Akemi

k8s证书延长有效期

2025/02/05

使用kubeadm

使用kubeadm安装k8s时，证书有效期默认为一年

一年到了就需要进行有效期的延长

查看k8s集群的证书有效期

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
（k8s 1.21之前）
kubeadm alpha certs check-expiration
（k8s 1.21之后）
kubeadm certs check-expiration

可以看到还有32天就过期了
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Mar 10, 2025 03:19 UTC   32d             ca                      no
apiserver                  Mar 10, 2025 03:19 UTC   32d             ca                      no
apiserver-etcd-client      Mar 10, 2025 03:19 UTC   32d             etcd-ca                 no
apiserver-kubelet-client   Mar 10, 2025 03:19 UTC   32d             ca                      no
controller-manager.conf    Mar 10, 2025 03:19 UTC   32d             ca                      no
etcd-healthcheck-client    Mar 10, 2025 03:19 UTC   32d             etcd-ca                 no
etcd-peer                  Mar 10, 2025 03:19 UTC   32d             etcd-ca                 no
etcd-server                Mar 10, 2025 03:19 UTC   32d             etcd-ca                 no
front-proxy-client         Mar 10, 2025 03:19 UTC   32d             front-proxy-ca          no
scheduler.conf             Mar 10, 2025 03:19 UTC   32d             ca                      no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 08, 2034 03:19 UTC   9y              no
etcd-ca                 Mar 08, 2034 03:19 UTC   9y              no
front-proxy-ca          Mar 08, 2034 03:19 UTC   9y              no

证书有效期延长

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
备份证书目录
sudo cp -r /etc/kubernetes/pki /etc/kubernetes/pki.backup
备份 kubeconfig 文件（如 admin.conf）
sudo cp /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.backup
cp ~/.kube/config ~/.kube/config.backup

更新集群所有证书
sudo kubeadm certs renew all

复制 admin.conf 到用户目录
sudo cp /etc/kubernetes/admin.conf ~/.kube/config

确保权限正确（当前用户可读写）
sudo chown $(id -u):$(id -g) ~/.kube/config

再次查看证书有效期，可以看到
kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Feb 05, 2026 10:57 UTC   364d            ca                      no
apiserver                  Feb 05, 2026 10:57 UTC   364d            ca                      no
apiserver-etcd-client      Feb 05, 2026 10:57 UTC   364d            etcd-ca                 no
apiserver-kubelet-client   Feb 05, 2026 10:57 UTC   364d            ca                      no
controller-manager.conf    Feb 05, 2026 10:57 UTC   364d            ca                      no
etcd-healthcheck-client    Feb 05, 2026 10:57 UTC   364d            etcd-ca                 no
etcd-peer                  Feb 05, 2026 10:57 UTC   364d            etcd-ca                 no
etcd-server                Feb 05, 2026 10:57 UTC   364d            etcd-ca                 no
front-proxy-client         Feb 05, 2026 10:57 UTC   364d            front-proxy-ca          no
scheduler.conf             Feb 05, 2026 10:57 UTC   364d            ca                      no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Mar 08, 2034 03:19 UTC   9y              no
etcd-ca                 Mar 08, 2034 03:19 UTC   9y              no
front-proxy-ca          Mar 08, 2034 03:19 UTC   9y              no

使用openssl

在另外一些场景下，k8s集群需要单独使用另外的客户端证书来配置kubeconfig，以提供外部访问的权限

创建新用户的rbac

为用户wangsheng创建rbac，以便让kubeconfig进行绑定

1
2
kubectl create clusterrolebinding wangsheng-admin-binding \
--clusterrole=cluster-admin --user=wangsheng

创建新证书与kubeconfig

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
cd /etc/kubernetes/pki

生成私钥
openssl genrsa -out client.key 2048

生成证书请求文件
openssl req -new -key client.key -subj "/CN=wangsheng" -out client.csr

向ca请求签发证书client.crt
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365

创建kubeconfig
cd ~
cat > client.config <<EOF
apiVersion: v1
kind: Config
clusters: []
contexts: []
current-context: ""
users: []
EOF

配置kubeconfig集群信息
kubectl config set-cluster wsk8s \
--server=https://192.168.10.121:6443 \
--certificate-authority=/etc/kubernetes/pki/ca.crt \
--kubeconfig=~/client.config

设置用户信息
kubectl config set-credentials wangsheng \
--client-certificate=/etc/kubernetes/pki/client.crt \
--client-key=/etc/kubernetes/pki/client.key \
--kubeconfig=~/client.config \
--embed-certs=true

设置上下文
kubectl config set-context wscontext \
--cluster=wsk8s \
--user=wangsheng \
--kubeconfig=~/client.config

使用上下文
kubectl config use-context wscontext \
--kubeconfig=~/client.config

验证使用
kubectl get pods --kubeconfig client.config
NAME                                        READY   STATUS        RESTARTS       AGE
guestbook-helm-guestbook-6fd56f9f49-92t28   1/1     Running       0              6h1m
guestbook-helm-guestbook-6fd56f9f49-jkzrl   1/1     Terminating   4 (35d ago)    61d
memcached-memcached-0                       1/1     Terminating   0              21d
memcached-memcached-1                       1/1     Running       3 (13d ago)    58d
memcached-memcached-2                       1/1     Terminating   2 (35d ago)    58d
nfs-provisioner-bd5ddfb84-86lb2             1/1     Running       8 (6h6m ago)   61d

使用openssl延长证书有效期并更新kubeconfig

1
2
3
4
5
6
7
8
9
10
11
12
13
查看证书有效期
 openssl x509 -in /etc/kubernetes/pki/client.crt -noout -text | grep Not
            Not Before: Feb  5 11:32:45 2025 GMT
            Not After : Feb  5 11:32:45 2026 GMT
表示从2025年2月5日11时32分45秒开始，到2026年2月5日11时32分45秒结束

无法延长证书的有效期，只能再签发一个，就按照前面的步骤再签发就行了
可以不更换私钥，直接用原本的私钥签发，也就是再获得一个client.crt

openssl base64 -in client.crt -out client-certificate-base64.txt
获得它的base64的值

然后vim手动修改client-certificate-data，将其替换成base64的值即可

或者使用kubectl config进行设置，适用于多上下文的情况

1
2
3
kubectl config set-credentials <your-user-name> \
--client-certificate=/etc/kubernetes/pki/client.crt \
--kubeconfig=~/client.config

原文作者：王盛

原文链接：https://akemi.zj.cn/2025/02/05/K8s-crt/

发表日期：February 5th 2025, 9:42:55 pm

更新日期：February 20th 2025, 6:37:27 pm

版权声明：本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
  1. 1. 使用kubeadm
    1. 1.1. 查看k8s集群的证书有效期
    2. 1.2. 证书有效期延长
  2. 2. 使用openssl
    1. 2.1. 创建新用户的rbac
    2. 2.2. 创建新证书与kubeconfig
    3. 2.3. 使用openssl延长证书有效期并更新kubeconfig
Total : 203
2025
2024
2023
Linux 云原生 云计算 开发 mysql