k8s- Change certificate time

One Check certificate validity

If you use kubeadm Installed k8s, The certificate is placed in the /etc/kubernetes/pki Under this catalog ,

Then check the certificate time , The default time of discovery is one year


1 [[email protected] pki]# openssl x509 -in apiserver.crt -text -noout | grep Not2             Not Before: Mar 19 17:36:19 2020 GMT3             Not After : Mar 19 17:36:19 2021 GMT




1.1 go The deployment environment


wget https://dl.google.com/go/go1.12.7.linux-amd64.tar.gz
tar -zxvf go1.12.1.linux-amd64.tar.gz -C /usr/local
vi /etc/profile
export PATH=$PATH:/usr/local/go/bin
source /etc/profile


1.2 Download the source code


cd /data && git clone https://github.com/kubernetes/kubernetes.git
git checkout -b remotes/origin/release-1.15.1 v1.15.1
# Because we're installing 1.15 Version of 




1.3 modify Kubeadm Source package update Certificate Policy


vim staging/src/k8s.io/client-go/util/cert/cert.go # kubeadm 1.14  Before the release
vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go # kubeadm 1.14  so far
const duration365d = time.Hour * 24 * 365
NotAfter: time.Now().Add(duration365d).UTC(),
make WHAT=cmd/kubeadm GOFLAGS=-v # compile
cp _output/bin/kubeadm /root/kubeadm-new # Copy 


1.4 to update kubeadm


 #  take  kubeadm  Replace
cp /usr/bin/kubeadm /usr/bin/kubeadm.old
cp /root/kubeadm-new /usr/bin/kubeadm
chmod a+x /usr/bin/kubeadm


1.5 Update each node certificate to Master node


cp -r /etc/kubernetes/pki /etc/kubernetes/pki.old
cd /etc/kubernetes/pki
#  to update
kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml
# View certificate time
openssl x509 -in apiserver.crt -text -noout | grep Not



to update :

kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml


Then check the certificate time again , Find that the effective time becomes 10 Years.


If you have more than one master node , Update with script


scp -r /root/kubeadm-config.yaml [email protected]:/root/
 scp -r /usr/bin/kubeadm [email protected]:/usr/bin
  Then go to 1.211 On this machine, execute the following command to update the certificate
 kubeadm alpha certs renew all --config=/root/kubeadm-config.yaml