Kubernetes certs 갱신하기

seungkyua 19.10.31

1,133 3 1

facebook twitter kakao link

3 1

facebook twitter kakao link

Kubeadm 으로 Kubernetes 를 설치할 경우 self signed 인증서는 1년 밖에 유효기간이 안됩니다.

그래서 반드시 인증서를 갱신해야 하는데 인증서 갱신 방법을 적었습니다.

kubernetes 1.14.x 버전에서 테스트 했습니다.

## 인증서 날짜 보기

# openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -text | grep Not

Not Before: Feb 20 06:39:50 2019 GMT

Not After : Feb 17 06:39:50 2029 GMT

# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep Not

Not Before: Feb 20 06:39:50 2019 GMT

Not After : Apr 22 08:44:16 2020 GMT

# openssl x509 -in /etc/kubernetes/pki/apiserver-kubelet-client.crt -noout -text | grep Not

Not Before: Feb 20 06:39:50 2019 GMT

Not After : Apr 22 08:44:17 2020 GMT

# openssl x509 -in /etc/kubernetes/pki/front-proxy-client.crt -noout -text | grep Not

Not Before: Feb 20 06:39:50 2019 GMT

Not After : Apr 22 08:44:17 2020 GMT

# openssl x509 -in /usr/local/share/ca-certificates/etcd-ca.crt -noout -text | grep Not

Not Before: Feb 20 06:29:53 2019 GMT

Not After : Jan 27 06:29:53 2119 GMT

## 서버 내의 인증서 보기

## kube-apiserver

# echo -n | openssl s_client -connect localhost:6443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## kube-controller-manager

# echo -n | openssl s_client -connect localhost:10257 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## kube-scheduler

# echo -n | openssl s_client -connect localhost:10259 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## kubelet

# echo -n | openssl s_client -connect [서버 호스트명]:10250 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## 기존의 kubeconfig.yaml 확인

# kubeadm config view --kubeconfig /etc/kubernetes/admin.conf

[ Master 노드 Certs 갱신 - Master 노드에서 각각 실행 ]

## 1. certs 백업

# mkdir -p ~/ahnsk/renewal-certs/certs-backup

# cp -r /etc/kubernetes/pki/* ~/ahnsk/renewal-certs/certs-backup/

## 2. kubeconfig.yaml 생성 (master ip를 넣을 것)

# cd ~/ahnsk/renewal-certs

# cat < ~/ahnsk/renewal-certs/kubeadm.yaml

apiVersion: kubeadm.k8s.io/v1alpha1

kind: MasterConfiguration

api:

advertiseAddress: 서버 IP

kubernetesVersion: v1.14.3

EOF

## 3. certs 갱신

# kubeadm alpha certs renew apiserver

# kubeadm alpha certs renew apiserver-kubelet-client

# kubeadm alpha certs renew front-proxy-client

## 4. config 백업

# mkdir -p ~/ahnsk/renewal-certs/config-backup

# cp -r /etc/kubernetes/*.conf ~/ahnsk/renewal-certs/config-backup/

## 5. config 생성

# rm -f /etc/kubernetes/*.conf

# kubeadm init phase kubeconfig all

## 6. 서비스 재시작

# kill -s SIGHUP $(pidof kube-apiserver)

# kill -s SIGHUP $(pidof kube-controller-manager)

# kill -s SIGHUP $(pidof kube-scheduler)

## 서버 내의 인증서 보기

## kube-apiserver

# echo -n | openssl s_client -connect localhost:6443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## kube-controller-manager

# echo -n | openssl s_client -connect localhost:10257 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## kube-scheduler

# echo -n | openssl s_client -connect localhost:10259 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## 7. kubelet pki 삭제 및 재시작

# kubectl drain --ignore-daemonsets [서버 호스트명]

# systemctl stop kubelet

# rm -f /var/lib/kubelet/pki/*

# systemctl stop docker

# systemctl start docker

# systemctl start kubelet

# kubectl uncordon [서버 호스트명]

## 서버 내의 kubelet 인증서 보기

# echo -n | openssl s_client -connect [서버 호스트명]:10250 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

## 8. admin.conf 복사

# cp -f /etc/kubernetes/admin.conf ~/.kube/config

[ Woker Certs 갱신 - Master 노드 Token 생성 ]

## 9. token 생성

# kubeadm token create

460oul.c5hnfmp9dx90aqx1

[ Woker 노드 각각 Certs 갱신 ]

## 10. worker node drain

# kubectl drain --ignore-daemonsets --delete-local-data [서버 호스트명]

## 11. Worker node kubelete restart (worker 노드에서 실행)

# systemctl stop kubelet

# rm -f /etc/kubernetes/kubelet.conf

# rm -f /var/lib/kubelet/pki/*

# new_token=460oul.c5hnfmp9dx90aqx1

# sed -i "s/token: .*/token: $new_token/" /etc/kubernetes/bootstrap-kubelet.conf

# systemctl stop docker

# systemctl start docker

# systemctl start kubelet

## 12. worker node uncordon (k1-master 에서 실행)

# kubectl uncordon [서버 호스트명]

## kubelet 인증서 보기 (worker 노드에서)

# echo -n | openssl s_client -connect [서버 호스트명]:10250 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not

Not Before: Oct 30 01:33:12 2019 GMT

Not After : Oct 29 01:33:12 2020 GMT

# openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -text -noout | grep Not

Not Before: Oct 30 02:28:00 2019 GMT

Not After : Oct 29 02:28:00 2020 GMT

# openssl x509 -in /var/lib/kubelet/pki/kubelet.crt -text -noout | grep Not

Not Before: Oct 30 01:33:12 2019 GMT

Not After : Oct 29 01:33:12 2020 GMT

#Kubernetes