如何处理 Kubeadm 搭建的集群证书过期问题

深碍√TFBOYSˉ_ 2022-12-19 09:25 100阅读 0赞

> ### 推荐阅读 ###
> 
> ##### Helm3（K8S 资源对象管理工具）视频教程：[https://edu.csdn.net/course/detail/32506][https_edu.csdn.net_course_detail_32506] #####
> 
> ##### Helm3（K8S 资源对象管理工具）博客专栏：[https://blog.csdn.net/xzk9381/category\_10895812.html][https_blog.csdn.net_xzk9381_category_10895812.html] #####

> [本文原文链接：https://blog.csdn.net/xzk9381/article/details/109535894，转载请注明出处。如有发现文章中的任何问题，欢迎评论区留言。][https_blog.csdn.net_xzk9381_article_details_109535894]

## Kubeadm 证书过期处理 ##

以下内容参考了如下链接：https://www.cnblogs.com/skymyyang/p/11093686.html

### 一、处理证书已过期的集群 ###

使用 kubeadm 搭建的集群，默认证书有效期是 1 年。如果没有在证书过期前续期，那么集群会无法运行，使用的过程中会报如下错误：

> x509: certificate has expired or is not yet valid.

查看当前 kubeadm 搭建的集群证书有效期信息，命令如下：

[@master74-53 ~]# for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done
    /etc/kubernetes/pki/apiserver.crt
                Not Before: Oct 24 03:10:01 2019 GMT
                Not After : Oct 23 03:10:01 2020 GMT
    -----------
    /etc/kubernetes/pki/apiserver-etcd-client.crt
                Not Before: Oct 24 03:10:03 2019 GMT
                Not After : Oct 23 03:10:04 2020 GMT
    -----------
    /etc/kubernetes/pki/apiserver-kubelet-client.crt
                Not Before: Oct 24 03:10:01 2019 GMT
                Not After : Oct 23 03:10:02 2020 GMT
    -----------
    /etc/kubernetes/pki/ca.crt
                Not Before: Oct 24 03:10:01 2019 GMT
                Not After : Oct 21 03:10:01 2029 GMT
    -----------
    /etc/kubernetes/pki/front-proxy-ca.crt
                Not Before: Oct 24 03:10:02 2019 GMT
                Not After : Oct 21 03:10:02 2029 GMT
    -----------
    /etc/kubernetes/pki/front-proxy-client.crt
                Not Before: Oct 24 03:10:02 2019 GMT
                Not After : Oct 23 03:10:03 2020 GMT
    -----------

可以看到证书的有效期是截止到 2020 年 10 月份，在证书过期后，使用如下步骤进行处理。

#### 1. 针对 kubeadm 1.13.x 及以上版本 ####

首先在服务器上创建一个 kubeadm.yaml 的文件，内容如下：

apiVersion: kubeadm.k8s.io/v1beta1
    kind: ClusterConfiguration
    kubernetesVersion: v1.16.2 				# 这里修改成集群对应的版本
    imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers 
    #这里使用国内的镜像仓库，否则在重新签发的时候会报错：could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt"

将 /etc/kubernetes/pki 中的证书文件进行备份，然后使用如下命令重新生成证书：

[@master74-53 /opt]# kubeadm alpha certs renew all --config=/opt/kubeadm.yaml
    certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
    certificate for serving the Kubernetes API renewed
    certificate the apiserver uses to access etcd renewed
    certificate for the API server to connect to kubelet renewed
    certificate embedded in the kubeconfig file for the controller manager to use renewed
    certificate for liveness probes to healthcheck etcd renewed
    certificate for etcd nodes to communicate with each other renewed
    certificate for serving etcd renewed
    certificate for the front proxy client renewed
    certificate embedded in the kubeconfig file for the scheduler manager to use renewed

运行命令后后重新生成如下证书文件：

#-- /etc/kubernetes/pki/apiserver.key
    #-- /etc/kubernetes/pki/apiserver.crt
    
    #-- /etc/kubernetes/pki/apiserver-etcd-client.key
    #-- /etc/kubernetes/pki/apiserver-etcd-client.crt
    
    #-- /etc/kubernetes/pki/apiserver-kubelet-client.key
    #-- /etc/kubernetes/pki/apiserver-kubelet-client.crt
    
    #-- /etc/kubernetes/pki/front-proxy-client.key
    #-- /etc/kubernetes/pki/front-proxy-client.crt
    
    #-- /etc/kubernetes/pki/etcd/healthcheck-client.key
    #-- /etc/kubernetes/pki/etcd/healthcheck-client.crt
    
    #-- /etc/kubernetes/pki/etcd/peer.key
    #-- /etc/kubernetes/pki/etcd/peer.crt
    
    #-- /etc/kubernetes/pki/etcd/server.key
    #-- /etc/kubernetes/pki/etcd/server.crt

查看新生成的证书有效期：

[@master74-53 /opt]# for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done
    /etc/kubernetes/pki/apiserver.crt
                Not Before: Oct 24 03:10:01 2019 GMT
                Not After : Oct 26 06:41:43 2021 GMT
    -----------
    /etc/kubernetes/pki/apiserver-etcd-client.crt
                Not Before: Oct 24 03:10:03 2019 GMT
                Not After : Oct 26 06:41:44 2021 GMT
    -----------
    /etc/kubernetes/pki/apiserver-kubelet-client.crt
                Not Before: Oct 24 03:10:01 2019 GMT
                Not After : Oct 26 06:41:44 2021 GMT
    -----------
    /etc/kubernetes/pki/ca.crt
                Not Before: Oct 24 03:10:01 2019 GMT
                Not After : Oct 21 03:10:01 2029 GMT
    -----------
    /etc/kubernetes/pki/front-proxy-ca.crt
                Not Before: Oct 24 03:10:02 2019 GMT
                Not After : Oct 21 03:10:02 2029 GMT
    -----------
    /etc/kubernetes/pki/front-proxy-client.crt
                Not Before: Oct 24 03:10:02 2019 GMT
                Not After : Oct 26 06:41:46 2021 GMT
    -----------

使用如下命令重新生成 kubeconfig 文件，否则 kubectl 将无法使用：

kubeadm init phase kubeconfig all

然后将新生成的文件拷贝到 `${HOME}/.kube` 目录下并重命名为 `config`：

cp -pr /etc/kubernetes/admin.conf /root/.kube/config

重启 apiserver、kube-controller、kube-scheduler、etcd 容器即可。

[https_edu.csdn.net_course_detail_32506]: https://edu.csdn.net/course/detail/32506
[https_blog.csdn.net_xzk9381_category_10895812.html]: https://blog.csdn.net/xzk9381/category_10895812.html
[https_blog.csdn.net_xzk9381_article_details_109535894]: https://blog.csdn.net/xzk9381/article/details/109535894