kubernetes证书过期怎么处理

这篇文章主要介绍"kubernetes证书过期怎么处理"，在日常操作中，相信很多人在kubernetes证书过期怎么处理问题上存在疑惑，小编查阅了各式资料，整理出简单好用的操作方法，希望对大家解答"kubernetes证书过期怎么处理"的疑惑有所帮助！接下来，请跟着小编一起来学习吧！

一、过期信息

# kubectl get podUnable to connect to the server: x509: certificate has expired or is not yet valid

二、处理etcd证书

2.1、查看过期信息

# cd /etc/etcd/ssl/# openssl x509 -in etcd.pem -noout -text |grep ' Not '            Not Before: Jul  5 07:57:00 2018 GMT            Not After : Jul  5 07:57:00 2019 GMT

2.2、修改过期时效

默认为8760h也就是一年

# vim ca-config.json {"signing": {"default": {  "expiry": "8760h"},"profiles": {  "kubernetes-Soulmate": {    "usages": [        "signing",        "key encipherment",        "server auth",        "client auth"    ],    "expiry": "8760h"  }}}}

修改为10年

{"signing": {"default": {  "expiry": "87600h"},"profiles": {  "kubernetes-Soulmate": {    "usages": [        "signing",        "key encipherment",        "server auth",        "client auth"    ],    "expiry": "87600h"  }}}}

2.3、备份并生成新的etcd证书

# mv /etc/etcd/ssl /etc/etcd/ssl_bak# mkdir -p /etc/etcd/ssl

# cfssl gencert -ca=ca.pem \   -ca-key=ca-key.pem \   -config=ca-config.json \   -profile=kubernetes-Soulmate etcd-csr.json | cfssljson -bare etcd2019/07/24 15:54:51 [INFO] generate received request2019/07/24 15:54:51 [INFO] received CSR2019/07/24 15:54:51 [INFO] generating key: rsa-20482019/07/24 15:54:51 [INFO] encoded CSR2019/07/24 15:54:51 [INFO] signed certificate with serial number 1290404918591115967682798275675232526192696402192019/07/24 15:54:51 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable forwebsites. For more information see the Baseline Requirements for the Issuance and Managementof Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);specifically, section 10.2.3 ("Information Requirements").# cp etcd.pem etcd-key.pem ca.pem /etc/etcd/ssl/

重启服务

# systemctl restart etcd

拷贝至其它etcd节点

# scp -r /etc/etcd/ssl/*.pem k8s2:/etc/etcd/ssl/# scp -r /etc/etcd/ssl/*.pem k8s3:/etc/etcd/ssl/

2.4、查看现在的时效

# openssl x509 -in etcd.pem -noout -text |grep ' Not '            Not Before: Jul 24 07:50:00 2019 GMT            Not After : Jul 21 07:50:00 2029 GMT

三、处理k8s证书

3.1、查看过期信息

# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '            Not Before: Jul  6 03:26:53 2018 GMT            Not After : Jul  6 03:26:53 2019 GMT

3.2、备份证书以及配置文件

# cd /etc/kubernetes# mkdir pki_bak# mkdir conf_bak# mv pki/apiserver* pki_bak/# mv pki/front-proxy-client.* pki_bak/# mv admin.conf kubelet.conf controller-manager.conf scheduler.conf conf_bak/

3.3、生成新的证书

# cat config.yaml   apiVersion: kubeadm.k8s.io/v1alpha1  kind: MasterConfiguration  kubernetesVersion: 1.10.4  etcd:    endpoints:    - https://172.16.40.111:2379    - https://172.16.40.112:2379    - https://172.16.40.121:2379    caFile: /etc/etcd/ssl/ca.pem    certFile: /etc/etcd/ssl/etcd.pem    keyFile: /etc/etcd/ssl/etcd-key.pem    dataDir: /var/lib/etcd  networking:    podSubnet: 192.168.0.0/16  api:    advertiseAddress: "172.16.40.10"    controlPlaneEndpoint: "172.16.40.10"  token: "b99a00.a144ef80536d4345"  tokenTTL: "0s"  apiServerCertSANs:    - k8s1    - k8s2    - k8s3    - 172.16.40.111    - 172.16.40.112    - 172.16.40.121    - 172.16.40.10  featureGates:    CoreDNS: true# kubeadm alpha phase certs all --config=config.yaml[certificates] Using the existing ca certificate and key.[certificates] Generated apiserver certificate and key.[certificates] apiserver serving cert is signed for DNS names [k8s1 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local 172.16.40.10 k8s1 k8s2 k8s3] and IPs [10.96.0.1 172.16.40.10 172.16.40.111 172.16.40.112 172.16.40.121 172.16.40.14 172.16.40.10][certificates] Generated apiserver-kubelet-client certificate and key.[certificates] Using the existing sa key.[certificates] Using the existing front-proxy-ca certificate and key.[certificates] Generated front-proxy-client certificate and key.[certificates] Valid certificates and keys now exist in "/etc/kubernetes/pki"

3.4、生成新的配置文件

# kubeadm alpha phase kubeconfig all --config=config.yaml[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"

3.5、拷贝环境变量

# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config# chown $(id -u):$(id -g) $HOME/.kube/config

3.6、拷贝证书及环境变量到其它节点

# scp -r /etc/kubernetes/pki  k8s2:/etc/kubernetes/# scp -r /etc/kubernetes/pki  k8s3:/etc/kubernetes/# scp $HOME/.kube/config k8s2:$HOME/.kube/config# scp $HOME/.kube/config k8s3:$HOME/.kube/config

到此，关于"kubernetes证书过期怎么处理"的学习就结束了，希望能够解决大家的疑惑。理论与实践的搭配能更好的帮助大家学习，快去试试吧！若想继续学习更多相关知识，请继续关注网站，小编会继续努力为大家带来更多实用的文章！