Kubernetes 为 kubeapi 创建 5 年证书

Question

在 Centos 7 中使用 kubeadm 创建 kubernetes 集群时，它创建了一年的 kubeapi 证书。对我来说，这对集群来说时间很短。如何在集群设置期间创建 5 年证书？

* SSL connection using TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
* Server certificate:
*       subject: CN=kube-apiserver
*       start date: Dec 20 14:32:00 2017 GMT
*       expire date: Dec 20 14:32:00 2018 GMT
*       common name: kube-apiserver
*       issuer: CN=kubernetes

我试过这不起作用：

openssl genrsa -out ca.key 2048
export MASTER_IP=192.168.16.171
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
kubeadm reset
rm -rf /etc/kubernetes
mkdir -p /etc/kubernetes/ca/pki
cp ca.key ca.crt /etc/kubernetes/ca/pki/
kubeadm init
curl -k -v https://localhost:6443

Server certificate:
*       subject: CN=kube-apiserver
*       start date: Apr 15 21:07:24 2018 GMT
*       expire date: Apr 15 21:07:25 2019 GMT
*       common name: kube-apiserver
*       issuer: CN=kubernetes

谢谢 SR

Answer 1

查看代码后，没有可以更改 API 证书到期日期的选项。代码中设置为 1 年。

https://github.com/kubernetes/client-go/blob/master/util/cert/cert.go

// NewSelfSignedCACert creates a CA certificate
func NewSelfSignedCACert(cfg Config, key *rsa.PrivateKey) (*x509.Certificate, error) {
    now := time.Now()
    tmpl := x509.Certificate{
        SerialNumber: new(big.Int).SetInt64(0),
        Subject: pkix.Name{
            CommonName:   cfg.CommonName,
            Organization: cfg.Organization,
        },
        NotBefore:             now.UTC(),
        NotAfter:              now.Add(duration365d * 10).UTC(),
        KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
        BasicConstraintsValid: true,
        IsCA: true,
    }

    certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key)
    if err != nil {
        return nil, err
    }
    return x509.ParseCertificate(certDERBytes)
}