[root@k8s-master ~]# kubeadm alpha certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Aug 30, 2022 07:53 UTC 363d no apiserver Aug 30, 2022 07:52 UTC 363d ca no apiserver-etcd-client Aug 30, 2022 07:53 UTC 363d etcd-ca no apiserver-kubelet-client Aug 30, 2022 07:52 UTC 363d ca no controller-manager.conf Aug 30, 2022 07:53 UTC 363d no etcd-healthcheck-client Aug 30, 2022 07:53 UTC 363d etcd-ca no etcd-peer Aug 30, 2022 07:53 UTC 363d etcd-ca no etcd-server Aug 30, 2022 07:53 UTC 363d etcd-ca no front-proxy-client Aug 30, 2022 07:53 UTC 363d front-proxy-ca no scheduler.conf Aug 30, 2022 07:53 UTC 363d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Aug 28, 2031 07:52 UTC 9y no etcd-ca Aug 28, 2031 07:53 UTC 9y no front-proxy-ca Aug 28, 2031 07:53 UTC 9y no
vim cmd/kubeadm/app/constants/constants.go，找到CertificateValidity，修改如下
1 2 3 4 5 6 7 8 9 10 11 12 13
.... const ( // KubernetesDir is the directory Kubernetes owns for storing various configuration files KubernetesDir = "/etc/kubernetes" // ManifestsSubDirName defines directory name to store manifests ManifestsSubDirName = "manifests" // TempDirForKubeadm defines temporary directory for kubeadm // should be joined with KubernetesDir. TempDirForKubeadm = "tmp"
// CertificateValidity defines the validity for all the signed certificates generated by kubeadm CertificateValidity = time.Hour * 24 * 365 * 100 ....
1.3. 安装编译软件
1
yum -y install gcc automake autoconf libtool make
安装go编译环境，这里就直接使用yum安装
查看go是否安装过
1 2
[root@k8s-master kubernetes]# go env -bash: go: command not found
查看yum的Golang
1 2 3 4 5 6 7 8 9 10 11 12 13 14
[root@k8s-master kubernetes]# yum info golang Last metadata expiration check: 0:06:47 ago on Wed 01 Sep 2021 10:07:23 AM CST. Available Packages Name : golang Version : 1.15.14 Release : 1.module_el8.4.0+882+ab13bcd9 Architecture : x86_64 Size : 708 k Source : golang-1.15.14-1.module_el8.4.0+882+ab13bcd9.src.rpm Repository : AppStream Summary : The Go Programming Language URL : http://golang.org/ License : BSD and Public Domain Description : The Go Programming Language.
[root@k8s-master kubernetes]# make WHAT=cmd/kubeadm +++ [0901 10:20:55] Building go targets for linux/amd64: ./vendor/k8s.io/code-generator/cmd/deepcopy-gen +++ [0901 10:21:08] Building go targets for linux/amd64: ./vendor/k8s.io/code-generator/cmd/defaulter-gen +++ [0901 10:21:18] Building go targets for linux/amd64: ./vendor/k8s.io/code-generator/cmd/conversion-gen +++ [0901 10:21:37] Building go targets for linux/amd64: ./vendor/k8s.io/kube-openapi/cmd/openapi-gen +++ [0901 10:21:53] Building go targets for linux/amd64: ./vendor/github.com/go-bindata/go-bindata/go-bindata warning: ignoring symlink /root/kubernetes/_output/local/go/src/k8s.io/kubernetes go: warning: "k8s.io/kubernetes/vendor/github.com/go-bindata/go-bindata/..." matched no packages +++ [0901 10:21:55] Building go targets for linux/amd64: cmd/kubeadm
cd /etc/kubernetes/pki kubeadm alpha certs renew all
输出如下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
[root@k8s-master kubernetes]# cd /etc/kubernetes/pki [root@k8s-master pki]# kubeadm alpha certs renew all [renew] Reading configuration from the cluster... [renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed
[root@k8s-master pki]# kubeadm alpha certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Aug 08, 2121 02:32 UTC 99y no apiserver Aug 08, 2121 02:32 UTC 99y ca no apiserver-etcd-client Aug 08, 2121 02:32 UTC 99y etcd-ca no apiserver-kubelet-client Aug 08, 2121 02:32 UTC 99y ca no controller-manager.conf Aug 08, 2121 02:32 UTC 99y no etcd-healthcheck-client Aug 08, 2121 02:32 UTC 99y etcd-ca no etcd-peer Aug 08, 2121 02:32 UTC 99y etcd-ca no etcd-server Aug 08, 2121 02:32 UTC 99y etcd-ca no front-proxy-client Aug 08, 2121 02:32 UTC 99y front-proxy-ca no scheduler.conf Aug 08, 2121 02:32 UTC 99y no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Aug 28, 2031 07:52 UTC 9y no etcd-ca Aug 28, 2031 07:53 UTC 9y no front-proxy-ca Aug 28, 2031 07:53 UTC 9y no
查看集群状态是否OK。
1 2 3 4 5
[root@k8s-master pki]# kubectl get node NAME STATUS ROLES AGE VERSION k8s-master Ready master 42h v1.18.0 k8s-node1 Ready <none> 42h v1.18.0 k8s-node2 Ready <none> 42h v1.18.0