由于默认的证书期限为1年，某些环境虽然能够触发更新策略，但由于处于内网无法连接外网更新证书，很影响使用！

以下为kubeadm安装环境，并修改其证书时间步骤

前期准备工作，提前在联网电脑下载好所需包

1.部署go环境

Go下载 - Go语言中文网 - Golang中文社区

mkdir /date

cd /date

wget https://studygolang.com/dl/golang/go1.18.3.linux-amd64.tar.gz

tar zxvf go1.18.3.linux-amd64.tar.gz -C /usr/local

vim /etc/profile

   export PATH=$PATH:/usr/local/go/bin

source /etc/profile
​

2、下载k8s源码

#下载源码

git clone https://github.com/kubernetes/kubernetes.git

#查看自己环境的版本信息

kubectl version

#切换对应版本源码分支

git checkout -b remotes/origin/release-1.18.0 v1.18.0

3、修改源码的更新证书策略

# 修改时长，“* 100”

vim kubernetes/cmd/kubeadm/app/constants/constants.go

    CertificateValidity = time.Hour * 24 * 365 * 100

cd kubernetes

#重新编译源码

make WHAT=cmd/kubeadm

4、备份原有的证书，并更新新证书

#备份原有的kubeadm，替换新的
mv /usr/bin/kubeadm /usr/bin/kubeadm.bak
cp kubernetes/_output/bin/kubeadm /usr/bin/

#备份原有证书，重新生成新证书
cp -r /etc/kubernetes/pki /etc/kubernetes/pki_bak
cd /etc/kubernetes/pki/
kubeadm alpha certs renew all

#查看证书时间，已经修改
kubeadm alpha certs check-expiration

#######################################################################
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 May 27, 2122 02:59 UTC   99y                                     no      
apiserver                  May 27, 2122 02:59 UTC   99y             ca                      no      
apiserver-etcd-client      May 27, 2122 02:59 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   May 27, 2122 02:59 UTC   99y             ca                      no      
controller-manager.conf    May 27, 2122 02:59 UTC   99y                                     no      
etcd-healthcheck-client    May 27, 2122 02:59 UTC   99y             etcd-ca                 no      
etcd-peer                  May 27, 2122 02:59 UTC   99y             etcd-ca                 no      
etcd-server                May 27, 2122 02:59 UTC   99y             etcd-ca                 no      
front-proxy-client         May 27, 2122 02:59 UTC   99y             front-proxy-ca          no      
scheduler.conf             May 27, 2122 02:59 UTC   99y                                     no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jun 05, 2032 09:22 UTC   9y              no      
etcd-ca                 Jun 05, 2032 09:22 UTC   9y              no      
front-proxy-ca          Jun 05, 2032 09:22 UTC   9y              no  
#####################################################################