/pki/
#    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd
#    scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/
# done

for host in ${CONTROL_PLANE_IPS}; do
    scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key}
"${USER}"@$host:/root/pki/
    scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd
    scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/
done