k8s 证书续期验证

更改为历史时间

/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2020-02-17 16:27:00"

[root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/change-notes-time.yml 
- name: Prepare and reset the required environment for a new build
  hosts: all
  gather_facts: yes
  user: root
  vars:
    new_time: "2021-02-18 12:50:00"
  tasks:
    - name: Disable ntp
      command: "timedatectl set-ntp no"

    - name: Set the new time
      command: "timedatectl set-time '{{ new_time }}'"

    - name: Enable ntp
      command: "timedatectl set-ntp yes"

部署新集群

nsp-kubernetes-deployer.bash -i 135.121.159.105 -l node-labels-standard-3nodes.yml

将时间更改为现在

/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2021-02-17 16:27:00"

续期证书 (在所有主节点上)

1. https://v1-16.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ 对于 1.16.3，renew all 似乎效果不佳。逐个续期每个组件。

   [root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/renew-certs.yml 
   - name: Prepare and reset the required environment for a new build
     hosts: "{{ groups['kube-master'] }}"
     gather_facts: yes
     user: root
     vars:
       cluster_components:
       - admin.conf
       - apiserver
       - apiserver-kubelet-client
       - controller-manager.conf
       - front-proxy-client
       - scheduler.conf
     tasks:
       - name: Renew certificates
         command: "kubeadm alpha certs renew {{ item }} --config /etc/kubernetes/kubeadm-config.yaml"
         loop: "{{ cluster_components }}"

2. 在使用 kubeadm init 创建的节点上，在 kubeadm 版本 1.17 之前，存在一个 bug，您必须手动修改 kubelet.conf 的内容。kubeadm init 完成后，您应该通过将 client-certificate-data 和 client-key-data 替换为以下内容来更新 kubelet.conf 以指向轮换的 kubelet 客户端证书：

   client-certificate: /etc/kubernetes/pki/apiserver-kubelet-client.crt
   client-key: /etc/kubernetes/pki/apiserver-kubelet-client.key

3. 重启 kube-apiserver

   docker stop $(docker ps | grep kube-apiserver | awk {'print $1'}) 

4. 更新 .kube/config 以解决类似 “error: You must be logged in to the server (Unauthorized)” 的错误

   ...
   current-context: kubernetes-admin@cluster.local
   kind: Config
   preferences: {}
   users:
   - name: kubernetes-admin
     user:
       client-certificate: /etc/kubernetes/pki/apiserver-kubelet-client.crt
       client-key: /etc/kubernetes/pki/apiserver-kubelet-client.key