k8s踩坑记录——证书一年有效期

2019-06-12 12:55:37 阅读：317 来源： 互联网

标签：有效期证书 openssl apiserver key kubeadm k8s config csr

依照https://github.com/strongit/kubeadm-ha/ 安装步骤，kubeadm init安装后的集群存在证书过期问题。现修复如下：
思路如下，
1、保留ca.crt ca.key front-proxy-ca.crt front-proxy-ca.key，根证书有效期十年
2、openssl重新签注
3、kubeadm alpha phase 生成config

 [root@k8s-master01 pki]# cat csr.conf
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C = CN
ST = BeiJing
L = BeiJing
O = k8s
OU = System
CN = kubernetes

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster
DNS.5 = kubernetes.default.svc.cluster.local
DNS.6 = k8s-master01
DNS.7 = k8s-master02
DNS.8 = k8s-master03
IP.1 = 10.96.0.1
IP.2 = 100.82.200.190
IP.3 = 100.82.200.184
IP.4 = 100.82.200.187
IP.5 = 100.82.200.194
IP.6 = 10.220.8.184
IP.7 = 10.220.8.187
IP.8 = 10.220.8.190
IP.9 = 10.220.8.194

[ v3_ext ]
authorityKeyIdentifier=keyid,issuer:always
basicConstraints=CA:FALSE
keyUsage=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=@alt_names

 openssl genrsa -out apiserver.key 2048 
 openssl req -new -key apiserver.key -out apiserver.csr -config csr.conf
 openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver.crt -days 10000 -extensions v3_ext -extfile csr.conf
 openssl x509  -noout -text -in ./apiserver.crt  |grep "Not"

 openssl genrsa -out apiserver-kubelet-client.key 2048
 openssl req -new -key apiserver-kubelet-client.key -out apiserver-kubelet-client.csr -config csr.conf
 openssl x509 -req -in apiserver-kubelet-client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver-kubelet-client.crt -days 10000 -extensions v3_ext -extfile csr.conf
 openssl x509  -noout -text -in ./apiserver-kubelet-client.crt  |grep "Not"

 openssl genrsa -out front-proxy-client.key 2048
 openssl req -new -key front-proxy-client.key -out front-proxy-client.csr -config csr.conf
 openssl x509 -req -in front-proxy-client.csr -CA front-proxy-ca.crt -CAkey front-proxy-ca.key -CAcreateserial -out front-proxy-client.crt -days 10000 -extensions v3_ext -extfile csr.conf
 openssl x509  -noout -text -in ./front-proxy-client.crt  |grep "Not"

kubeadm alpha phase certs all --config kubeadm-config.yaml

kubeadm alpha phase kubelet config write-to-disk --config kubeadm-config.yaml
kubeadm alpha phase kubelet write-env-file --config kubeadm-config.yaml
kubeadm alpha phase kubeconfig kubelet --config kubeadm-config.yaml

kubeadm alpha phase kubeconfig all --config kubeadm-config.yaml

kubeadm alpha phase controlplane all --config kubeadm-config.yaml

systemctl restart kubelet
kubeadm alpha phase mark-master --config kubeadm-config.yaml
cp /etc/kubernetes/admin.conf ~/.kube/config

重启集群后，执行kubelet logs pods XXXX -n kube-system报错如下：Error from server (Forbidden): Forbidden (user=kubernetes, verb=get, resource=nodes, subresource=proxy) ( pods/log kube-scheduler-k8s-master01)
解决方案：kubectl create clusterrolebinding system:kubernetes --clusterrole=cluster-admin --user=system:kubernetes

标签：有效期,证书,openssl,apiserver,key,kubeadm,k8s,config,csr
来源： https://blog.51cto.com/strongit/2407732

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。

ICode9

k8s踩坑记录——证书一年有效期