Kubernetes certificate validity period modification

Certificate validity period modification

[[email protected] pki]# openssl x509 -in apiserver.crt -text -noout

First download the source code of kubeadm, and modify the function of apiserver one-year certificate distribution, from 1 year to 10 years.(Requires go language environment)

go Chinese Community

1.go locale

[[email protected] data]# tar -zxvf go1.16.5.linux-amd64.tar.gz -C /usr/local[[email protected] data]# vim /etc/profileexport PATH=$PATH:/usr/local/go/bin[[email protected] data]# source /etc/profile[[email protected] data]# go version

• 1
• 2
• 3
• 4
• 5

2. Download the kubernetes source code

[[email protected] data]# git clone https://github.com/kubernetes/kubernetes.git[[email protected] data]# cd kubernetes[[email protected] kubernetes]# kubeadm versionkubeadm version: &version.Info{Major:"1", Minor:"15", GitVersion:"v1.21.2",[[email protected] kubernetes]# git checkout -b remotes/origin/release-1.21.2 v1.21.2

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9

3. Modify the Kubeadm source package update certificate policy

[[email protected] kubernetes]# vim staging/src/k8s.io/client-go/util/cert/cert.go# kubeadm before version 1.14vi cmd/kubeadm/app/constants/constants.go# kubeadm 1.21.2 to date// NewSignedCert {const duration365d = time.Hour * 24 * 365 * 100NotAfter: time.Now().Add(duration365d).UTC(),}[[email protected] kubernetes]# make WHAT=cmd/kubeadm GOFLAGS=-v[[email protected] kubernetes]# cp /usr/bin/kubeadm /usr/bin/kubeadm.old[[email protected] kubernetes]# cp _output/bin/kubeadm /usr/bin/kubeadm[[email protected] kubernetes]# chmod a+x /usr/bin/kubeadm[[email protected] kubernetes]# cd /etc/kubernetes/[[email protected] kubernetes]# cp -r pki /pki.oldNew certificate generation[[email protected] ~]# kubeadm certs renew all --config=/root/kubeadm_init/kubeadm-config.yaml--config is the yaml file that originally installed the k8s cluster[[email protected] ~]# cd /etc/kubernetes/pkiView certificate age[[email protected] pki]# openssl x509 -in apiserver.crt -text -nooutView kubeadm-config.yaml location[[email protected] pki]# cd /etc/kubernetes/pki/openssl x509 -in apiserver.crt -text -nooutk8sv1.19.10 version:Need to add alpha commandkubeadm alpha certs renew all --config=/root/kubeadm_init/kubeadm-config.yamlYou also need to add alpha to view the expiration time of all certificateskubeadm alpha certs check-expiration