Kubernetes kubeadm管理证书之续签证书

1
2
3
4
5
6
7
8
9
10
11
/etc/kubernetes/pki/apiserver.crt                #1年有效期
/etc/kubernetes/pki/front-proxy-ca.crt           #10年有效期
/etc/kubernetes/pki/ca.crt                       #10年有效期
/etc/kubernetes/pki/apiserver-etcd-client.crt    #1年有效期
/etc/kubernetes/pki/front-proxy-client.crt       #1年有效期
/etc/kubernetes/pki/etcd/server.crt              #1年有效期
/etc/kubernetes/pki/etcd/ca.crt                  #10年有效期
/etc/kubernetes/pki/etcd/peer.crt                #1年有效期
/etc/kubernetes/pki/etcd/healthcheck-client.crt  #1年有效期
/etc/kubernetes/pki/apiserver-kubelet-client.crt #1年有效期

1
2
3
4
5
6
7
8
9
10
11
12
# 方法1
kubeadm alpha certs check-expiration
# 方法2
openssl x509 -noout -dates -in /etc/kubernetes/pki/apiserver.crt
kubeadm alpha certs 命令详解：
Available Commands:
  certificate-key  生成证书和key
  check-expiration  检测证书过期时间
  renew            续订Kubernetes集群的证书

  kubeadm alpha certs命令仅支持v1.15及其以上的版本。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
[root@master-63 ~]# kubeadm alpha certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 May 22, 2021 15:26 UTC   327d                                    no      
apiserver                  May 22, 2021 15:26 UTC   327d            ca                      no      
apiserver-etcd-client      May 22, 2021 15:26 UTC   327d            etcd-ca                 no      
apiserver-kubelet-client   May 22, 2021 15:26 UTC   327d            ca                      no      
controller-manager.conf    May 22, 2021 15:26 UTC   327d                                    no      
etcd-healthcheck-client    May 22, 2021 15:26 UTC   327d            etcd-ca                 no      
etcd-peer                  May 22, 2021 15:26 UTC   327d            etcd-ca                 no      
etcd-server                May 22, 2021 15:26 UTC   327d            etcd-ca                 no      
front-proxy-client         May 22, 2021 15:26 UTC   327d            front-proxy-ca          no      
scheduler.conf             May 22, 2021 15:26 UTC   327d                                    no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      May 20, 2030 15:26 UTC   9y              no      
etcd-ca                 May 20, 2030 15:26 UTC   9y              no      
front-proxy-ca          May 20, 2030 15:26 UTC   9y              no      

1
2
3
4
5
6
[root@master-63 ~]# kubeadm  alpha certs renew apiserver
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

certificate for serving the Kubernetes API renewed

1
2
systemctl restart kubelet

1
2
3
4
kubeadm alpha certs renew apiserver --csr-only  --csr-dir /tmp/apiserver.csr
--csr-only：仅生成CSR。
--csr-dir：生成的CSR和私钥文件保存在哪里，默认保存在/etc/kubernetes/pki

1
2
3
root@k8s-master:~# ls /tmp/apiserver.csr/
apiserver.csr  apiserver.key

1
2
https://kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha/