快速搞定K8S新老版本的證書(shū)續(xù)期問(wèn)題

更新時(shí)間：2026年01月24日 10:32:10 作者：龍飛05

本文介紹了Kubernetes集群證書(shū)續(xù)期的步驟,包括更新證書(shū)、替換CCNA證書(shū)、重啟相關(guān)組件以及驗(yàn)證新證書(shū)的有效性

新版本-1.21以上版本集群證書(shū)續(xù)期

# 當(dāng)對(duì)k8s集群版本進(jìn)行了升級(jí)之后它的證書(shū)會(huì)自動(dòng)更新
# 查看有效期
kubeadm certs check-expiration
# 證書(shū)續(xù)期
kubeadm certs renew all #可以針對(duì)單個(gè)集群組件進(jìn)行升級(jí)
# 執(zhí)行完上條命令之后需要對(duì)api controller-manager scheduler進(jìn)行重啟
docker ps | grep -v pause | grep -E "etcd|scheduler|controller|apiserver" | awk '{print $1}' | awk '{print "docker","restart",$1}' | bash
# 修改config文件
cp /etc/kubernetes/admin.conf /root/.kube/config

#編譯kubeadm的方式延長(zhǎng)證書(shū)有效期
100年修改golang源碼，在kubeadm init之前進(jìn)行編譯，二進(jìn)制文件

# k8s自動(dòng)對(duì)證書(shū)進(jìn)行續(xù)期

老版本k8s的證書(shū)續(xù)期

# master節(jié)點(diǎn)
# 更新證書(shū)

kubeadm alpha certs renew all
kubeadm alpha certs check-expiration

# 重新生成證書(shū)

kubeadm init phase certs all --config /etc/kubernetes/kubeadm-config.yaml
kubeadm init phase kubeconfig all --config /etc/kubernetes/kubeadm-config.yaml
\# kubeadm init phase kubeconfig admin --kubeconfig-dir=/etc/kubernetes/
\# kubeadm init phase kubeconfig controller-manager --kubeconfig-dir=/etc/kubernetes/
\# kubeadm init phase kubeconfig scheduler --kubeconfig-dir=/etc/kubernetes/
\# kubeadm init phase kubeconfig kubelet --config /etc/kubernetes/kubeadm-config.yaml

# 檢查新證書(shū)的 SAN 列表

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A1 "Subject Alternative Name"
openssl x509 -in /etc/kubernetes/pki/etcd/server.crt -noout -text | grep -A1 "Subject Alternative Name"

tar czvf pki.tar.gz pki/*

# 啟動(dòng)一個(gè) HTTP 服務(wù)器來(lái)提供證書(shū)文件

python3 -m http.server 8080

sudo -i
cd /etc/kubernetes/
rm -rf /etc/kubernetes/pki
rm -f /etc/kubernetes/{admin.conf,controller-manager.conf,scheduler.conf,kubelet.conf,pki.tar.gz}
wget http://10.116.0.6:8080/{admin.conf,controller-manager.conf,scheduler.conf,kubelet.conf,pki.tar.gz}
tar xf pki.tar.gz

docker restart $(docker ps -q -a -f "name=kube-controller-manager|kube-scheduler")
docker restart $(docker ps -q -a -f "name=kube-apiserver|kube-controller-manager|kube-scheduler|etcd")

cp /etc/kubernetes/admin.conf $HOME/.kube/config

rm -fr /var/lib/kubelet/pki.bak
mv /var/lib/kubelet/pki /var/lib/kubelet/pki.bak
systemctl restart kubelet
systemctl status kubelet

kubectl get csr # 查看未批準(zhǔn)的 CSR
kubectl certificate approve <CSR-NAME>
kubectl certificate approve $(kubectl get csr | grep Pending | awk '{print $1}')

# 替換 ccalico 證書(shū)

POD_CIDR=`grep 'cluster-cidr' /etc/kubernetes/manifests/kube-controller-manager.yaml | awk -F= '{print $2}'`

sed '/CALICO_IPV4POOL_CIDR/{n;s#".*"#"'$POD_CIDR'"#}' calico-etcd.yaml -i

sed -i 's/# \(etcd-.*\)/\1/' calico-etcd.yaml
etcd_key=$(cat /etc/kubernetes/pki/etcd/peer.key | base64 -w 0)
etcd_crt=$(cat /etc/kubernetes/pki/etcd/peer.crt | base64 -w 0)
etcd_ca=$(cat /etc/kubernetes/pki/etcd/ca.crt | base64 -w 0)
sed -i -e 's/\(etcd-key: \).*/\1'$etcd_key'/' \
  -e 's/\(etcd-cert: \).*/\1'$etcd_crt'/' \
  -e 's/\(etcd-ca: \).*/\1'$etcd_ca'/' calico-etcd.yaml

ETCD=$(grep 'advertise-client-urls' /etc/kubernetes/manifests/etcd.yaml | awk -F= '{print $2}')
sed -i -e 's@\(etcd_endpoints: \).*@\1"'$ETCD'"@' \
  -e 's/\(etcd_.*:\).*#/\1/' \
  -e 's/replicas: 1/replicas: 2/' calico-etcd.yaml

kubectl delete -f calico-etcd.yaml --grace-period=0 --force
kubectl apply -f calico-etcd.yaml

# node 節(jié)點(diǎn)
# 更新證書(shū)

sudo -i
cd /etc/kubernetes/
rm -fr /etc/kubernetes/{bootstrap-kubelet.conf,kubelet.conf,pki/*}
wget http://10.116.0.7:8080/{bootstrap-kubelet.conf,kubelet.conf}
wget http://10.116.0.7:8080/pki/ca.crt -O pki/ca.crt

# 重啟 kubelet

rm -fr /var/lib/kubelet/pki.bak
mv /var/lib/kubelet/pki /var/lib/kubelet/pki.bak
systemctl restart kubelet
systemctl status kubelet

# 重啟 kube-proxy

kubectl delete pod -n kube-system -l k8s-app=kube-proxy

# 重啟 docker

sudo -i
cd /etc/kubernetes/
systemctl restart docker

# 重啟 coredns
# 刪除現(xiàn)有 Token 的 Secret，Kubernetes 會(huì)自動(dòng)生成新 Token
# 查找 CoreDNS ServiceAccount 關(guān)聯(lián)的 Secret

kubectl get secrets -n kube-system | grep coredns-token

# 刪除舊 Secret（例如 coredns-token-xxxxx）

kubectl delete secret -n kube-system coredns-token-xxxxx
kubectl scale -n kube-system deployment/coredns --replicas=0

# 測(cè)試新 Token 是否有效

TOKEN=$(kubectl get secret coredns-token-45r8t -n kube-system -o jsonpath='{.data.token}' | base64 -d)
\# curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc.cluster.local/api/v1/namespaces
curl -k -H "Authorization: Bearer $TOKEN" https://10.116.0.6:6443/api/v1/namespaces