[经验交流] kubeadm 安装 kubernetes 一年过期的解决办法

kubeadm 是 kubernetes 提供的一个初始化集群的工具，使用起来非常方便。但是它创建的apiserver、controller-manager等证书默认只有一年的有效期，同时kubelet 证书也只有一年有效期，一年之后 kubernetes 将停止服务。官方推荐一年之内至少用 kubeadm upgrade 更新一次 kubernetes 系统，更新时也会自动更新证书。不过，在产线环境或者无法连接外网的环境频繁更新 kubernetes 不太现实。可以修改 kubeadm，让它初始化集群时创建10年或其它有效期的apiserver、controller-manager证书，同时配合kubelet证书自动轮换机制来解决这个问题。

转载注明原作者地址：http://www.cnblogs.com/hahp

本文适用于 kubernetes 1.9.X

1. 修补 kubeadm

下面是我的源代码补丁，请给所需要的 kubernetes 版本打上，然后重新编译 kubeadm，用新编译的 kubeadm 初始化集群：

diff -Nur kubernetes.orig/vendor/k8s.io/client-go/util/cert/cert.go kubernetes/vendor/k8s.io/client-go/util/cert/cert.go

--- kubernetes.orig/vendor/k8s.io/client-go/util/cert/cert.go    -- ::40.553612448 +

+++ kubernetes/vendor/k8s.io/client-go/util/cert/cert.go    -- ::48.301330560 +

@@ -, +, @@

         IPAddresses:  cfg.AltNames.IPs,

         SerialNumber: serial,

         NotBefore:    caCert.NotBefore,

-        NotAfter:     time.Now().Add(duration365d).UTC(),

+        NotAfter:     time.Now().Add(duration365d * ).UTC(),

         KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,

         ExtKeyUsage:  cfg.Usages,

     }

@@ -, +, @@

             CommonName: fmt.Sprintf("%s@%d", host, time.Now().Unix()),

         },

         NotBefore: time.Now(),

-        NotAfter:  time.Now().Add(time.Hour *  * ),

+        NotAfter:  time.Now().Add(time.Hour *  * ),

         KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,

         ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},

2. 自动轮换 kubelet 证书

注：kubelet证书分为server和client两种， k8s 1.9默认启用了client证书的自动轮换，但server证书自动轮换需要用户开启。方法是：

2.1 增加 kubelet 参数

--feature-gates=RotateKubeletServerCertificate=true

2.2 增加 controller-manager 参数

--experimental-cluster-signing-duration=87600h0m0s
--feature-gates=RotateKubeletServerCertificate=true

2.3 创建 rbac 对象

创建rbac对象，允许节点轮换kubelet server证书：

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  annotations:

    rbac.authorization.kubernetes.io/autoupdate: "true"

  labels:

    kubernetes.io/bootstrapping: rbac-defaults

  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeserver

rules:

- apiGroups:

  - certificates.k8s.io

  resources:

  - certificatesigningrequests/selfnodeserver

  verbs:

  - create

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: kubeadm:node-autoapprove-certificate-server

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeserver

subjects:

- apiGroup: rbac.authorization.k8s.io

  kind: Group

  name: system:nodes