当前位置：首页 > 文章中心 > 正文内容

Kubernetes(k8s)-创建永久(100年)证书

dgx6663个月前 (03-12)文章中心28

Kubernetes 是一个用于自动化容器化应用程序部署、扩展和管理的开源平台。它提供了一种容器编排的方式，可以自动管理应用程序的部署、伸缩、负载均衡和容错等任务。 Kubernetes 基于容器技术，特别是 Docker，它使用容器作为应用程序和服务的基本构建块。通过 Kubernetes，用户可以轻松地定义和部署容器化应用程序，并通过集群来管理和编排这些容器。Kubernetes提供了多种安装方式，可以根据自己的需求和实际情况选择合适的方式，这里采用kubeadm方式来部署集群，kubeadm安装集群里面涉及到的证书，有的有效期是10年，有的有效期是1年，而且除了根证书是10年，实际业务使用的证书都是1年.

1.查看当前证书情况

[root@node1 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Feb 19, 2026 08:13 UTC   364d            ca                      no      
apiserver                  Feb 19, 2026 08:13 UTC   364d            ca                      no      
apiserver-etcd-client      Feb 19, 2026 08:13 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Feb 19, 2026 08:13 UTC   364d            ca                      no      
controller-manager.conf    Feb 19, 2026 08:13 UTC   364d            ca                      no      
etcd-healthcheck-client    Feb 19, 2026 08:13 UTC   364d            etcd-ca                 no      
etcd-peer                  Feb 19, 2026 08:13 UTC   364d            etcd-ca                 no      
etcd-server                Feb 19, 2026 08:13 UTC   364d            etcd-ca                 no      
front-proxy-client         Feb 19, 2026 08:13 UTC   364d            front-proxy-ca          no      
scheduler.conf             Feb 19, 2026 08:13 UTC   364d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Feb 17, 2035 08:13 UTC   9y              no      
etcd-ca                 Feb 17, 2035 08:13 UTC   9y              no      
front-proxy-ca          Feb 17, 2035 08:13 UTC   9y              no      
[root@node1 ~]#

这个图里面显示的证书包括3个ca证书，3个etcd证书，3个apiserver证书，一个kubectl证书，一个controller-manager证书，一个scheduler证书，一个proxy启用代理证书。这里的证书到期以后就不可用，不具有自动续签的能力，kubelet证书该如何查看呢？

[root@node1 ~]# openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -text |grep Validity -A2
        Validity
            Not Before: Feb 19 08:13:41 2025 GMT
            Not After : Feb 19 08:13:46 2026 GMT

更进一步进入目录发现，这个文件其实是个软连接，连接文件本目录下一个带有时间戳的文件，这个时间戳上的时间，实际上就是证书的生成时间，有效期就在这个生成时间加上一年时间。

2.证书续期

[root@node1 pki]#  kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
[root@node1 pki]#

通过以上命令，我们可以一键续期除kubelet外的所有证书，根证书不会续期。我们也可以手工续期某一个组件，只需要把最后的证书更换成为对应的证书名字即可。

 kubeadm certs renew scheduler.conf

证书续期以后，当前应用程序还需要重启才会生效。

但是有没有什么方法可以在创建集群的时候就提供更长的证书时间呢？很遗憾，kubeadm并没有给我们提供这样的参数，这个计算逻辑在Kubeadm的源代码里面，所以只能修改源代码来实现。

准备工作

1.服务器安装go环境go环境需要大于1.17，否则会报错，这里用的是1.23

[root@node1 ~]# cd /usr/local
[root@node1 local]#  wget https://golang.google.cn/dl/go1.23.4.linux-amd64.tar.gz
--2025-02-19 16:25:02--  https://golang.google.cn/dl/go1.23.4.linux-amd64.tar.gz
Resolving golang.google.cn (golang.google.cn)... 114.250.64.34, 2401:3800:4001:14::1002
Connecting to golang.google.cn (golang.google.cn)|114.250.64.34|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://dl.google.com/go/go1.23.4.linux-amd64.tar.gz [following]
--2025-02-19 16:25:03--  https://dl.google.com/go/go1.23.4.linux-amd64.tar.gz
Resolving dl.google.com (dl.google.com)... 114.250.65.33
Connecting to dl.google.com (dl.google.com)|114.250.65.33|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 73645095 (70M) [application/x-gzip]
Saving to: ‘go1.23.4.linux-amd64.tar.gz.1’

100%[================================================================================================================================================================>] 73,645,095  38.3MB/s   in 1.8s   

2025-02-19 16:25:05 (38.3 MB/s) - ‘go1.23.4.linux-amd64.tar.gz.1’ saved [73645095/73645095]
[root@node1 local]#  tar -zxvf go1.23.4.linux-amd64.tar.gz
##添加到环境变量中
[root@node1 local]# cat /root/.bash_profile 
# .bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
	. ~/.bashrc
fi

# User specific environment and startup programs
PATH=$PATH:$HOME/bin:/usr/local/go/bin/

export PATH

    ##source使其立即生效
    [root@node1 local]# source /root/.bash_profile

2.服务器安装git命令

[root@node1 local]#  yum -y install git

3.修改代码

下载代码

[root@node1 ~]# git clone --depth 1 -b v1.23.12 https://github.com/kubernetes/kubernetes.git
[root@node1 ~]# cd kubernetes-1.23.12
备注:
这里演示的环境操作系统版本为:Red Hat Enterprise Linux Server release 7.9 (Maipo)
使用el7的yum安装的话只能安装到1.28.2的版本，这里演示使用的是1.23.12版本.
如果使用这个git 克隆不下来的话，也可以下载zip包上传到服务器上面，这里采用的是上传zip包

修改ca证书到100年

[root@node1 kubernetes-1.23.12]# cd staging/src/k8s.io/client-go/util/cert/
[root@node1 cert]# vi cert.go
 // NewSelfSignedCACert creates a CA certificate
     58 func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
     59         now := time.Now()
     60         tmpl := x509.Certificate{
     61                 SerialNumber: new(big.Int).SetInt64(0),
     62                 Subject: pkix.Name{
     63                         CommonName:   cfg.CommonName,
     64                         Organization: cfg.Organization,
     65                 },
     66                 DNSNames:              []string{cfg.CommonName},
     67                 NotBefore:             now.UTC(),
     68                 NotAfter:              now.Add(duration365d * 100).UTC(),
     69                 KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
位置：68行修改为:365d * 100,如下
NotAfter:              now.Add(duration365d * 100).UTC()

修改生成的其他证书

[root@node1 kubernetes-1.23.12]# cd cmd/kubeadm/app/constants/
[root@node1 constants]# vi constants.go
 49         // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
     50         //CertificateValidity = time.Hour * 24 * 365
     51         CertificateValidity = time.Hour * 24 * 365 * 100
位置：50行,原始为CertificateValidity = time.Hour * 24 * 365，修改为如下:
CertificateValidity = time.Hour * 24 * 365 * 100
保存后退出。

如果是新机器则还需要安装gcc编译器,这里演示环境已经安装过gcc,这里不再进行安装。

开始进行编译

[root@node1 kubernetes-1.23.12]# make all WHAT=cmd/kubeadm GOFLAGS=-v

编译完成以后，获取对应的kubeadm二进制包

[root@node1 kubernetes-1.23.12]# ls -ltr _output/bin/kubeadm 
-rwxr-xr-x 1 root root 44544152 Feb 19 14:14 _output/bin/kubeadm

重新安装集群,需要使用手工编译的kubeadm二进制文件替换掉yum安装的kubeadm文件，文件路径是/bin/kubeadm。然后使用进行集群的创建。

[root@node1 ~]# cp -rf kubernetes-1.23.12/_output/bin/kubeadm /bin/
cp: overwrite ‘/bin/kubeadm’? y

创建集群

##清理掉原有的集群
[root@node1 ~]# kubeadm reset
[reset] Reading configuration from the cluster...
[reset] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[reset] WARNING: Changes made to this host by 'kubeadm init' or 'kubeadm join' will be reverted.
[reset] Are you sure you want to proceed? [y/N]: y
[preflight] Running pre-flight checks
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of config directories: [/etc/kubernetes/manifests /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]
[reset] Deleting contents of stateful directories: [/var/lib/etcd /var/lib/kubelet /var/lib/dockershim /var/run/kubernetes /var/lib/cni]

The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d

The reset process does not reset or clean up iptables rules or IPVS tables.
If you wish to reset iptables, you must do so manually by using the "iptables" command.

If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)
to reset your system's IPVS tables.

The reset process does not clean your kubeconfig files and you must remove them manually.
Please, check the contents of the $HOME/.kube/config file.
[root@node1 ~]# rm -rf /root/.kube/config 

##创建新的集群
[root@node1 ~]# kubeadm init \
> --apiserver-advertise-address=172.16.17.50 \
> --image-repository registry.aliyuncs.com/google_containers \
> --kubernetes-version v1.23.12 \
> --pod-network-cidr=10.244.0.0/16
[init] Using Kubernetes version: v1.23.12
[preflight] Running pre-flight checks
	[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 26.1.4. Latest validated version: 20.10
	[WARNING Hostname]: hostname "node1" could not be reached
	[WARNING Hostname]: hostname "node1": lookup node1 on 202.102.224.68:53: no such host
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local node1] and IPs [10.96.0.1 172.16.17.50]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [localhost node1] and IPs [172.16.17.50 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [localhost node1] and IPs [172.16.17.50 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 9.003817 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config-1.23" in namespace kube-system with the configuration for the kubelets in the cluster
NOTE: The "kubelet-config-1.23" naming of the kubelet ConfigMap is deprecated. Once the UnversionedKubeletConfigMap feature gate graduates to Beta the default name will become just "kubelet-config". Kubeadm upgrade will handle this transition transparently.
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node node1 as control-plane by adding the labels: [node-role.kubernetes.io/master(deprecated) node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node node1 as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: 00vk10.b7uhs64iqq3v1rmo
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 172.16.17.50:6443 --token 00vk10.b7uhs64iqq3v1rmo \
	--discovery-token-ca-cert-hash sha256:a8c22ef3ebb1bbfc798635dc2611fed7f3f520fbda6b9b6947ea5c5c83a5da82 
[root@node1 ~]#   mkdir -p $HOME/.kube
[root@node1 ~]#   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@node1 ~]#   sudo chown $(id -u):$(id -g) $HOME/.kube/config
[root@node1 ~]# kubectl get nodes
NAME    STATUS     ROLES                  AGE   VERSION
node1   NotReady   control-plane,master   43s   v1.23.12

检查证书

[root@node1 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jan 26, 2125 08:45 UTC   99y             ca                      no      
apiserver                  Jan 26, 2125 08:45 UTC   99y             ca                      no      
apiserver-etcd-client      Jan 26, 2125 08:45 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Jan 26, 2125 08:45 UTC   99y             ca                      no      
controller-manager.conf    Jan 26, 2125 08:45 UTC   99y             ca                      no      
etcd-healthcheck-client    Jan 26, 2125 08:45 UTC   99y             etcd-ca                 no      
etcd-peer                  Jan 26, 2125 08:45 UTC   99y             etcd-ca                 no      
etcd-server                Jan 26, 2125 08:45 UTC   99y             etcd-ca                 no      
front-proxy-client         Jan 26, 2125 08:45 UTC   99y             front-proxy-ca          no      
scheduler.conf             Jan 26, 2125 08:45 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jan 26, 2125 08:45 UTC   99y             no      
etcd-ca                 Jan 26, 2125 08:45 UTC   99y             no      
front-proxy-ca          Jan 26, 2125 08:45 UTC   99y             no      
[root@node1 ~]#  openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -text |grep Validity -A2
-bash:  openssl: command not found
[root@node1 ~]# 
[root@node1 ~]# openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -text |grep Validity -A2
        Validity
            Not Before: Feb 19 08:45:29 2025 GMT
            Not After : Jan 26 08:45:33 2125 GMT

可以看到，无论是ca证书，还是其他业务使用的证书都是100年，包括kubelet证书也是100年，这样我们的集群就不用在考虑证书到期的问题。

扫描二维码推送至手机访问。

版权声明：本文由第六芝士网发布，如需转载请注明出处。

本文链接：http://www.dgx666.com/post/241.html

标签: ipscan
分享给朋友：
返回列表

上一篇：看尚CANTV 42吋智能电视:618特惠999元 看球首选

下一篇：国产版Sora开源了!推理优化到18G，4090单卡可跑

“Kubernetes(k8s)-创建永久(100年)证书” 的相关文章

浅谈新安装的计算机需要扩充哪些字体

计算机自带的字体只有：Windows 10 安装好之后， 只是默认提供宋体/新宋体、黑体、楷体、仿宋、微软雅黑字体，见下图安装Office后会新增以下字体（列出一部分）：您在安装office的时候注意选择下安装“字体”， Office会给你添加一些字体供选用。office安装扩充字体字库的方法：此时...

述职报告标准格式(模板一)

2023年度述职报告（标题：方正小标宋_GBK二号）xx主任 xxx（姓名：楷体_GB2312 三号）正 文（三号仿宋_GB2312，字间距按标准间距，行间距28磅。一级标题用黑体，二级标题用楷体_GB2312）...

已下架的腾讯 QQ HD iPadOS 版无法登录账号，提示当前版本过低

IT之家 7 月 13 日消息 去年 3 月，适用于 iPad 设备的 QQ HD 应用从苹果 App Store 下架。据IT之家网友反馈，目前使用 QQ HD iPadOS 版时会提示账号暂时无法登录，“当前版本过低，请升级到 QQ 最新版本”。这也意味着，原 QQ HD 用户需转移至通用版 Q...

Win10运行AutoCAD2014卡在“正在检查许可”界面怎么办?

在使用计算机的过程中，您将始终遇到兼容性问题。例如，在运行AutoCAD2014时，将有长的开放时间，并且将在“检查许可证”界面中的卡片，我该怎么办？以下小系列为您提供了有效的解决方案。按如下方式进行：1.右键单击桌面上的CAD快捷方式，选择“属性”，单击“打开文件位置”。2.打开CAD的安装目录后...

CAD如何彻底删除卸载保证能正常安装?

很多同学CAD遇到出问题（通常是激活失效或者功能异常）。匆忙的把CAD卸载了重新安装，要么是重新安装过程中提示CAD已经安装。要么是安装过程中安装路径是灰色的不可选。要么是好不容易能安装，最后提示安装失败。出现此类问题的原因是上一次卸载过程中CAD没有彻底卸载干净。很多同学简单的认为卸载CAD，就是...

cad2014怎么转换成pdf?推荐这几款转换神器!

PDF是一种通用的文件格式，可以在不同的操作系统、不同版本的CAD软件和不同设备上打开和查看，还可以保持打印格式的一致性，避免在不同设备上打印时出现格式错误。这有助于提高文档的可读性和可理解性，确保打印的准确性和一致性。在进行建筑设计、工程制图等领域的工作时，将CAD转换为PDF是一种常见的做法。下...

滇ICP备2024046894号-17