kubernetes证书过期处理

rancher中文文档：http://docs.rancher.cn/

k8s中文文档：https://kubernetes.io/zh/docs

一、修改kubeadm 源码 增加证书到100年

$ git clone https://github.com/kubernetes/kubernetes.git

$ cd kubernetes

# 编辑源码

$ git checkout release-1.15
$ vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go
$ git diff
--- a/cmd/kubeadm/app/util/pkiutil/pki_helpers.go
+++ b/cmd/kubeadm/app/util/pkiutil/pki_helpers.go
@@ -571,7 +571,7 @@ func NewSignedCert(cfg *certutil.Config, key crypto.Signer, caCert *x509.Certifi
  IPAddresses: cfg.AltNames.IPs,
  SerialNumber: serial,
  NotBefore: caCert.NotBefore,

- NotAfter: time.Now().Add(kubeadmconstants.CertificateValidity).UTC(),

+ NotAfter: time.Now().Add(kubeadmconstants.CertificateValidity * 100).UTC(),
  KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
  ExtKeyUsage: cfg.Usages,

# 编译二进制

$ go version
go version go1.12.7 linux/amd64
$ go build ./cmd/kubeadm

# 使用二进制更新证书

$ ./kubeadm alpha certs renew all
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healtcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

查看证书

cd /etc/kubernetes/pki

openssl x509 -in front-proxy-client.crt   -noout -text  |grep Not
            Not Before: Nov 28 09:07:02 2018 GMT
            Not After : Nov 25 09:07:03 2028 GMT

openssl x509 -in apiserver.crt   -noout -text  |grep Not
            Not Before: Nov 28 09:07:04 2018 GMT
            Not After : Nov 25 09:07:04 2028 GMT

参考：https://blog.csdn.net/xianjuke008/article/details/106107618/

二、集群证书过期处理

cp -rp /etc/kubernetes /etc/kubernetes.bak
./kubeadm alpha certs renew all
docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' |xargs docker restart
mv /root/.kube/config /root/.kube/config_old
cp /etc/kubernetes/admin.conf /root/.kube/config
#查看证书到期时间
kubeadm alpha certs check-expiration

三、rancher更新证书

见 ： https://www.cnblogs.com/jerry-0910/p/15379813.html

四、rancher证书过期处理

见：http://docs.rancher.cn/docs/rancher2/cluster-admin/certificate-rotation/_index/#升级较旧的-rancher-版本后轮换过期的证书