默认支持10年有效证书

默认支持10年有效证书

kubectl的客户端证书默认支持10年有效期,可以极大降低使用k8e的更换证书的难度。

#k8e证书放在这里:
[[email protected] ~]$ sudo ls -ls /var/lib/k8e/server/tls
total 116
4 -rw-r--r-- 1 root root 1173 Mar 31 21:58 client-admin.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-admin.key
4 -rw-r--r-- 1 root root 1182 Mar 31 21:58 client-auth-proxy.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-auth-proxy.key
4 -rw------- 1 root root  570 Mar 31 21:44 client-ca.crt
4 -rw------- 1 root root  227 Mar 31 21:44 client-ca.key
4 -rw-r--r-- 1 root root 1165 Mar 31 21:58 client-controller.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-controller.key
4 -rw-r--r-- 1 root root 1161 Mar 31 21:58 client-k8e-cloud-controller.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-k8e-cloud-controller.key
4 -rw-r--r-- 1 root root 1153 Mar 31 21:58 client-k8e-controller.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-k8e-controller.key
4 -rw-r--r-- 1 root root 1144 Mar 31 21:58 client-kube-apiserver.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-kube-apiserver.key
4 -rw------- 1 root root  227 Mar 31 21:58 client-kubelet.key
4 -rw-r--r-- 1 root root 1144 Mar 31 21:58 client-kube-proxy.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-kube-proxy.key
4 -rw-r--r-- 1 root root 1153 Mar 31 21:58 client-scheduler.crt
4 -rw------- 1 root root  227 Mar 31 21:58 client-scheduler.key
8 -rw-r--r-- 1 root root 4365 Mar 31 22:04 dynamic-cert.json
0 drwx------ 2 root root  232 Mar 31 21:58 etcd
4 -rw------- 1 root root  591 Mar 31 21:44 request-header-ca.crt
4 -rw------- 1 root root  227 Mar 31 21:44 request-header-ca.key
4 -rw------- 1 root root  570 Mar 31 21:44 server-ca.crt
4 -rw------- 1 root root  227 Mar 31 21:44 server-ca.key
4 -rw------- 1 root root 1679 Mar 31 21:44 service.key
4 -rw-r--r-- 1 root root 1400 Mar 31 21:58 serving-kube-apiserver.crt
4 -rw------- 1 root root  227 Mar 31 21:58 serving-kube-apiserver.key
4 -rw------- 1 root root  227 Mar 31 21:58 serving-kubelet.key
0 drwx------ 2 root root   84 Mar 31 21:58 temporary-certs

# 验证一下10年有效期:
[[email protected] ~]$ sudo openssl x509 -in /var/lib/k8e/server/tls/client-admin.crt -noout -dates
notBefore=Mar 31 21:44:12 2022 GMT
notAfter=Mar 28 21:58:06 2032 GMT

当然k8e默认是支持无痛更新证书的,操作如下:

[[email protected] ~]$ sudo /usr/local/bin/k8e certificate rotate
INFO[2022-03-31T22:56:15.675352946Z] Server detected, rotating server certificates 
INFO[2022-03-31T22:56:15.675540013Z] Rotating certificates for admin service      
INFO[2022-03-31T22:56:15.675613081Z] Rotating certificates for etcd service       
INFO[2022-03-31T22:56:15.675700587Z] Rotating certificates for api-server service 
INFO[2022-03-31T22:56:15.675772295Z] Rotating certificates for controller-manager service 
INFO[2022-03-31T22:56:15.675858493Z] Rotating certificates for cloud-controller service 
INFO[2022-03-31T22:56:15.675941033Z] Rotating certificates for scheduler service  
INFO[2022-03-31T22:56:15.676010268Z] Rotating certificates for k8e-server service 
INFO[2022-03-31T22:56:15.676159542Z] Rotating dynamic listener certificate        
INFO[2022-03-31T22:56:15.676253293Z] Rotating certificates for k8e-controller service 
INFO[2022-03-31T22:56:15.676337271Z] Rotating certificates for auth-proxy service 
INFO[2022-03-31T22:56:15.676382604Z] Rotating certificates for kubelet service    
INFO[2022-03-31T22:56:15.676419579Z] Rotating certificates for kube-proxy service 
INFO[2022-03-31T22:56:15.677357403Z] Successfully backed up certificates for all services to path /var/lib/k8e/server/tls-1648767375, please restart k8e server or agent to rotate certificates 

[[email protected] ~]$ sudo systemctl restart k8e
[[email protected] ~]$ kubectl get no
NAME                                               STATUS   ROLES                       AGE   VERSION
ip-172-31-17-149.ap-northeast-2.compute.internal   Ready    control-plane,etcd,master   52m   v1.21.11+k8e1
ip-172-31-27-151.ap-northeast-2.compute.internal   Ready    control-plane,etcd,master   72m   v1.21.11+k8e1
ip-172-31-29-191.ap-northeast-2.compute.internal   Ready    control-plane,etcd,master   58m   v1.21.11+k8e1

搞定!