# kubeadm alpha certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf Jun 20, 2021 11:21 UTC 364d no apiserver Jun 20, 2021 11:21 UTC 364d ca no apiserver-etcd-client Jun 20, 2021 11:21 UTC 364d etcd-ca no apiserver-kubelet-client Jun 20, 2021 11:21 UTC 364d ca no controller-manager.conf Jun 20, 2021 11:21 UTC 364d no etcd-healthcheck-client Jun 20, 2021 11:21 UTC 364d etcd-ca no etcd-peer Jun 20, 2021 11:21 UTC 364d etcd-ca no etcd-server Jun 20, 2021 11:21 UTC 364d etcd-ca no front-proxy-client Jun 20, 2021 11:21 UTC 364d front-proxy-ca no scheduler.conf Jun 20, 2021 11:21 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Jun 18, 2030 11:21 UTC 9y no etcd-ca Jun 18, 2030 11:21 UTC 9y no front-proxy-ca Jun 18, 2030 11:21 UTC 9y no
vim cmd/kubeadm/app/constants/constants.go，找到CertificateValidity，修改如下
1 2 3 4 5 6 7 8 9 10 11 12 13
.... const ( // KubernetesDir is the directory Kubernetes owns for storing various configuration files KubernetesDir = "/etc/kubernetes" // ManifestsSubDirName defines directory name to store manifests ManifestsSubDirName = "manifests" // TempDirForKubeadm defines temporary directory for kubeadm // should be joined with KubernetesDir. TempDirForKubeadm = "tmp"
// CertificateValidity defines the validity for all the signed certificates generated by kubeadm CertificateValidity = time.Hour * 24 * 365 * 100 ....
（4）、编译kubeadm
1
make WHAT=cmd/kubeadm
编译完生成如下目录和二进制文件
1 2 3 4 5 6 7 8 9
# ll _output/bin/ total 76172 -rwxr-xr-x 1 root root 6799360 Jun 20 21:08 conversion-gen -rwxr-xr-x 1 root root 6778880 Jun 20 21:08 deepcopy-gen -rwxr-xr-x 1 root root 6750208 Jun 20 21:08 defaulter-gen -rwxr-xr-x 1 root root 4883629 Jun 20 21:08 go2make -rwxr-xr-x 1 root root 2109440 Jun 20 21:09 go-bindata -rwxr-xr-x 1 root root 39256064 Jun 20 21:11 kubeadm -rwxr-xr-x 1 root root 11419648 Jun 20 21:09 openapi-gen
cd /etc/kubernetes/pki kubeadm alpha certs renew all
输出如下
1 2 3 4 5 6 7 8 9 10 11 12
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed certificate for serving the Kubernetes API renewed certificate the apiserver uses to access etcd renewed certificate for the API server to connect to kubelet renewed certificate embedded in the kubeconfig file for the controller manager to use renewed certificate for liveness probes to healthcheck etcd renewed certificate for etcd nodes to communicate with each other renewed certificate for serving etcd renewed certificate for the front proxy client renewed certificate embedded in the kubeconfig file for the scheduler manager to use renewed
[root@k8s-master pki]# kubeadm alpha certs check-expiration [check-expiration] Reading configuration from the cluster... [check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED admin.conf May 27, 2120 13:25 UTC 99y no apiserver May 27, 2120 13:25 UTC 99y ca no apiserver-etcd-client May 27, 2120 13:25 UTC 99y etcd-ca no apiserver-kubelet-client May 27, 2120 13:25 UTC 99y ca no controller-manager.conf May 27, 2120 13:25 UTC 99y no etcd-healthcheck-client May 27, 2120 13:25 UTC 99y etcd-ca no etcd-peer May 27, 2120 13:25 UTC 99y etcd-ca no etcd-server May 27, 2120 13:25 UTC 99y etcd-ca no front-proxy-client May 27, 2120 13:25 UTC 99y front-proxy-ca no scheduler.conf May 27, 2120 13:25 UTC 99y no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED ca Jun 18, 2030 11:21 UTC 9y no etcd-ca Jun 18, 2030 11:21 UTC 9y no front-proxy-ca Jun 18, 2030 11:21 UTC 9y no
