k8s 证书续期验证

gene.liu@live.com (Gene Liu) — Thu, 18 Feb 2021 22:39:49 +0000

更改为历史时间

        
        
        
    
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2020-02-17 16:27:00"

[root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/change-notes-time.yml 
- name: Prepare and reset the required environment for a new build
  hosts: all
  gather_facts: yes
  user: root
  vars:
    new_time: "2021-02-18 12:50:00"
  tasks:
    - name: Disable ntp
      command: "timedatectl set-ntp no"

    - name: Set the new time
      command: "timedatectl set-time '{{ new_time }}'"

    - name: Enable ntp
      command: "timedatectl set-ntp yes"

部署新集群

        
nsp-kubernetes-deployer.bash -i 135.121.159.105 -l node-labels-standard-3nodes.yml

将时间更改为现在

        
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2021-02-17 16:27:00"

续期证书 (在所有主节点上)

https://v1-16.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ 对于 1.16.3，renew all 似乎效果不佳。逐个续期每个组件。

读取 Kubernetes Secrets

gene.liu@live.com (Gene Liu) — Thu, 12 Mar 2020 17:00:00 +0000

关于读取 Kubernetes Secret 的简短说明。

        
kubectl get secret mysecret -o yaml

echo "the-encoded-string" | base64 --decode

kubectl get secret nsp-k8s-certs-expiration -o jsonpath="{.data.k8s-certs-expiration.txt}" | base64 --decode

K8s - 标签 - Gene.Tech

k8s 证书续期验证

更改为历史时间

部署新集群

将时间更改为现在

续期证书 (在所有主节点上)

读取 Kubernetes Secrets