如何将kubernetes的证书（ca、etcd-ca、front-proxy-ca）有效期更换成99年

1. 原理

Kubernetes 组件的有效期是由 签发它的 CA 决定的。

如果 CA 本身过期，哪怕组件证书 99 年，集群也会挂。

所以必须重新生成 CA，并设置 --expiry 为 99 年（比如 36500 天）。

2. 备份

# 备份旧的 CA 目录
cp -r /etc/kubernetes/pki /etc/kubernetes/pki-bak

3. 重新生成 CA

# 生成新的 ca.crt 和 ca.key，99 年有效期
kubeadm certs generate-csr --cert-dir=/etc/kubernetes/pki

# 直接用 openssl 生成 99 年 CA（示例以 ca 为例）
openssl req -x509 -new -nodes -keyout /etc/kubernetes/pki/ca.key \
  -out /etc/kubernetes/pki/ca.crt \
  -subj "/CN=kubernetes-ca" \
  -days 36500 \
  -sha256

# etcd-ca
openssl req -x509 -new -nodes -keyout /etc/kubernetes/pki/etcd/ca.key \
  -out /etc/kubernetes/pki/etcd/ca.crt \
  -subj "/CN=etcd-ca" \
  -days 36500 \
  -sha256

# front-proxy-ca
openssl req -x509 -new -nodes -keyout /etc/kubernetes/pki/front-proxy-ca.key \
  -out /etc/kubernetes/pki/front-proxy-ca.crt \
  -subj "/CN=front-proxy-ca" \
  -days 36500 \
  -sha256

4. 重新签发所有组件证书

因为新的 CA 已经变了，需要重新签发依赖它的所有组件证书：

kubeadm certs renew all --cert-dir=/etc/kubernetes/pki

5. 分发证书到所有控制节点

docker

    docker ps |grep -E 'k8s_kube-apiserver|k8s_kube-controller-manager|k8s_kube-scheduler|k8s_etcd_etcd' | awk -F ' ' '{print $1}' |xargs docker restart

或者

containerd:

crictl ps |grep -E 'kube-apiserver|kube-controller-manager|kube-scheduler|etcd' | awk -F ' ' '{print $1}' |xargs crictl stop

crictl ps  -a |grep Exited |awk '{print $1}' |xargs crictl rm

6、检查证书

kubeadm certs check-expiration

成功显示

root@k8s:/etc/kubernetes# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Jul 22, 2125 10:04 UTC   99y             ca                      no      
apiserver                  Jul 22, 2125 10:04 UTC   99y             ca                      no      
apiserver-etcd-client      Jul 22, 2125 10:04 UTC   99y             etcd-ca                 no      
apiserver-kubelet-client   Jul 22, 2125 10:04 UTC   99y             ca                      no      
controller-manager.conf    Jul 22, 2125 10:04 UTC   99y             ca                      no      
etcd-healthcheck-client    Jul 22, 2125 10:04 UTC   99y             etcd-ca                 no      
etcd-peer                  Jul 22, 2125 10:04 UTC   99y             etcd-ca                 no      
etcd-server                Jul 22, 2125 10:04 UTC   99y             etcd-ca                 no      
front-proxy-client         Jul 22, 2125 10:04 UTC   99y             front-proxy-ca          no      
scheduler.conf             Jul 22, 2125 10:04 UTC   99y             ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Jul 22, 2125 10:03 UTC   99y             no      
etcd-ca                 Jul 22, 2125 10:03 UTC   99y             no      
front-proxy-ca          Jul 22, 2125 10:03 UTC   99y             no