1.查看当前的使用期限

for item in `find /etc/kubernetes/pki -maxdepth 2 -name "*.crt"`;do openssl x509 -in $item -text -noout| grep Not;echo ======================$item===================;done

2.备份过期证书

备份证书

cp -rp /etc/kubernetes /etc/kubernetes.bak

生成配置文件

kubeadm config view > /tmp/cluster.yaml

更新新证书
生成新证书

kubeadm alpha certs renew all --config=/tmp/cluster.yaml

重启相关服务

docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' |xargs docker restart

查看证书到期时间

for item in `find /etc/kubernetes/pki -maxdepth 2 -name "*.crt"`;do openssl x509 -in $item -text -noout| grep Not;echo ======================$item===============;done

覆盖配置文件

rm -rf /root/.kube/
mkdir /root/.kube/
cp -i /etc/kubernetes/admin.conf /root/.kube/config

验证

kubectl get no

标题kubernetes v1.14更新证书的方法

说明：

kubeadm v1.14未提供kubeadm alpha phase kubeconfig all 之类的命令来自动生成/etc/kubernetes/*.conf文件，那只能按照下面步骤自行更新。
以下步骤中的 ip:port 按实际更改。

1.更新/etc/kubernetes/pki下的所有证书文件（不含ca证书）。
##renew all cert except ca cert
kubeadm alpha certs renew all

2.以下是手动生成/etc/kubernetes/*.conf文件的方法。

##generate admin.conf
kubectl config set-cluster kubernetes \
--certificate-authority=pki/ca.crt  \
--embed-certs=true \
--server=https://10.10.53.101:6443 \
--kubeconfig=admin.conf
 
kubectl config set-credentials kubernetes-admin \
--client-certificate=pki/apiserver-kubelet-client.crt \
--client-key=pki/apiserver-kubelet-client.key \
--embed-certs=true \
--kubeconfig=admin.conf
 
kubectl config set-context kubernetes-admin@kubernetes \
--cluster=kubernetes \
--user=kubernetes-admin \
--kubeconfig=admin.conf
 
kubectl config use-context kubernetes-admin@kubernetes --kubeconfig=admin.conf
 
##generate controller-manager.conf
kubectl config set-cluster kubernetes \
--certificate-authority=pki/ca.crt \
--embed-certs=true \
--server=https://10.10.53.101:6443 \
--kubeconfig=controller-manager.conf
 
kubectl config set-credentials system:kube-controller-manager \
--client-certificate=pki/apiserver-kubelet-client.crt \
--client-key=pki/apiserver-kubelet-client.key \
--embed-certs=true \
--kubeconfig=controller-manager.conf
 
kubectl config set-context system:kube-controller-manager@kubernetes \
--cluster=kubernetes \
--user=system:kube-controller-manager \
--kubeconfig=controller-manager.conf
 
kubectl config use-context system:kube-controller-manager@kubernetes --kubeconfig=controller-manager.conf
 
##generate scheduler.conf
kubectl config set-cluster kubernetes \
--certificate-authority=pki/ca.crt \
--embed-certs=true \
--server=https://10.10.53.101:6443 \
--kubeconfig=scheduler.conf
 
kubectl config set-credentials system:kube-scheduler \
--client-certificate=pki/apiserver-kubelet-client.crt \
--client-key=pki/apiserver-kubelet-client.key \
--embed-certs=true \
--kubeconfig=scheduler.conf
 
kubectl config set-context system:kube-scheduler@kubernetes \
--cluster=kubernetes \
--user=system:kube-scheduler \
--kubeconfig=scheduler.conf
 
kubectl config use-context system:kube-scheduler@kubernetes --kubeconfig=scheduler.conf
 
##generate kubelet.conf
kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) > kubelet.conf
 
systemctl stop kubelet
systemctl stop docker
 
##clear kubelet pki
mkdir -p /var/lib/kubelet/pki-bak
mv /var/lib/kubelet/pki/* /var/lib/kubelet/pki-bak/
 
systemctl start docker
systemctl start kubelet
##set admin config
cp /etc/kubernetes/admin.conf ~/.kube/config
 
##approve node csr
kubectl get csr|grep $(hostname)|awk '{print $1}'|xargs kubectl certificate approve
 

kubernetes v1.15更新证书的方法
1.更新/etc/kubernetes/pki目录下的所有证书（不包含ca证书）

kubeadm alpha certs renew all

2.检查csr状态，如果没有approved，则手动执行如下命令

kubectl get csr|grep -v NAME|awk ‘{print $1}’|xargs kubectl certificate approve

————————————————
原文链接：https://blog.csdn.net/qq_33235529/article/details/106053919

标题kubeadm安装 更新证书

一、查看证书过期时间

vim test.sh

for item in `find /etc/kubernetes/pki -maxdepth 2 -name "*.crt"`;
do openssl x509 -in $item -text -noout| grep Not;
echo ======================$item===============;
done

或者一个个看：

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '

二、通过命令续期
master操作
1、修改机器时间模拟证书过期
date -s “2025-12-30 12:00”
证书过期报错
[root@bogon ~]# kubectl get pod -n kube-system
Unable to connect to the server: x509: certificate has expired or is not yet valid
2、备份文件：

cp -r /etc/kubernetes  /etc/kubernetes_old
cp $HOME/.kube/config /home/lihongbao/aa/config/
#mv /var/lib/kubelet/pki /var/lib/kubelet/pki.old

3、重新生成
##kubeadm config view > kubeadm.yaml
3.1 重新生成证书：
在当前目录下编辑配置文件kubeadm.conf并写入以下内容：

apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.13.0
imageRepository: my.registry:5000/google_containers

3.2 更新证书命令：

kubeadm alpha certs renew all --config kubeadm.conf

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '
输出：
            Not Before: May 24 03:32:37 2019 GMT
            Not After : Dec 30 12:43:03 2025 GM

3.3 重新生成配置文件：

kubeadm init phase kubeconfig all --config kubeadm.conf

3.4 更新.kube下的配置文件：

cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

3.5 重启kube-apiserver,kube-controller,kube-scheduler,etcd这4个容器：

docker ps | grep -v pause | grep -E "etcd|scheduler|controller|apiserver" | awk '{print $1}' | awk '{print "docker","restart",$1}' | bash

或者重启docker

node操作
1、先在node节点备份文件

cp /etc/kubernetes/kubelet.conf  /etc/kubernetes/kubelet.conf_bak

2、在master节点上生成kubelet.conf并拷贝到node节点上

#kubeadm init phase kubeconfig kubelet --node-name <节点名称> --kubeconfig-dir /tmp/ --apiserver-advertise-address <集群VIP>，例如：
kubeadm init phase kubeconfig kubelet --node-name test1 --kubeconfig-dir /tmp/ --apiserver-advertise-address 192.168.180.45

scp /tmp/kubelet.conf root@192.168.180.46:/etc/kubernetes/

3、重启node节点的kubelet

 systemctl restart kubelet

1
三、编译源码Kubeadm，设置10年
master操作
1、安装go语言。

到go中文社区https://studygolang.com/下载对应版本的go语言包，配置go环境

##下载
wget https://studygolang.com/dl/golang/go1.14.1.linux-amd64.tar.gz
tar -zxvf go1.14.1.linux-amd64.tar.gz -C /usr/local
##添加环境变量:
vim /etc/profile
export PATH=/usr/local/go/bin:$PATH
##使环境生效
source /etc/profile
##查看go语言版本
go verison

warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go version go1.13.5 linux/amd64

一定要确定go语言有环境变量 不然后面编译会报错。

2、下载源码

#git下载
git clone https://github.com/kubernetes/kubernetes.git
#切换到v1.13.0分支
cd kubernetes && git checkout -b remotes/origin/release-1.13.0 v1.13.0
#浏览器打开下载
https://github.com/kubernetes/kubernetes/releases/tag/v1.13.0
3、修改时间为10年

vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14 版本之前

vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14 至今

const duration365d = time.Hour * 24 * 365 * 10
NotAfter: time.Now().Add(duration365d).UTC()

#编译kubeadm
make WHAT=cmd/kubeadm GOFLAGS=-v

#生成k8syaml文件
kubeadm config view > cluster.yaml

#更新 kubeadm，将 kubeadm 进行替换
cp /usr/bin/kubeadm /usr/bin/kubeadm.old
cp _output/bin/kubeadm /usr/bin/kubeadm
chmod 775 /usr/bin/kubeadm

4、备份文件

cp -r /etc/kubernetes /etc/kubernetes_old
cp $HOME/.kube/config /home/lihongbao/aa/config/
#mv /var/lib/kubelet/pki /var/lib/kubelet/pki.old

5、重新生成

5.1更新证书命令：

kubeadm alpha certs renew all --config cluster.conf

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ’ Not ’
输出：
Not Before: May 24 03:32:37 2019 GMT
Not After : Dec 30 12:43:03 2025 GM

5.2 重新生成配置文件：

rm -rf admin.conf controller-manager.conf kubelet.conf scheduler.conf

kubeadm init phase kubeconfig all --config cluster.conf

5.3 更新.kube下的配置文件：

cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown ( i d − u ) : (id -u): (id−u):(id -g) $HOME/.kube/config

5.4 重启kube-apiserver,kube-controller,kube-scheduler,etcd这4个容器：

docker ps | grep -v pause | grep -E “etcd|scheduler|controller|apiserver” | awk ‘{print $1}’ | awk ‘{print “docker”,“restart”,$1}’ | bash

或者重启docker

node操作
1、先在node节点备份文件

cp /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf_bak

2、在master节点上生成kubelet.conf并拷贝到node节点上

#kubeadm init phase kubeconfig kubelet --node-name <节点名称> --kubeconfig-dir /tmp/ --apiserver-advertise-address <集群VIP>，例如：
kubeadm init phase kubeconfig kubelet --node-name test1 --kubeconfig-dir /tmp/ --apiserver-advertise-address 192.168.180.45

scp /tmp/kubelet.conf root@192.168.180.46:/etc/kubernetes/

3、重启node节点的kubelet

systemctl restart kubelet
————————————————
版权声明：本文为CSDN博主「常名先生」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/jiangbenchu/article/details/109287837