如何处理 Kubeadm 搭建的集群证书过期问题

Kubeadm 证书过期处理

以下内容参考了如下链接：https://www.cnblogs.com/skymyyang/p/11093686.html

一、处理证书已过期的集群

使用 kubeadm 搭建的集群，默认证书有效期是 1 年。如果没有在证书过期前续期，那么集群会无法运行，使用的过程中会报如下错误：

x509: certificate has expired or is not yet valid.

查看当前 kubeadm 搭建的集群证书有效期信息，命令如下：

[@master74-53 ~]#  for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done
/etc/kubernetes/pki/apiserver.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 23 03:10:01 2020 GMT
-----------
/etc/kubernetes/pki/apiserver-etcd-client.crt
            Not Before: Oct 24 03:10:03 2019 GMT
            Not After : Oct 23 03:10:04 2020 GMT
-----------
/etc/kubernetes/pki/apiserver-kubelet-client.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 23 03:10:02 2020 GMT
-----------
/etc/kubernetes/pki/ca.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 21 03:10:01 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-ca.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 21 03:10:02 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-client.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 23 03:10:03 2020 GMT
-----------

可以看到证书的有效期是截止到 2020 年 10 月份，在证书过期后，使用如下步骤进行处理。

1. 针对 kubeadm 1.13.x 及以上版本

首先在服务器上创建一个 kubeadm.yaml 的文件，内容如下：

apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.16.2 				# 这里修改成集群对应的版本
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
#这里使用国内的镜像仓库，否则在重新签发的时候会报错：could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt"

将 /etc/kubernetes/pki 中的证书文件进行备份，然后使用如下命令重新生成证书：

[@master74-53 /opt]# kubeadm alpha certs renew all --config=/opt/kubeadm.yaml
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

运行命令后后重新生成如下证书文件：

#-- /etc/kubernetes/pki/apiserver.key
#-- /etc/kubernetes/pki/apiserver.crt

#-- /etc/kubernetes/pki/apiserver-etcd-client.key
#-- /etc/kubernetes/pki/apiserver-etcd-client.crt

#-- /etc/kubernetes/pki/apiserver-kubelet-client.key
#-- /etc/kubernetes/pki/apiserver-kubelet-client.crt

#-- /etc/kubernetes/pki/front-proxy-client.key
#-- /etc/kubernetes/pki/front-proxy-client.crt

#-- /etc/kubernetes/pki/etcd/healthcheck-client.key
#-- /etc/kubernetes/pki/etcd/healthcheck-client.crt

#-- /etc/kubernetes/pki/etcd/peer.key
#-- /etc/kubernetes/pki/etcd/peer.crt

#-- /etc/kubernetes/pki/etcd/server.key
#-- /etc/kubernetes/pki/etcd/server.crt

查看新生成的证书有效期：

[@master74-53 /opt]#  for i in /etc/kubernetes/pki/*.crt;do echo $i; openssl x509 -in $i -text -noout|egrep "Not Before|Not After";echo "-----------";done
/etc/kubernetes/pki/apiserver.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 26 06:41:43 2021 GMT
-----------
/etc/kubernetes/pki/apiserver-etcd-client.crt
            Not Before: Oct 24 03:10:03 2019 GMT
            Not After : Oct 26 06:41:44 2021 GMT
-----------
/etc/kubernetes/pki/apiserver-kubelet-client.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 26 06:41:44 2021 GMT
-----------
/etc/kubernetes/pki/ca.crt
            Not Before: Oct 24 03:10:01 2019 GMT
            Not After : Oct 21 03:10:01 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-ca.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 21 03:10:02 2029 GMT
-----------
/etc/kubernetes/pki/front-proxy-client.crt
            Not Before: Oct 24 03:10:02 2019 GMT
            Not After : Oct 26 06:41:46 2021 GMT
-----------

使用如下命令重新生成 kubeconfig 文件，否则 kubectl 将无法使用：

kubeadm init phase kubeconfig all

然后将新生成的文件拷贝到 ${HOME}/.kube 目录下并重命名为 config：

cp -pr /etc/kubernetes/admin.conf /root/.kube/config

重启 apiserver、kube-controller、kube-scheduler、etcd 容器即可。