kubenetes证书过期更新

Kubenetes v1.11版本，二进制部署包证书过期更新；

1、检查当前证书情况：

[root@paas2 kubernetes]#  for item in `find /etc/kubernetes/ssl -maxdepth 2 -name "*.crt"`;do openssl x509 -in $item -text -noout| grep Not;echo ======================$item===================;done
            Not Before: Mar 31 02:20:17 2020 GMT
            Not After : Mar 31 02:20:17 2021 GMT
======================/etc/kubernetes/ssl/kubelet.crt===================

当前证书已过期，目前集群整体状态所有节点都出现NotReady状态

[root@paas1 kubernetes]# kubectl get no
NAME              STATUS     ROLES     AGE       VERSION
172.10.32.11      NotReady      master    364d      v1.11.1
172.10.32.12      NotReady      master    364d      v1.11.1
172.10.32.16      NotReady      node      343d      v1.11.1
172.10.32.17      NotReady      node      343d      v1.11.1
172.10.32.18      NotReady      node      364d      v1.11.1

k8s配置信息的工作目录一般为/etc/kubernetes，证书目录一般为/etc/kubernetes/ssl。

2.备份文件,在单台master进行操作

    [root@paas1 kubernetes]# cd /etc/kubernetes
    [root@paas1 kubernetes]# cp kubelet.kubeconfig kubelet.kubeconfig.bak
    [root@paas1 kubernetes]# mkdir sslbak && cp ssl/ sslbak

3.清理原有证书及配置文件

[root@paas1 kubernetes]# rm -f kubelet.kubeconfig
[root@paas1 kubernetes]# rm ssl/kubelet.*

4.重启kubelet

[root@paas1 ]# systemctl  restart kubelet && systemctl  status  kubelet

5.使用csr重新生成证书

[root@paas1 ~]# kubectl get csr
NAME                                    AGE       REQUESTOR           CONDITION
node-csr-JR1Zepcp2p-gk                  1h        kubelet-bootstrap    Pending

#获取到的csr若为node-csr-JR1Zepcp2p-gk
[root@paas1 ~]# kubectl certificate approve node-csr-JR1Zepcp2p-gk

[root@paas1 ~]# kubectl get csr
NAME                                    AGE       REQUESTOR           CONDITION
node-csr-JR1Zepcp2p-gk                  1h        kubelet-bootstrap   Approved,Issued

6.处理完master后对其他master和node进行修改

 [root@node kubernetes]# cd /etc/kubernetes
 [root@node kubernetes]# rm ssl/kubelet.*
 [root@node kubernetes]# systemctl  restart kubelet && systemctl  status  kubelet

7.对node请求过来的新证书处理

[root@paas1 ~]# kubectl get csr
NAME                                   AGE       REQUESTOR           CONDITION
node-csr-JR1Zepcp2p-gk                  1h        kubelet-bootstrap   Approved,Issued
node-csr-JR1Zdaddaf-da                  1h        kubelet-bootstrap   Pending
node-csr-hEpAQi9zW3-dd                  1h        kubelet-bootstrap   Pending

#获取到的csr中Pending状态全部激活
[root@paas1 ~]# kubectl certificate approve node-csr-JR1Zdaddaf-da
[root@paas1 ~]# kubectl certificate approve node-csr-hEpAQi9zW3-dd

#检查激活后的各个证书情况
[root@paas1 ~]# kubectl get csr
NAME                                   AGE       REQUESTOR           CONDITION
node-csr-JR1Zepcp2p-gk                  1h        kubelet-bootstrap   Approved,Issued
node-csr-JR1Zdaddaf-da                  1h        kubelet-bootstrap   Approved,Issued
node-csr-hEpAQi9zW3-dd                  1h        kubelet-bootstrap   Approved,Issued

8.证书替换完成后检查集群状态

[root@paas1 kubernetes]# kubectl get no
NAME              STATUS    ROLES     AGE       VERSION
172.10.32.11      Ready     master    364d      v1.11.1
172.10.32.12      Ready     master    364d      v1.11.1
172.10.32.16      Ready     node      343d      v1.11.1
172.10.32.17      Ready     node      343d      v1.11.1
172.10.32.18      Ready     node      364d      v1.11.1

集群状态恢复，之后检查各个node上的证书时间

[root@paas1 ~]# for item in `find /etc/kubernetes/ssl -maxdepth 2 -name "*.crt"`;do openssl x509 -in $item -text -noout| grep Not;echo ======================$item===================;done
            Not Before: Mar 31 04:36:34 2021 GMT
            Not After : Mar 31 04:36:34 2022 GMT
======================/etc/kubernetes/ssl/kubelet.crt===================

再次检查发现证书时间已更新。

以上就是针对二进制部署kubenetes的证书过期的完整操作。