K8s修改api-server证书为10年
api-server如何修改证书的年限
·
一，查看证书年限
1，查看k8s所有证书
/etc/kubernetes/pki
2,查看证书的年限
一年期的证书
(base) [root@node1 pki]# openssl x509 -in apiserver.crt -text -noout
Not Before: Nov 8 12:40:23 2022 GMT
Not After : Nov 8 12:40:23 2023 GMT
十年期的证书
(base) [root@node1 pki]# openssl x509 -in ca.crt -text -noout
Not Before: Nov 8 12:40:23 2022 GMT
Not After : Nov 5 12:40:23 2032 GMT
二，调整api-server证书年限为10年
1,浏览器访问以下链接下载go语言环境
https://studygolang.com/dl linux包
2，解压到/usr/local目录下
tar -xvf go1.19.3.linux-amd64.tar.gz -C /usr/local
3，
配置并刷新环境变量
vim /etc/profile
export PATH=$PATH:/usr/local/go/bin
source /etc/profile
验证：
go version
go version go1.19.3 linux/amd64
4,安装git，使用git进行克隆,
创建一个data目录，切换到data目录下
mkdir -p /data && /data
克隆
git clone https://github.com/kubernetes/kubernetes.git
如果报错，则设置参数多试几次
git config --global http.postBuffer 100M
5，切换版本
查看当前版本
kubeadm version
切换版本分支
git checkout -b remotes/origin/release-1.20.4 v1.20.4
###切换到一个新分支 'remotes/origin/release-1.20.4'
如果报错fatal: Not a git repository (or any of the parent directories): .git
则执行git init
6，版本在1.14以后用一下命令创建
vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go
在里面添加一行
const duration3650d = time.Hour * 24 * 365 * 10
time.Now().Add(duration3650d).UTC(),
7,编译kubeadm
make WHAT=cmd/kubeadm GOFLAGS=-v
8，备份文件
cp _output/bin/kubeadm /root/
mv /usr/bin/kubeadm /usr/bin/kubeadm.bak
cp kubeadm /usr/bin/
chmod a+x /usr/bin/kubeadm
cd /etc/kubernetes/
cp -r ski/ ski.old
9.重新生成证书
cd /~
kubeadmin alpha certs renew all --config=/usr/local/install-k8s/core/kubeadm-config.yaml
Command "all" is deprecated, please use the same command under "kubeadm certs"
W1206 11:33:48.179839 895 utils.go:69] The recommended value for "clusterDNS" in "KubeletConfiguration" is: [10.233.0.10]; the provided value is: [169.254.25.10]
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
10,查看证书年限
cd /etc/kubernetes/pki && openssl x509 -in apiserver.crt -text -noout
K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容
更多推荐
0
0- 0
已为社区贡献1条内容
所有评论(0)