目录
引言
随着云计算技术的飞速发展，Kubernetes已成为企业构建、扩展和管理容器化应用程序的首选平台。然而，随着集群的持续运行，在企业中经常会遇到一个问题——Kubernetes集群的证书过期。这个问题不仅影响集群的稳定性，还可能带来安全风险。本文将深入探讨Kubernetes证书过期的问题、影响以及解决方案
一、证书过期的问题与影响
Kubernetes集群中的各个组件（如API服务器、节点、控制器管理器等）之间使用证书进行身份验证和安全传输数据。然而，由于证书具有有效期限，一旦证书过期，集群中的组件将无法正常通信，导致应用程序无法正常运行。
二、解决方案
（一）查看证书剩余时间
[root@master01 ~]#kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf May 16, 2025 07:16 UTC 330d no
apiserver May 16, 2025 07:16 UTC 330d ca no
apiserver-etcd-client May 16, 2025 07:16 UTC 330d etcd-ca no
apiserver-kubelet-client May 16, 2025 07:16 UTC 330d ca no
controller-manager.conf May 16, 2025 07:16 UTC 330d no
etcd-healthcheck-client May 16, 2025 07:16 UTC 330d etcd-ca no
etcd-peer May 16, 2025 07:16 UTC 330d etcd-ca no
etcd-server May 16, 2025 07:16 UTC 330d etcd-ca no
front-proxy-client May 16, 2025 07:16 UTC 330d front-proxy-ca no
scheduler.conf May 16, 2025 07:16 UTC 330d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca May 14, 2034 07:16 UTC 9y no
etcd-ca May 14, 2034 07:16 UTC 9y no
front-proxy-ca May 14, 2034 07:16 UTC 9y no 标题含义
证书作用
根证书
（二）备份重要数据
数据对运维人员来说是非常重要的东西，为防止证书更新失败，需要将之前的证书进行备份，万一证书更新失败后，K8S集群还能再有效期内正常运行，而后重新更新证书
需要进行备份的文件有两个
[root@master01 ~]#ll /etc/kubernetes/pki/
总用量 68
-rw-r--r-- 1 root root 1265 5月 16 15:16 apiserver.crt
-rw-r--r-- 1 root root 1135 5月 16 15:16 apiserver-etcd-client.crt
-rw------- 1 root root 1675 5月 16 15:16 apiserver-etcd-client.key
-rw------- 1 root root 1675 5月 16 15:16 apiserver.key
-rw-r--r-- 1 root root 1143 5月 16 15:16 apiserver-kubelet-client.crt
-rw------- 1 root root 1675 5月 16 15:16 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1066 5月 16 15:16 ca.crt
-rw------- 1 root root 1675 5月 16 15:16 ca.key
drwxr-xr-x 2 root root 162 5月 16 15:16 etcd
-rw-r--r-- 1 root root 1078 5月 16 15:16 front-proxy-ca.crt
-rw------- 1 root root 1675 5月 16 15:16 front-proxy-ca.key
-rw-r--r-- 1 root root 1103 5月 16 15:16 front-proxy-client.crt
-rw------- 1 root root 1679 5月 16 15:16 front-proxy-client.key
-rw------- 1 root root 1679 5月 16 15:16 sa.key
-rw------- 1 root root 451 5月 16 15:16 sa.pub
[root@master01 ~]#ll /var/lib/etcd/
总用量 0
drwx------ 4 root root 29 6月 13 14:44 member
'------------------------------------------------------------------------------------'
/etc/kubernetes/pki/：此目录存放的是旧的证书文件
/var/lib/etcd/：存放etcd数据，整个集群的业务以及组件通信都在其中备份数据
[root@master01 ~]#mkdir -p /k8s/bak/
#备份证书
[root@master01 ~]#cp -ar /etc/kubernetes/pki/ /k8s/bak/
#备份数据库
[root@master01 ~]#cp -ar /var/lib/etcd/ /k8s/bak/
[root@master01 ~]#ll /k8s/bak/
总用量 4
drwx------ 3 root root 20 6月 13 14:44 etcd
drwxr-xr-x 3 root root 4096 6月 6 08:51 pki（三）更新证书
根证书默认都是十年，所以需要升级客户端证书
[root@master01 ~]#kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
升级后查看证书有效期时限
（四）重启相关组件的pod
更新完证书之后，相关pod还是以之前的证书为凭证，所以需要重启相关组件，使新的证书生效
在更新证书时，同样会有提示信息
直接删除之前的组件pod，它们不是由pod控制器管理，而是由集群管理工具集群管理工具kubeadm直接重新拉取
[root@master01 ~]#kubectl delete pods -n kube-system kube-apiserver-master01 kube-controller-manager-master01 kube-scheduler-master01 etcd-master01
pod "kube-apiserver-master01" deleted
pod "kube-controller-manager-master01" deleted
pod "kube-scheduler-master01" deleted
pod "etcd-master01" deleted
[root@master01 ~]#kubectl get pod -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-74ff55c5b-dwzdp 1/1 Running 10 34d
coredns-74ff55c5b-ws8c8 1/1 Running 10 34d
etcd-master01 1/1 Running 10 9s
kube-apiserver-master01 1/1 Running 5 9s
kube-controller-manager-master01 1/1 Running 45 9s
kube-proxy-58zbl 1/1 Running 0 3d6h
kube-proxy-9v7jw 1/1 Running 0 3d6h
kube-proxy-xdgb4 1/1 Running 0 3d6h
kube-scheduler-master01 1/1 Running 48 9s
