二十五、kubeamd安装方式的证书时间修改

如果更新k8s版本会默认更新证书
检查证书有效期（一部分10年一部分1年）
openssl x509 -in apiserver.crt -text -noout

1、go 环境部署

https://studygolang.com/dl
wget https://dl.google.com/go/go1.12.7.linux-amd64.tar.gz 
tar -zxvf go1.12.1.linux-amd64.tar.gz -C /usr/local 
mv go /usr/local/
vi /etc/profile 
export PATH=$PATH:/usr/local/go/bin 
source /etc/profile

2、下载源码

 git clone https://github.com/kubernetes/kubernetes.git 
kubeadm  version  #查看当前版本
[root@k8s-master kubernetes]# pwd
/root/kubernetes
git checkout -b remotes/origin/release-1.15.0 v1.15.0   #修改至当前版本

3、修改 Kubeadm 源码包更新证书策略

查看开发者手册
vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14 版本之前 
vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今 
搜索certTmpl  就在这个的上下
const duration3650d = time.Hour * 24 * 365 * 10       #表示一小时*24*365 表示10年
NotAfter: time.Now().Add(duration365d).UTC(),   #这一行在下面修改add的值就行

make WHAT=cmd/kubeadm GOFLAGS=-v         #只编译kubeadm
cp _output/bin/kubeadm /root/kubeadm-new 

更新 kubeadm

# 将 kubeadm 进行替换 
cp /usr/bin/kubeadm /usr/bin/kubeadm.old 
cp /root/kubeadm-new /usr/bin/kubeadm 
chmod a+x /usr/bin/kubeadm 

5、更新各节点证书至 Master 节点

cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old 
cd /etc/kubernetes/pki 
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml 
openssl x509 -in apiserver.crt -text -noout | grep Not

6、HA集群其余 mater 节点证书更新

#!/bin/bash 
masterNode="192.168.66.20 192.168.66.21" 
#for host in ${masterNode}; do 
# scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} 
"${USER}"@$host:/etc/kubernetes/pki/ 
# scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/etc/kubernetes/pki/etcd 
# scp /etc/kubernetes/admin.conf "root"@$host:/etc/kubernetes/ 
#done 
for host in ${CONTROL_PLANE_IPS}; do 
scp /etc/kubernetes/pki/{ca.crt,ca.key,sa.key,sa.pub,front-proxy-ca.crt,front-proxy-ca.key} 
"${USER}"@$host:/root/pki/ 
scp /etc/kubernetes/pki/etcd/{ca.crt,ca.key} "root"@$host:/root/etcd 
scp /etc/kubernetes/admin.conf "root"@$host:/root/kubernetes/ 
done