此方法支持以下 kubeadm版本

v1.22到v1.25

kubeadm 默认证书为一年,一年过期后,会导致 api service 不可用,使用过程中会出现:x509: certificate has expired or is not yet valid.

001、获取源码

访问:https://github.com/kubernetes/kubernetes/releases,下载特定版本源码

wget -c https://github.com/kubernetes/kubernetes/archive/v1.22.12.tar.gz
tar xf v1.22.12.tar.gz
mv kubernetes-1.22.12 kubernetes
cd kubernetes

002、修改证书有效期

主要有两个地方需要修改

021、修改 CA 有效期为 100 年(默认为 10 年)

vim ./staging/src/k8s.io/client-go/util/cert/cert.go

// 这个方法里面 NotAfter:              now.Add(duration365d * 10).UTC()
// 默认有效期就是 10 年,改成 100 年 (sysin)
// 输入 /NotAfter 查找,回车定位
func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
now := time.Now()
tmpl := x509.Certificate{
SerialNumber: new(big.Int).SetInt64(0),
Subject: pkix.Name{
CommonName: cfg.CommonName,
Organization: cfg.Organization,
},
NotBefore: now.UTC(),
// NotAfter: now.Add(duration365d * 10).UTC(),
NotAfter: now.Add(duration365d * 100).UTC(),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
BasicConstraintsValid: true,
IsCA: true,
} certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key)
if err != nil {
return nil, err
}
return x509.ParseCertificate(certDERBytes)
}

022、修改证书有效期为 100 年(默认为 1 年)

vim ./cmd/kubeadm/app/constants/constants.go

// 就是这个常量定义 CertificateValidity,改成 * 100 年 (sysin)
// 输入 /CertificateValidity 查找,回车定位
const (
// KubernetesDir is the directory Kubernetes owns for storing various configuration files
KubernetesDir = "/etc/kubernetes"
// ManifestsSubDirName defines directory name to store manifests
ManifestsSubDirName = "manifests"
// TempDirForKubeadm defines temporary directory for kubeadm
// should be joined with KubernetesDir.
TempDirForKubeadm = "tmp" // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
// CertificateValidity = time.Hour * 24 * 365
CertificateValidity = time.Hour * 24 * 365 * 100 // CACertAndKeyBaseName defines certificate authority base name
CACertAndKeyBaseName = "ca"
// CACertName defines certificate name
CACertName = "ca.crt"
// CAKeyName defines certificate name
CAKeyName = "ca.key"

验证一下已经正确修改:

cat ./staging/src/k8s.io/client-go/util/cert/cert.go | grep NotAfter
cat ./cmd/kubeadm/app/constants/constants.go | grep CertificateValidity

git 验证(可选,适用于 git 获取的源码),修改的内容如下:

git diff

diff --git a/cmd/kubeadm/app/constants/constants.go b/cmd/kubeadm/app/constants/constants.go
index 75adf43..54f25fa 100644
--- a/cmd/kubeadm/app/constants/constants.go
+++ b/cmd/kubeadm/app/constants/constants.go
@@ -44,7 +44,7 @@ const (
TempDirForKubeadm = "tmp" // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
- CertificateValidity = time.Hour * 24 * 365
+ CertificateValidity = time.Hour * 24 * 365 * 100 // CACertAndKeyBaseName defines certificate authority base name
CACertAndKeyBaseName = "ca"
diff --git a/staging/src/k8s.io/client-go/util/cert/cert.go b/staging/src/k8s.io/client-go/util/cert/cert.go
index 9fd097a..865d6bb 100644
--- a/staging/src/k8s.io/client-go/util/cert/cert.go
+++ b/staging/src/k8s.io/client-go/util/cert/cert.go
@@ -63,7 +63,7 @@ func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, erro
Organization: cfg.Organization,
},
NotBefore: now.UTC(),
- NotAfter: now.Add(duration365d * 10).UTC(),
+ NotAfter: now.Add(duration365d * 100).UTC(),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
BasicConstraintsValid: true,
IsCA: true,

源代码改好了,接下来就是编译 kubeadm 了。

003、编译

编译方式采用本机编译

环境需求参看 下面的官方文档。

https://github.com/kubernetes/community/blob/master/contributors/devel/development.md
本例编译参考信息
cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core) uname -r
4.19.188-10.el7.ucloud.x86_64 4C 8G

031、软件包准备

yum groupinstall "Development Tools" -y #gcc, make etc.
yum install rsync jq -y

032、GoLang 环境

查看 kube-cross 的 TAG 版本号

cat ./build/build-image/cross/VERSION
v1.22.0-go1.16.15-buster.0
安装 Go 环境
# 这里下载go版本需要以 kube-cross 的 TAG 版本号 为准
wget -c https://golang.google.cn/dl/go1.16.15.linux-amd64.tar.gz
tar zxvf go1.16.15.linux-amd64.tar.gz -C /usr/local
# 编辑 / etc/profile 文件添加如下:
#go setting
export GOROOT=/usr/local/go
export GOPATH=/usr/local/gopath
export PATH=$PATH:$GOROOT/bin
#生效
source /etc/profile

验证

go version
go version go1.16.15 linux/amd64

033、编译

# 编译 kubeadm, 这里主要编译 kubeadm 即可
make all WHAT=cmd/kubeadm GOFLAGS=-v # 编译 kubelet
# make all WHAT=cmd/kubelet GOFLAGS=-v # 编译 kubectl
# make all WHAT=cmd/kubectl GOFLAGS=-v #编译完产物在 _output/bin/kubeadm 目录下,
#其中 bin 是使用了软连接
#真实路径是_output/local/bin/linux/amd64/kubeadm
mv /usr/bin/kubeadm /usr/bin/kubeadm_backup
cp _output/local/bin/linux/amd64/kubeadm /usr/bin/kubeadm
chmod +x /usr/bin/kubeadm

查看编译后的信息

kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.12", GitCommit:"b058e1760c79f46a834ba59bd7a3486ecf28237d", GitTreeState:"archive", BuildDate:"2022-12-07T02:57:53Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"}
在其他节点上替换原有版本
mv /usr/bin/kubeadm /usr/bin/kubeadm_bak
# 把编译后的kubeadm 拷贝到 /usr/bin/目录下

004、更新证书

如果是使用原版 kubeadm 安装之后,可以手动执行命令更新证书有效期到 100 年。

可以先备份证书,证书在 /etc/kubernetes/pki

检查证书到期时间

kubeadm certs check-expiration

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W1207 16:16:32.988622 198420 utils.go:69] The recommended value for "clusterCIDR" in "KubeProxyConfiguration" is: 10.101.18.0/24; the provided value is: 10.101.16.0/23 CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Nov 13, 2122 06:19 UTC 99y ca no
apiserver Nov 13, 2122 06:19 UTC 99y ca no
apiserver-etcd-client Nov 13, 2122 06:19 UTC 99y etcd-ca no
apiserver-kubelet-client Nov 13, 2122 06:19 UTC 99y ca no
controller-manager.conf Nov 13, 2122 06:19 UTC 99y ca no
etcd-healthcheck-client Nov 13, 2122 06:19 UTC 99y etcd-ca no
etcd-peer Nov 13, 2122 06:19 UTC 99y etcd-ca no
etcd-server Nov 13, 2122 06:19 UTC 99y etcd-ca no
front-proxy-client Nov 13, 2122 06:19 UTC 99y front-proxy-ca no
scheduler.conf Nov 13, 2122 06:19 UTC 99y ca no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Nov 13, 2122 06:19 UTC 99y no
etcd-ca Nov 13, 2122 06:19 UTC 99y no
front-proxy-ca Nov 13, 2122 06:19 UTC 99y no

续订证书

kubeadm certs renew all

再次查看证书有效期,全部都 100 年了

kubeadm certs check-expiration

005、疑问

A:node节点的kubeadm需不需要更新

为了防止留坑,master和node都更新掉

B:

C:什么时候更新证书

最好是在执行 Kubeadm join之前重新编译kubeadm,然后进行替换。替换后不用重启可以直接执行 kubeadm join 命令

参考文档

https://sysin.cn/blog/kubernetes-kubeadm-cert-100y/#3-2-2-GoLang-%E7%8E%AF%E5%A2%83

最新文章

  1. angularjs的简单应用(一)
  2. JS获取网页属性包括宽、高等
  3. html input type="button" 页面跳转
  4. 【 D3.js 进阶系列 — 2.1 】 力学图的事件 + 顶点的固定
  5. C语言库函数大全及应用实例九
  6. mysql关联删除
  7. 第三次冲刺spring会议(第六次会议)
  8. 理解用requireJs 来实现javascript的模块化加载
  9. angular高级篇之transclude使用详解
  10. 微服务架构之RPC-client序列化细节
  11. Compile C++ code in Matlab with OpenCV support
  12. 2017 百度杯丶二月场第一周WP
  13. 21天打造分布式爬虫-Spider类爬取糗事百科(七)
  14. 【CF526F】Pudding Monsters cdq分治
  15. vue中的路由高亮
  16. java基本数据类型的范围
  17. 【java】之Method和Field反射获取和设置属性值
  18. 实验 六:分析linux内核创建一个新进程的过程
  19. python3 web测试模块selenium
  20. linux,mac安装sentry

热门文章

  1. python与数值计算环境安装
  2. 如何使用ChatGPT来自动化Python任务
  3. 12、HSSFWorkbook实现多张sheet导出
  4. Web应用怎样获取Access Token?
  5. 用Java写一个分布式缓存——缓存管理
  6. Salesforce LWC学习(四十一) If:true 即将弃用?
  7. Node.js学习笔记----day05(MongonDB详情)
  8. 0基础搭建基于OpenAI的ChatGPT钉钉聊天机器人
  9. 连接KingbaseES异常,致命错误/ 用户"system" Password 认证失败(kbjdbc/autodetected server-encoding to be GB2312...)
  10. http八股 跨域的本质 请求行 请求头 请求体 xss