Kubernetes---修改证书可用年限
Kubernetes 修改 --- 可用 证书
2023-09-11 14:18:14 时间
⒈查询证书可用时间
openssl x509 -in apiserver.crt -text -noout
*在Vallidity节点下
Kubernetes有两种机制去创建证书,有一部分是1年的,有1部分是10年的
⒉部署Go语言环境
Go中文社区:https://studygolang.com/dl
https://studygolang.com/dl/golang/go1.14.2.linux-amd64.tar.gz
https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz
wget https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz tar -zxvf go1.14.2.linux-amd64.tar.gz -C /usr/local vi /etc/profile export PATH=$PATH:/usr/local/go/bin source /etc/profile
go version
⒊下载源码
cd /data && git clone https://github.com/kubernetes/kubernetes.git cd kubernetes git checkout -b remotes/origin/release-1.15.1 v1.15.1 #切换当前版本(分支)
⒋修改 Kubeadm源码包更新证书策略
vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14 版本之前 vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今 const duration365d = time.Hour * 24 * 365 * 10 #设置为10年 NotAfter: time.Now().Add(duration365d).UTC(), #替换 make WHAT=cmd/kubeadm GOFLAGS=-v #设置只编译kubeadm cp _output/bin/kubeadm /root/kubeadm-new
⒌更新 kubeadm
#将kubeadm 进行替换 cp /usr/bin/kubeadm /usr/bin/kubeadm.old cp /root/kubeadm-new /usr/bin/kubeadm chmod a+x /usr/bin/kubeadm
⒍更新各节点证书至Master节点
cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old cd /etc/kubernetes/pki kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml openssl x509 -in apiserver.crt -text -noout | grep Not
⒎HA集群其余 mater节点证书更新
#!/bin/bash masterNode="192.168.66.20 192.168.66.21" #for host in ${masterNode}; do # scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} # "${USER}"@$host:/etc/kubernetes/pki/ # scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd # scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/ #done for host in ${CONTROL_PLANE_IPS}; do scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} "${USER}"@$host:/root/pki/ scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/ done
相关文章
- CPU: 在Docker和kubernetes的运用
- kubernetes:字段选择器(field-selector)标签选择器(labels-selector)和筛选 Kubernetes 资源
- Kubernetes资源对象:CustomResourceDefinition
- 课时 25:Kubernetes 网络模型进阶(叶磊)
- 课时 27:Kubernetes 安全之访问控制(匡大虎)
- kubernetes【网络】Kubernetes 三层网络方案
- Kubernetes CKS 2021--网络策略networkpolicy
- 快给你的Kubernetes集群建一个只读账户(防止高管。。。后)
- Kubernetes提供了另一种容器运行时
- kubernetes-核心资源之Ingress
- kubernetes 集群安装etcd集群,带证书