一.查看证书过期时间

1.用查看文件的方式

# 查看证书
~]# for item in `find /etc/kubernetes/pki -maxdepth 2 -name "*.crt"`;do openssl x509 -in $item -text -noout| grep Not;echo ======================$item===============;done

2.用命令的方式

~]# kubeadm certs check-expiration

二.操作概述

1.故障现象

k8s安装一年后证书显示过期。证书未自动续期。

2.更新过程

一下操作需到所有master节点操作

3.下载kubeadm

一般情况下，k8s创建的集群节点上的/usr/bin/文件夹下会存在kubeadm二进制文件，如果发现master节点上没有kubeadm，可以从官方下载。以amd64架构1.16.9版本的kubeadm为例子，可以通过curl -L --remote-name-all https://storage.googleapis.com/kubernetes-release/release/v1.16.9/bin/linux/amd64/kubeadm下载到本地，如果需要其他版本请将URL中的版本号修改为其他版本号即可。使用chmod +x kubeadm命令为二进制加权限后，将kubeadm发送到集群master节点

三.操作步骤

1.备份文件

~]# cp -r /etc/kubernetes /etc/kubernetes.bak && cp -r /var/lib/etcd /var/lib/etcd.bak
## 将k8s和tecd相关文件做备份

2.执行证书更新

~]# kubeadm alpha certs renew all
# 如果使用的1.16.x版本，其打印内容如下
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

## 如果是1.18.x版本，打印内容会多一些提示：
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed

3.更新kubeconfig

执行kubeadm init phase kubeconfig all可使用新证书生成新的kubeconfig文件。执行cp -r /root/.kube /root/.kube.bak备份后，可以执行cp -f /etc/kubernetes/admin.conf /root/.kube/config覆盖掉原本的kubeconfig文件。

# 执行kubeadm init phase kubeconfig all时可能报错，需要把/etc/kubernetes/下的一些文件删除或移走
I0221 14:28:32.309687   23977 version.go:248] remote version is much newer: v1.23.4; falling back to: stable-1.15
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
error execution phase kubeconfig/admin: a kubeconfig file "/etc/kubernetes/admin.conf" exists already but has got the wrong API Server URL
~]# mv /etc/kubernetes/admin.conf /root/
# 此时可能还又其他文件如果有就都移走然后再执行kubeadm init phase kubeconfig all

4.验证

验证与组件重启，执行完上述更新证书操作后可以通过

~]# echo | openssl s_client -showcerts -connect 127.0.0.1:6443 -servername api 2>/dev/null | openssl x509 -noout -enddate

验证apiserver证书有效期是否更新，会发现证书有效期没有更新。此原因是k8s组件如果没有重启就不会使用新证书导致的。执行

~]# docker rm -f $(docker ps -q -f label=io.kubernetes.container.name=kube-apiserver)
~]# docker rm -f $(docker ps -q -f label=io.kubernetes.container.name=kube-controller-manager) 
~]# docker rm -f $(docker ps -q -f label=io.kubernetes.container.name=kube-scheduler)
~]# docker rm -f $(docker ps -q -f label=io.kubernetes.container.name=etcd)
# 以重启k8s及etcd相关组件后，再次执行可以观察到证书有效期已经发生变化。
~]# echo | openssl s_client -showcerts -connect 127.0.0.1:6443 -servername api 2>/dev/null | openssl x509 -noout -enddate
notAfter=Feb 21 06:27:04 2023 GMT

# 注，建议重启一下kubelet docker
~]# systemctl restart kubelet docker

k8s证书更新