使
用sealos安装的1.31版本的集群，发现super-admin证书为1年，手动更换kubeadmin文件，首先需要准备go环境，yum -y install go，建议下载1.2以上版本的go

场景一：如果你是在第一天部署集群（kubeadm init），此时集群还不存在，没有 ConfigMap。

• 此时必须修改源码并编译，否则 kubeadm init 生成的证书默认就是 1 年。

#下载go环境，编译依赖

[root@openclaw kubernetes]# yum -y install go  rsync

#下载kubernetes源码项目，并切换对应版本，进入源码目录

[root@openclaw kubernetes]# git clone https://github.com/kubernetes/kubernetes.git
[root@openclaw kubernetes]# git checkout v1.31.0

[root@openclaw kubernetes]# cd kubernetes

#修改源码文件 staging/src/k8s.io/client-go/util/cert/cert.go 

[root@openclaw kubernetes]# cd kubernetes 
[root@openclaw kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go 

#找到 CertificateValidity 常量，将：

CertificateValidity = time.Hour * 24 * 365

改为：

CertificateValidity = time.Hour * 24 * 365 * 100

 #修改完成之后开始编译

[root@openclaw kubernetes]#  make all WHAT=cmd/kubeadm GOFLAGS=-v

完成之后可以看到新编译的kubeadm文件，目录在kubernetes/_output/local/bin/linux/amd64中

[root@openclaw sealos]# ll kubernetes/_output/local/bin/linux/amd64/kubeadm
-rwxr-xr-x 1 root root 58290328 Aug  6 11:16 kubeadm

再把新生成的文件替换掉原来的kubeadm文件，并加上可执行权限,再次查询证书情况

[root@openclaw sealos]# cp kubernetes/_output/local/bin/linux/amd64/kubeadm /usr/bin/kubeadm 
cp: overwrite '/usr/bin/kubeadm'? yes

root@ecs-7678-0225260 sealos]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W0806 13:31:53.889378   46264 utils.go:69] The recommended value for "healthzBindAddress" in "KubeletConfiguration" is: 127.0.0.1; the provided value is: 0.0.0.0

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 13, 2126 03:54 UTC   99y             ca                      no      
apiserver                  Jul 13, 2126 03:54 UTC   99y             ca                      no      
apiserver-etcd-client      Jul 13, 2126 03:54 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Jul 13, 2126 03:54 UTC   99y             ca                      no      
controller-manager.conf    Jul 13, 2126 03:54 UTC   99y             ca                      no      
etcd-healthcheck-client    Jul 13, 2126 03:54 UTC   99y             etcd-ca                 no      
etcd-peer                  Jul 13, 2126 03:54 UTC   99y             etcd-ca                 no      
etcd-server                Jul 13, 2126 03:54 UTC   99y             etcd-ca                 no      
front-proxy-client         Jul 13, 2126 03:54 UTC   99y             front-proxy-ca          no      
scheduler.conf             Jul 13, 2126 03:54 UTC   99y             ca                      no      
super-admin.conf           Jul 13, 2126 03:54 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 13, 2126 02:35 UTC   99y             no      
etcd-ca                 Jul 13, 2126 02:35 UTC   99y             no      
front-proxy-ca          Jul 13, 2126 02:35 UTC   99y             no      

如果还是没有改过来，尝试直接修改 /etc/kubernetes/kubeadm-config.yaml

目录

场景一：如果你是在第一天部署集群（kubeadm init），此时集群还不存在，没有 ConfigMap。

---

对于已经运行的集群，kubeadm 的逻辑是：

1. 读取 /etc/kubernetes/kubeadm-config.yaml（如果存在）。
2. 读取集群里的 kube-system/kubeadm-config ConfigMap。
3. 如果配置里有 certificateValidityPeriod 字段，优先使用这个值。
4. 如果配置里没有这个字段，才使用二进制文件里的默认值。

kubectl -n kube-system edit cm kubeadm-config

#找到
    caCertificateValidityPeriod: 87600h0m0s
    certificateValidityPeriod: 87600h0m0s
修改为
    caCertificateValidityPeriod: 876000h0m0s
    certificateValidityPeriod: 876000h0m0s
#续订证书

kubeadm certs renew all
#检查就可以了
 kubeadm certs check-expiration

[root@ecs-7678-0225260 sealos]#  kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
W0806 13:55:37.888120   51752 cluster.go:96] error unmarshaling configuration schema.GroupVersionKind{Group:"kubeadm.k8s.io", Version:"v1beta4", Kind:"ClusterConfiguration"}: time: invalid duration "8760000h0m0s"
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 13, 2126 05:52 UTC   99y             ca                      no      
apiserver                  Jul 13, 2126 05:52 UTC   99y             ca                      no      
apiserver-etcd-client      Jul 13, 2126 05:52 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Jul 13, 2126 05:52 UTC   99y             ca                      no      
controller-manager.conf    Jul 13, 2126 05:52 UTC   99y             ca                      no      
etcd-healthcheck-client    Jul 13, 2126 05:52 UTC   99y             etcd-ca                 no      
etcd-peer                  Jul 13, 2126 05:52 UTC   99y             etcd-ca                 no      
etcd-server                Jul 13, 2126 05:52 UTC   99y             etcd-ca                 no      
front-proxy-client         Jul 13, 2126 05:52 UTC   99y             front-proxy-ca          no      
scheduler.conf             Jul 13, 2126 05:52 UTC   99y             ca                      no      
super-admin.conf           Jul 13, 2126 05:52 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 13, 2126 02:35 UTC   99y             no      
etcd-ca                 Jul 13, 2126 02:35 UTC   99y             no      
front-proxy-ca          Jul 13, 2126 02:35 UTC   99y             no