Kubernetes 编译 kubeadm 修改证书有效期到 100 年

前言

kubeadm 生成的客户端证书在 1 年后到期。过期后，会导致服务不可用，使用过程中会出现：x509: certificate has expired or is not yet valid.

默认情况下，kubeadm 会生成运行一个集群所需的全部证书。但要使用自定义的证书，需要生成各个组件的证书，所以直接修改 kubeadm 源码，将证书的时间延长为100年。

获取源码

下载特定版本源码：https://github.com/kubernetes/kubernetes/releases

或者 git 获取，切换到指定版本

# 查看当前分支
git branch
# 查看所有分支
git tag -l

#切换至1.14.1分支
git checkout v1.14.1
#切换到1.20.8分支
git checkout v1.20.8

git clone https://github.com/kubernetes/kubernetes.git

git checkout -b remotes/origin/release-1.23 v1.23.17

修改源码

修改 CA 有效期为 100 年

vim ./staging/src/k8s.io/client-go/util/cert/cert.go

// 这个方法里面 NotAfter:              now.Add(duration365d * 10).UTC()
// 默认有效期就是 10 年，改成 100 年 (sysin)
// 输入 /NotAfter 查找，回车定位
func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
        now := time.Now()
        tmpl := x509.Certificate{
                SerialNumber: new(big.Int).SetInt64(0),
                Subject: pkix.Name{
                        CommonName:   cfg.CommonName,
                        Organization: cfg.Organization,
                },
                NotBefore:             now.UTC(),
                // NotAfter:              now.Add(duration365d * 10).UTC(),
                NotAfter:              now.Add(duration365d * 100).UTC(),
                KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
                BasicConstraintsValid: true,
                IsCA:                  true,
        }

        certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key)
        if err != nil {
                return nil, err
        }
        return x509.ParseCertificate(certDERBytes)
}

修改证书有效期为 100 年

vim ./cmd/kubeadm/app/constants/constants.go

// 就是这个常量定义 CertificateValidity，改成 * 100 年 (sysin)
// 输入 /CertificateValidity 查找，回车定位
const (
        // KubernetesDir is the directory Kubernetes owns for storing various configuration files
        KubernetesDir = "/etc/kubernetes"
        // ManifestsSubDirName defines directory name to store manifests
        ManifestsSubDirName = "manifests"
        // TempDirForKubeadm defines temporary directory for kubeadm
        // should be joined with KubernetesDir.
        TempDirForKubeadm = "tmp"

        // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
        // CertificateValidity = time.Hour * 24 * 365
        CertificateValidity = time.Hour * 24 * 365 * 100

        // CACertAndKeyBaseName defines certificate authority base name
        CACertAndKeyBaseName = "ca"
        // CACertName defines certificate name
        CACertName = "ca.crt"
        // CAKeyName defines certificate name
        CAKeyName = "ca.key"

本地编译kubeadm

更新linux编译环境

CentOS：

yum groupinstall "Development Tools" -y #gcc, make etc.
yum install rsync jq -y

Ubuntu：

sudo apt install build-essential #(Following command will install essential commands like gcc, make etc.)
sudo apt install rsync jq -y

安装go环境

或者从这里下载go源码包：https://studygolang.com/dl

wget https://dl.google.com/go/go1.22.linux-amd64.tar.gz
## 或者
# wget https://golang.google.cn/dl/go1.22.linux-amd64.tar.gz
tar zxvf go1.22.linux-amd64.tar.gz  -C /usr/local

# 编辑 / etc/profile 文件添加如下：
export GOROOT=/usr/local/go
export GOPATH=/usr/local/gopath
export PATH=$PATH:$GOROOT/bin

#使环境变量生效
#source /etc/profile

# 这里一次性编译，直接执行如下命令即可
export PATH=$PATH:/usr/local/go/bin

验证：

go version
# 输出如下
go version go1.22 linux/amd64

编译

编译kubeadm

make WHAT=cmd/kubeadm GOFLAGS=-v

编译kubelet

make all WHAT=cmd/kubelet GOFLAGS=-v

编译kubectl

make all WHAT=cmd/kubectl GOFLAGS=-v

编译生成的二进制文件在 _output/bin/ 目录下

查看编译后的版本信息

kubeadm version

替换kubeadm，更新证书

# 将kubeadm 文件拷贝替换系统中原有kubeadm
cp /usr/bin/kubeadm /usr/bin/kubeadm_bak
cp _output/bin/kubeadm /usr/bin/kubeadm

# 备份kube-master节点证书
cp -r /etc/kubernetes/pki /etc/kubernetes/pki_bak

检查证书到期时间

kubeadm certs check-expiration

# 早期版本 (1.19 及之前版本) 命令如下，kubeadm alpha certs 命令 1.20 开始废弃，kubeadm alpha 命令 1.21 开始彻底废弃
kubeadm alpha certs check-expiration

续订全部证书

kubeadm certs renew all

再次查看证书有效期，全部都 100 年了

kubeadm certs check-expiration

k8s v1.19版本之后，自签证书过期x509: certificate has expired or is not yet valid

k8s v1.16.3，Unable to connect to the server: x509: certificate has expired or is not yet valid