快捷導(dǎo)航

快速搞定K8S新老版本的證書續(xù)期問題

更新時間：2026年01月24日 10:32:10 作者：龍飛05

本文介紹了Kubernetes集群證書續(xù)期的步驟,包括更新證書、替換CCNA證書、重啟相關(guān)組件以及驗證新證書的有效性

新版本-1.21以上版本集群證書續(xù)期

# 當(dāng)對k8s集群版本進行了升級之后它的證書會自動更新
# 查看有效期
kubeadm certs check-expiration
# 證書續(xù)期
kubeadm certs renew all #可以針對單個集群組件進行升級
# 執(zhí)行完上條命令之后需要對api controller-manager scheduler進行重啟
docker ps | grep -v pause | grep -E "etcd|scheduler|controller|apiserver" | awk '{print $1}' | awk '{print "docker","restart",$1}' | bash
# 修改config文件
cp /etc/kubernetes/admin.conf /root/.kube/config

#編譯kubeadm的方式延長證書有效期
100年修改golang源碼，在kubeadm init之前進行編譯，二進制文件

# k8s自動對證書進行續(xù)期

老版本k8s的證書續(xù)期

# master節(jié)點
# 更新證書

kubeadm alpha certs renew all
kubeadm alpha certs check-expiration

# 重新生成證書

kubeadm init phase certs all --config /etc/kubernetes/kubeadm-config.yaml
kubeadm init phase kubeconfig all --config /etc/kubernetes/kubeadm-config.yaml
\# kubeadm init phase kubeconfig admin --kubeconfig-dir=/etc/kubernetes/
\# kubeadm init phase kubeconfig controller-manager --kubeconfig-dir=/etc/kubernetes/
\# kubeadm init phase kubeconfig scheduler --kubeconfig-dir=/etc/kubernetes/
\# kubeadm init phase kubeconfig kubelet --config /etc/kubernetes/kubeadm-config.yaml

# 檢查新證書的 SAN 列表

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A1 "Subject Alternative Name"
openssl x509 -in /etc/kubernetes/pki/etcd/server.crt -noout -text | grep -A1 "Subject Alternative Name"

tar czvf pki.tar.gz pki/*

# 啟動一個 HTTP 服務(wù)器來提供證書文件

python3 -m http.server 8080

sudo -i
cd /etc/kubernetes/
rm -rf /etc/kubernetes/pki
rm -f /etc/kubernetes/{admin.conf,controller-manager.conf,scheduler.conf,kubelet.conf,pki.tar.gz}
wget http://10.116.0.6:8080/{admin.conf,controller-manager.conf,scheduler.conf,kubelet.conf,pki.tar.gz}
tar xf pki.tar.gz

docker restart $(docker ps -q -a -f "name=kube-controller-manager|kube-scheduler")
docker restart $(docker ps -q -a -f "name=kube-apiserver|kube-controller-manager|kube-scheduler|etcd")

cp /etc/kubernetes/admin.conf $HOME/.kube/config

rm -fr /var/lib/kubelet/pki.bak
mv /var/lib/kubelet/pki /var/lib/kubelet/pki.bak
systemctl restart kubelet
systemctl status kubelet

kubectl get csr # 查看未批準(zhǔn)的 CSR
kubectl certificate approve <CSR-NAME>
kubectl certificate approve $(kubectl get csr | grep Pending | awk '{print $1}')

# 替換 ccalico 證書

POD_CIDR=`grep 'cluster-cidr' /etc/kubernetes/manifests/kube-controller-manager.yaml | awk -F= '{print $2}'`

sed '/CALICO_IPV4POOL_CIDR/{n;s#".*"#"'$POD_CIDR'"#}' calico-etcd.yaml -i

sed -i 's/# \(etcd-.*\)/\1/' calico-etcd.yaml
etcd_key=$(cat /etc/kubernetes/pki/etcd/peer.key | base64 -w 0)
etcd_crt=$(cat /etc/kubernetes/pki/etcd/peer.crt | base64 -w 0)
etcd_ca=$(cat /etc/kubernetes/pki/etcd/ca.crt | base64 -w 0)
sed -i -e 's/\(etcd-key: \).*/\1'$etcd_key'/' \
  -e 's/\(etcd-cert: \).*/\1'$etcd_crt'/' \
  -e 's/\(etcd-ca: \).*/\1'$etcd_ca'/' calico-etcd.yaml

ETCD=$(grep 'advertise-client-urls' /etc/kubernetes/manifests/etcd.yaml | awk -F= '{print $2}')
sed -i -e 's@\(etcd_endpoints: \).*@\1"'$ETCD'"@' \
  -e 's/\(etcd_.*:\).*#/\1/' \
  -e 's/replicas: 1/replicas: 2/' calico-etcd.yaml

kubectl delete -f calico-etcd.yaml --grace-period=0 --force
kubectl apply -f calico-etcd.yaml

# node 節(jié)點
# 更新證書

sudo -i
cd /etc/kubernetes/
rm -fr /etc/kubernetes/{bootstrap-kubelet.conf,kubelet.conf,pki/*}
wget http://10.116.0.7:8080/{bootstrap-kubelet.conf,kubelet.conf}
wget http://10.116.0.7:8080/pki/ca.crt -O pki/ca.crt

# 重啟 kubelet

rm -fr /var/lib/kubelet/pki.bak
mv /var/lib/kubelet/pki /var/lib/kubelet/pki.bak
systemctl restart kubelet
systemctl status kubelet

# 重啟 kube-proxy

kubectl delete pod -n kube-system -l k8s-app=kube-proxy

# 重啟 docker

sudo -i
cd /etc/kubernetes/
systemctl restart docker

# 重啟 coredns
# 刪除現(xiàn)有 Token 的 Secret，Kubernetes 會自動生成新 Token
# 查找 CoreDNS ServiceAccount 關(guān)聯(lián)的 Secret

kubectl get secrets -n kube-system | grep coredns-token

# 刪除舊 Secret（例如 coredns-token-xxxxx）

kubectl delete secret -n kube-system coredns-token-xxxxx
kubectl scale -n kube-system deployment/coredns --replicas=0

# 測試新 Token 是否有效

TOKEN=$(kubectl get secret coredns-token-45r8t -n kube-system -o jsonpath='{.data.token}' | base64 -d)
\# curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc.cluster.local/api/v1/namespaces
curl -k -H "Authorization: Bearer $TOKEN" https://10.116.0.6:6443/api/v1/namespaces