k8s 1.20.5 更新证书

# 准备编译的软件
yum install gcc make rsync unzip wget  -y

# 安装 golang
mkdir -p /data/software 
cd /data/software/
wget https://dl.google.com/go/go1.15.1.linux-amd64.tar.gz

tar zxvf go1.15.1.linux-amd64.tar.gz  -C /usr/local

# 添加环境变量
vi /etc/profile

export GOROOT=/usr/local/go
export GOPATH=/usr/local/gopath
export PATH=$PATH:$GOROOT/bin

source /etc/profile

# 下载 kubernetes 源码
cd /data/software
wget https://codeload.github.com/kubernetes/kubernetes/zip/refs/tags/v1.20.5
unzip kubernetes-1.20.5.zip 

# 修改源码增加证书时间
cd kubernetes-1.20.5/
 
vi cmd/kubeadm/app/constants/constants.go
- CertificateValidity = time.Hour * 24 * 365
+ CertificateValidity = time.Hour * 24 * 365 * 10

vi staging/src/k8s.io/client-go/util/cert/cert.go
- const duration365d = time.Hour * 24 * 365
+ const duration365d = time.Hour * 24 * 365 * 10

vi hack/lib/version.sh
      if git_status=$("${git[@]}" status --porcelain 2>/dev/null) && [[ -z ${git_status} ]]; then
        KUBE_GIT_TREE_STATE="clean"
      else
-        KUBE_GIT_TREE_STATE="dirty"
+       KUBE_GIT_TREE_STATE="clean"
      fi

cd /data/software/kubernetes-1.20.5/

# 重新编译 kubeadm
make all WHAT=cmd/kubeadm GOFLAGS=-v

# 编译 kubelet
make all WHAT=cmd/kubelet GOFLAGS=-v

# 编译 kubectl
make all WHAT=cmd/kubectl GOFLAGS=-v

# 编译完的 kubeadm 在 _output/bin/kubeadm 目录下，其中 bin 是使用了软连接，真实路径是 _output/local/bin/linux/amd64/kubeadm

# 备份，更改命令
mv /usr/bin/kubeadm /usr/bin/kubeadm_bak
cp _output/local/bin/linux/amd64/kubeadm /usr/bin/kubeadm
chmod +x /usr/bin/kubeadm

# 备份配置
cp -r /etc/kubernetes/pki /etc/kubernetes/pki.backup
mkdir -p /etc/kubernetes/back
cp /etc/kubernetes/*.conf /etc/kubernetes/back

# 检查证书到期时间
kubeadm alpha certs check-expiration

# 更新证书
kubeadm alpha certs renew all

# 再次检查证书到期时间
kubeadm alpha certs check-expiration

# 重启 docker 让 apiserver、controller、scheduler 配置生效，如果不是使用 docker 作为容器运行时的话直接在 k8s 中删除
docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' 

systemctl restart kubelet.service 

# 在 K8S 中重启 apiserver、controller、scheduler、etcd
# kubectl -n kube-system delete pod kube-apiserver-k8s-master kube-controller-manager-k8s-master kube-scheduler-k8s-master  etcd-k8s-master

多 master 的集群建议操作以下步骤

# 1 生成集群配置yaml
kubeadm config view > /root/kubeadm.yaml

# 2 通过集群配置更新证书
kubeadm alpha certs renew all –config=/root/kubeadm.yaml

# 3 查看证书时间
kubeadm alpha certs check-expiration

# 4 重启docker让apiserver、controller、scheduler配置生效
docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' |xargs docker restart

参考：
https://blog.51cto.com/u_12835116/2850446
https://blog.51cto.com/legehappy/4895615