检查证书的过期时间
官网地址: https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/
[root@master ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Nov 21, 2023 07:43 UTC 357d no
apiserver Nov 21, 2023 07:43 UTC 357d ca no
apiserver-etcd-client Nov 21, 2023 07:43 UTC 357d etcd-ca no
apiserver-kubelet-client Nov 21, 2023 07:43 UTC 357d ca no
controller-manager.conf Nov 21, 2023 07:43 UTC 357d no
etcd-healthcheck-client Nov 21, 2023 07:43 UTC 357d etcd-ca no
etcd-peer Nov 21, 2023 07:43 UTC 357d etcd-ca no
etcd-server Nov 21, 2023 07:43 UTC 357d etcd-ca no
front-proxy-client Nov 21, 2023 07:43 UTC 357d front-proxy-ca no
scheduler.conf Nov 21, 2023 07:43 UTC 357d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Nov 18, 2032 07:43 UTC 9y no
etcd-ca Nov 18, 2032 07:43 UTC 9y no
front-proxy-ca Nov 18, 2032 07:43 UTC 9y no
更新所有证书
[root@master ~]# kubeadm certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
[root@master ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Nov 29, 2023 02:41 UTC 364d no
apiserver Nov 29, 2023 02:41 UTC 364d ca no
apiserver-etcd-client Nov 29, 2023 02:41 UTC 364d etcd-ca no
apiserver-kubelet-client Nov 29, 2023 02:41 UTC 364d ca no
controller-manager.conf Nov 29, 2023 02:41 UTC 364d no
etcd-healthcheck-client Nov 29, 2023 02:41 UTC 364d etcd-ca no
etcd-peer Nov 29, 2023 02:41 UTC 364d etcd-ca no
etcd-server Nov 29, 2023 02:41 UTC 364d etcd-ca no
front-proxy-client Nov 29, 2023 02:41 UTC 364d front-proxy-ca no
scheduler.conf Nov 29, 2023 02:41 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Nov 18, 2032 07:43 UTC 9y no
etcd-ca Nov 18, 2032 07:43 UTC 9y no
front-proxy-ca Nov 18, 2032 07:43 UTC 9y no
