Akemi

编译安装kubeadm—修改初始证书时长

2025/06/12

环境说明

k8s版本:1.28
docker版本:26.1.3, build b72abbb
linux版本:Rocky Linux release 8.10 (Green Obsidian)
需求镜像:registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0

1.下载k8s的github官方源码

1
2
3
4
5
6
git clone https://github.com/kubernetes/kubernetes.git

如果因为网络问题导致无法clone
也可以选择挂梯子在网页端下载，然后上传

unzip kubernetes-release-1.28.zip

2.修改源码中证书时间相关的内容

1
2
3
4
5
6
7
8
9
vim cmd/kubeadm/app/constants/constants.go
控制平面证书
...
CertificateValidity = time.Hour * 24 * 365 * 10

vim staging/src/k8s.io/client-go/util/cert/cert.go
普通应用证书
...
NotAfter:  time.Now().Add(duration365d * 10).UTC(),

3.下载需求镜像

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
编译需要在go环境中进行，官方推荐使用镜像
我这里1.28需要的镜像是
[registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0](http://registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0)

挂梯子进行一手拉取
systemctl show docker --property Environment
Environment=HTTP_PROXY=http://192.168.8.1:7899 HTTPS_PROXY=http://192.168.8.1:7899 NO_PROXY=localhos

docker pull registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0
v1.28.0-go1.22.8-bullseye.0: Pulling from build-image/kube-cross
014ac6453c34: Pull complete
21912b76607d: Pull complete
ee27f1f94c19: Pull complete
eeb8d9c20a4f: Pull complete
4bfbe2417dd5: Pull complete
09011c4fc1a6: Pull complete
4f4fb700ef54: Pull complete
0fd0da1c86ed: Pull complete
2a74b2f6122a: Pull complete
b896dea0682c: Pull complete
7e8a9da617ce: Pull complete
fe36f218f128: Pull complete
ad0b0c840126: Pull complete
b6571094e84f: Pull complete
Digest: sha256:5ede83719fd9262d201df6609fcfe08100764554519d3666d4129fc89c8290b5
Status: Downloaded newer image for registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0
registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0

拉取完之后进行一手镜像的搬运，因为我拉取和构建的机器不是同一台
docker save -o kube-cross1.28.tar.gz registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0

 docker load -i ~/kube-cross1.28.tar.gz
315317d32d9b: Loading layer  129.5MB/129.5MB
c79ad3cc3bfa: Loading layer  29.52MB/29.52MB
28284e7d7233: Loading layer  156.8MB/156.8MB
96a8445fc292: Loading layer  229.9MB/229.9MB
06347fbf8d6d: Loading layer  232.9MB/232.9MB
5332a13c422b: Loading layer   2.56kB/2.56kB
5f70bf18a086: Loading layer  1.024kB/1.024kB
92399a811fe8: Loading layer  4.608kB/4.608kB
df60dc7797ad: Loading layer  36.06MB/36.06MB
db4daec613e6: Loading layer  4.688GB/4.688GB
3f7d681c4d66: Loading layer   8.27MB/8.27MB
c7a66b046021: Loading layer  1.536kB/1.536kB
1edd9d3eb8b3: Loading layer  226.3MB/226.3MB
6fab755ca22d: Loading layer  1.157MB/1.157MB
Loaded image: registry.k8s.io/build-image/kube-cross:v1.28.0-go1.22.8-bullseye.0

4.进行编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
cd build/
./run.sh make kubeadm
+++ [0612 01:11:16] Verifying Prerequisites....
+++ [0612 01:11:16] Building Docker image kube-build:build-3c3906e106-5-v1.28.0-go1.22.8-bullseye.0
+++ [0612 01:11:30] Creating data container kube-build-data-3c3906e106-5-v1.28.0-go1.22.8-bullseye.0
+++ [0612 01:11:30] Syncing sources to container
+++ [0612 01:11:35] Output from this container will be rsynced out upon completion. Set KUBE_RUN_COPY_OUTPUT=n to disable.
+++ [0612 01:11:35] Running build command...
Go version: go version go1.22.8 linux/amd64
+++ [0612 01:11:35] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kubeadm (static)
Env for linux/amd64: GOOS=linux GOARCH=amd64 GOROOT=/usr/local/go CGO_ENABLED= CC=
Coverage is disabled.
+++ [0612 01:12:07] Placing binaries
+++ [0612 01:12:08] Syncing out of container

查看输出的kubeadm的版本：
../_output/dockerized/bin/linux/amd64/kubeadm version
kubeadm version: &version.Info{Major:"", Minor:"", GitVersion:"v0.0.0-master+9d9e08b3179aa8df23909b495c2001b8cccf494a", GitCommit:"9d9e08b3179aa8df23909b495c2001b8cccf494a", GitTreeState:"archive", BuildDate:"2025-06-12T05:11:35Z", GoVersion:"go1.22.8", Compiler:"gc", Platform:"linux/amd64"}

替换二进制命令
\cp ../_output/dockerized/bin/linux/amd64/kubeadm /usr/bin/kubeadm

5.集群初始化与验证证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
cd ~
kubeadm init --config=kubeadm.yaml
...
Your Kubernetes control-plane has initialized successfully!

kubectl get nodes
NAME   STATUS     ROLES           AGE   VERSION
test   NotReady   control-plane   89s   v1.28.1

kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jun 10, 2035 05:16 UTC   9y              ca                      no
apiserver                  Jun 10, 2035 05:16 UTC   9y              ca                      no
apiserver-etcd-client      Jun 10, 2035 05:16 UTC   9y              etcd-ca                 no
apiserver-kubelet-client   Jun 10, 2035 05:16 UTC   9y              ca                      no
controller-manager.conf    Jun 10, 2035 05:16 UTC   9y              ca                      no
etcd-healthcheck-client    Jun 10, 2035 05:16 UTC   9y              etcd-ca                 no
etcd-peer                  Jun 10, 2035 05:16 UTC   9y              etcd-ca                 no
etcd-server                Jun 10, 2035 05:16 UTC   9y              etcd-ca                 no
front-proxy-client         Jun 10, 2035 05:16 UTC   9y              front-proxy-ca          no
scheduler.conf             Jun 10, 2035 05:16 UTC   9y              ca                      no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jun 10, 2035 05:16 UTC   9y              no
etcd-ca                 Jun 10, 2035 05:16 UTC   9y              no
front-proxy-ca          Jun 10, 2035 05:16 UTC   9y              no

可以看到此时所有证书都是10年的有效期

原文作者：王盛

原文链接：https://akemi.zj.cn/2025/06/12/Kubeadm-make/

发表日期：June 12th 2025, 1:43:03 pm

更新日期：June 12th 2025, 1:43:45 pm

版权声明：本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
Total : 223
2025
2024
2023
Linux 云原生 云计算 开发 mysql