kubeadm deploys k8s v1.21 version cluster certificate update
Date: 20231101 By topxia
For kubernetes deployed by kubeadm, change the certificate validity period to 99 years by recompiling kubeadm. In actual work, it is recommended to change it to less than 10 years, because the CA statute of limitations is 10 years, as can be seen below.
1. Preparation
1. Check the validity period of the certificate
The default certificate installed by kubeadm is only for one year.
1) kubeadm command
]# kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf May 24, 2024 02:23 UTC 204d ca no apiserver May 24, 2024 02:23 UTC 204d ca no apiserver-etcd-client May 24, 2024 02:23 UTC 204d etcd-ca no apiserver-kubelet-client May 24, 2024 02:23 UTC 204d ca no controller-manager.conf May 24, 2024 02:23 UTC 204d ca no etcd-healthcheck-client May 24, 2024 02:23 UTC 204d etcd-ca no etcd-peer May 24, 2024 02:23 UTC 204d etcd-ca no etcd-server May 24, 2024 02:23 UTC 204d etcd-ca no front-proxy-client May 24, 2024 02:23 UTC 204d front-proxy-ca no scheduler.conf May 24, 2024 02:23 UTC 204d ca no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca May 22, 2033 02:23 UTC 9y no etcd-ca May 22, 2033 02:23 UTC 9y no front-proxy-ca May 22, 2033 02:23 UTC 9y no
2) View files with openssl
]# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep Not
Not Before: May 25 02:23:20 2023 GMT
Not After: May 24 02:23:20 2024 GMT
2. View the current version
Confirm the current kubeadm version and go version
Command: kubeadm version
]# kubeadm version
kubeadm version: & amp;version.Info{<!-- -->Major:"1", Minor:"21", GitVersion:"v1.21.8", GitCommit:"4a3b558c52eb6995b3c5c1db5e54111bd0645a64" , GitTreeState:"clean", BuildDate:"2021-12-15T14:50:58Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/amd64 "}
| Module | version |
|---|---|
| kubeadm | v1.21.8 |
| go | 1.16.12 |
3. Prepare the go environment
# go language download address https://studygolang.com/dl # Find the corresponding version go1.16.12, download the Linux, x86-64 architecture version # File name: go1.16.12.linux-amd64.tar.gz # download link ]# wget https://studygolang.com/dl/golang/go1.16.12.linux-amd64.tar.gz # Unzip ]# tar zxvf go1.16.12.linux-amd64.tar.gz # Make soft connection ]# ln -s /root/code-k8s-v1.21.8/go/bin/go /usr/bin/ ]# ln -s /root/code-k8s-v1.21.8/go/bin/gofmt /usr/bin/ # Check version, test passed ]# go version go version go1.16.12 linux/amd64
4. Download k8s source code
(1) Download the corresponding version
# Official website https://github.com/kubernetes/kubernetes # Find the corresponding version v1.21.8 through release tags https://github.com/kubernetes/kubernetes/releases/tag/v1.21.8 # Download both zip and tar.gz ]# wget https://github.com/kubernetes/kubernetes/archive/refs/tags/v1.21.8.zip # Unzip the downloaded source code ]# unzip kubernetes-1.21.8.zip
(2) Code modification time
]# cd kubernetes-1.21.8/cmd/kubeadm/app/constants/ # Modify the default certificate time ]# vim constants.go CertificateValidity = time.Hour * 24 * 365 Change to CertificateValidity = time.Hour * 24 * 365 * 100
(3) Compilation
# Return to the decompression directory to compile # cd kubernetes-1.21.8 # compile ]# make WHAT=cmd/kubeadm or ]# make WHAT=cmd/kubeadm GOFLAGS=-v
(4) View the compiled version
[root@master kubernetes-1.21.8]# ll _output/bin/ total 81160 -rwxr-xr-x 1 root root 5951488 Nov 1 13:24 conversion-gen -rwxr-xr-x 1 root root 5697536 Nov 1 13:24 deepcopy-gen -rwxr-xr-x 1 root root 5718016 Nov 1 13:24 defaulter-gen -rwxr-xr-x 1 root root 3559199 Nov 1 13:24 go2make -rwxr-xr-x 1 root root 1970176 Nov 1 13:24 go-bindata -rwxr-xr-x 1 root root 44888064 Nov 1 13:26 kubeadm -rwxr-xr-x 1 root root 9662464 Nov 1 13:24 openapi-gen -rwxr-xr-x 1 root root 5660672 Nov 1 13:24 prerelease-lifecycle-gen
2. Replace kubeadm and update certificate
1. Backup
# Back up the original kubeadm and certificate files ]# mv /usr/bin/kubeadm /usr/bin/kubeadm-original.bak # Cannot backup via mv ]# cp -r /etc/kubernetes/pki /etc/kubernetes/pki-20231101-bak
2. Update kubeadm
]# cp -f _output/bin/kubeadm /usr/bin/kubeadm
# Verify whether the version is a new compiled version based on BuildDate
]# kubeadm version
kubeadm version: & amp;version.Info{<!-- -->Major:"1", Minor:"21", GitVersion:"v1.21.8", GitCommit:"4a3b558c52eb6995b3c5c1db5e54111bd0645a64" , GitTreeState:"archive", BuildDate:"2023-11-01T05:25:37Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/amd64 "}
3. Update certificate
]# kubeadm certs renew all [renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
Use old versions: kubeadm alpha certs renew all
4. Update kubeconfig
# You can use the new certificate to generate a new kubeconfig file [root@master ~]# kubeadm init phase kubeconfig all I1101 14:30:31.313451 1645983 version.go:254] remote version is much newer: v1.28.3; falling back to: stable-1.21 [kubeconfig] Using kubeconfig folder "/etc/kubernetes" [kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/admin.conf" [kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/kubelet.conf" [kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/controller-manager.conf" [kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/scheduler.conf"
5. Replace cofig file
# Replacement file [root@master ~]# cp -f /etc/kubernetes/admin.conf ~/.kube/config # Restart the server. Generally, you need to restart the server, otherwise some deployments cannot be used. # View nodes [root@master ~]# kubectl get node NAME STATUS ROLES AGE VERSION master Ready control-plane,master 420d v1.21.8
6. View the new certificate
[root@master kubernetes-1.21.8]# kubeadm certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Oct 08, 2123 06:29 UTC 99y ca no apiserver Oct 08, 2123 06:29 UTC 99y ca no apiserver-etcd-client Oct 08, 2123 06:29 UTC 99y etcd-ca no apiserver-kubelet-client Oct 08, 2123 06:29 UTC 99y ca no controller-manager.conf Oct 08, 2123 06:29 UTC 99y ca no etcd-healthcheck-client Oct 08, 2123 06:29 UTC 99y etcd-ca no etcd-peer Oct 08, 2123 06:29 UTC 99y etcd-ca no etcd-server Oct 08, 2123 06:29 UTC 99y etcd-ca no front-proxy-client Oct 08, 2123 06:29 UTC 99y front-proxy-ca no scheduler.conf Oct 08, 2123 06:29 UTC 99y ca no CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca May 22, 2033 02:23 UTC 9y no etcd-ca May 22, 2033 02:23 UTC 9y no front-proxy-ca May 22, 2033 02:23 UTC 9y no [root@master kubernetes-1.21.8]#