使用kubekey 更新K8S证书

jwangkun

发布于 2021-12-23 16:48:18

1.8K0

发布于 2021-12-23 16:48:18

文章被收录于专栏：John Wong's BlogJohn Wong's Blog

获取安装程序可执行文件

下载 KubeKey 可执行文件发布页面下载解压后可直接使用。
从源代码生成二进制文件

git clone https://github.com/kubesphere/kubekey.git
 cd kubekey
 ./build.sh

检查证书有效期

./kk certs check-expiration [(-f | --file) path]

-f to specify the configuration file which was generated for cluster creation. This parameter is not required if it is single node.

./kk certs check-expiration

INFO[08:06:54 CST] Listing cluster certs ...                    
CERTIFICATE                    EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   NODE
apiserver.crt                  Nov 07, 2021 02:56 UTC   <invalid>       ca                      k8s-master1
apiserver-kubelet-client.crt   Nov 07, 2021 02:56 UTC   <invalid>       ca                      k8s-master1
front-proxy-client.crt         Nov 07, 2021 02:56 UTC   <invalid>       front-proxy-ca          k8s-master1
admin.conf                     Nov 07, 2021 02:57 UTC   <invalid>                               k8s-master1
controller-manager.conf        Nov 07, 2021 02:57 UTC   <invalid>                               k8s-master1
scheduler.conf                 Nov 07, 2021 02:57 UTC   <invalid>                               k8s-master1

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   NODE
ca.crt                  Nov 05, 2030 02:56 UTC   8y              k8s-master1
front-proxy-ca.crt      Nov 05, 2030 02:56 UTC   8y              k8s-master1
INFO[08:06:54 CST] Successful.

更新K8S证书

./kk certs renew [(-f | --file) path]

-f to specify the configuration file which was generated for cluster creation. This parameter is not required if it is single node.

./kk certs renew

INFO[08:07:23 CST] Renewing cluster certs ...                   
[k8s-master1 10.213.118.10] MSG:
v1.18.6
INFO[08:07:28 CST] Syncing cluster kubeConfig ...               
INFO[08:07:28 CST] Listing cluster certs ...                    
CERTIFICATE                    EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   NODE
apiserver.crt                  Nov 19, 2022 00:07 UTC   364d            ca                      k8s-master1
apiserver-kubelet-client.crt   Nov 19, 2022 00:07 UTC   364d            ca                      k8s-master1
front-proxy-client.crt         Nov 19, 2022 00:07 UTC   364d            front-proxy-ca          k8s-master1
admin.conf                     Nov 19, 2022 00:07 UTC   364d                                    k8s-master1
controller-manager.conf        Nov 19, 2022 00:07 UTC   364d                                    k8s-master1
scheduler.conf                 Nov 19, 2022 00:07 UTC   364d                                    k8s-master1

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   NODE
ca.crt                  Nov 05, 2030 02:56 UTC   8y              k8s-master1
front-proxy-ca.crt      Nov 05, 2030 02:56 UTC   8y              k8s-master1
INFO[08:07:28 CST] Successful.

kubernetes v1.15以上更新证书的方法

更新/etc/kubernetes/pki目录下的所有证书（不包含ca证书）

注意：需要在每一个节点上都更新

# 查看现有证书到期时间
$ kubeadm alpha certs check-expiration
# 使用二进制更新证书
$ kubeadm alpha certs renew all
# 每月的最后1天
crontab  -e

* * 1  * *  /usr/bin/kubeadm alpha certs renew all

本文参与腾讯云自媒体同步曝光计划，分享自作者个人站点/博客。

原始发表：2021-11-19，如有侵权请联系 cloudcommunity@tencent.com 删除

https