# k8s 证书续期验证

## 更改为历史时间

```bash
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2020-02-17 16:27:00"

[root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/change-notes-time.yml 
- name: Prepare and reset the required environment for a new build
  hosts: all
  gather_facts: yes
  user: root
  vars:
    new_time: "2021-02-18 12:50:00"
  tasks:
    - name: Disable ntp
      command: "timedatectl set-ntp no"

    - name: Set the new time
      command: "timedatectl set-time '{{ new_time }}'"

    - name: Enable ntp
      command: "timedatectl set-ntp yes"
```

## 部署新集群

```bash
nsp-kubernetes-deployer.bash -i 135.121.159.105 -l node-labels-standard-3nodes.yml
```

## 将时间更改为现在

```bash
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2021-02-17 16:27:00"
```

## 续期证书 (在所有主节点上)

1. https://v1-16.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/
   对于 1.16.3，`renew all` 似乎效果不佳。逐个续期每个组件。

   ```yaml
   [root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/renew-certs.yml 
   - name: Prepare and reset the required environment for a new build
     hosts: "{{ groups['kube-master'] }}"
     gather_facts: yes
     user: root
     vars:
       cluster_components:
       - admin.conf
       - apiserver
       - apiserver-kubelet-client
       - controller-manager.conf
       - front-proxy-client
       - scheduler.conf
     tasks:
       - name: Renew certificates
         command: "kubeadm alpha certs renew {{ item }} --config /etc/kubernetes/kubeadm-config.yaml"
         loop: "{{ cluster_components }}"
   ```

2. 在使用 `kubeadm init` 创建的节点上，在 kubeadm 版本 1.17 之前，存在一个 bug，您必须手动修改 `kubelet.conf` 的内容。`kubeadm init` 完成后，您应该通过将 `client-certificate-data` 和 `client-key-data` 替换为以下内容来更新 `kubelet.conf` 以指向轮换的 kubelet 客户端证书：

   ```yaml
   client-certificate: /etc/kubernetes/pki/apiserver-kubelet-client.crt
   client-key: /etc/kubernetes/pki/apiserver-kubelet-client.key
   ```

3. 重启 `kube-apiserver`

   ```bash
   docker stop $(docker ps | grep kube-apiserver | awk {'print $1'}) 
   ```

4. 更新 `.kube/config` 以解决类似 "error: You must be logged in to the server (Unauthorized)" 的错误

   ```yaml
   ...
   current-context: kubernetes-admin@cluster.local
   kind: Config
   preferences: {}
   users:
   - name: kubernetes-admin
     user:
       client-certificate: /etc/kubernetes/pki/apiserver-kubelet-client.crt
       client-key: /etc/kubernetes/pki/apiserver-kubelet-client.key
   ```