K8S 证书可用时间修改

Posted 2021-03-04 klvchen

mkdir tools && cd tools/
wget https://studygolang.com/dl/golang/go1.12.7.linux-amd64.tar.gz
tar -zxvf go1.12.7.linux-amd64.tar.gz -C /usr/local/

vi /etc/profile
# 添加
export PATH=$PATH:/usr/local/go/bin

source /etc/profile

go version

mkdir /data && cd /data/
# 把 kubernetes-release-1.15.zip  上传到这来
unzip kubernetes-release-1.15.zip 

cd kubernetes-release-1.15/cmd/kubeadm/app/util/pkiutil/
vi pki_helpers.go 
# 添加
const duration365d = time.Hour * 24 * 365 * 10

# 修改 Add()中的值
NotAfter:     time.Now().Add(duration365d).UTC(),

cd /data/kubernetes-release-1.15
make WHAT=cmd/kubeadm GOFLAGS=-v
cp /usr/bin/kubeadm /usr/bin/kubeadm.old
cp _output/bin/kubeadm /usr/bin/
chmod a+x /usr/bin/kubeadm
cd /etc/kubernetes/

# 备份原来的 pki
cp -r pki pki.old

# 重新生成 证书
kubeadm alpha certs renew all --config=/usr/local/install-k8s/core/kubeadm-config.yaml 

# 检查证书是否成功修改
cd /etc/kubernetes/pki

openssl x509 -in apiserver.crt -text -noout

成功修改为 10 年