How to renew kubernetes ssl certs - ssl

Question

I'm using kubeadm to build k8s cluster and default ssl certs will be used in 1 year.
I plan use cfssl or opensll to gen new certs with 10 years use.
Could anynone pls help me.
Thanks all

Answer 1

You can generate certs using cfssl or openssl and store in a directory and specify that directory in Kubeadm init and kubeadm will not generate certs and use the provided certs.
kubeadm init --cert-dir
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#custom-certificates
Kubeadm also provides cert renew mechanism for renewing certs for 1 year.
kubeadm alpha certs renew
Since you have a running cluster which signs certs with 1 year of validity you can change this flag of kube controller manager default duration of cert signed to sign certs for 10 years.
--experimental-cluster-signing-duration duration Default: 8760h0m0s
Once this is done you can use below guide to sign cert valid for 10 years.
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#renew-certificates-with-the-kubernetes-certificates-api

Answer 2

To renew Kubernetes certs for 10 years (not recommended).
Check certs expiration
kubeadm alpha certs check-expiration --config="/etc/kubernetes/kubeadm-config.yaml"
Back up the existing Kubernetes certificates
mkdir -p $HOME/fcik8s-old-certs/pki
/bin/cp -p /etc/kubernetes/pki/*.* $HOME/fcik8s-old-certs/pki
Back up the existing configurtion files
/bin/cp -p /etc/kubernetes/*.conf $HOME/fcik8s-old-certs
Back up your home configuration
mkdir -p $HOME/fcik8s-old-certs/.kube
/bin/cp -p ~/.kube/config $HOME/fcik8s-old-certs/.kube/.
Add --cluster-signing-duration flag (--experimental-cluster-signing-duration prior to 1.19) for kube-controller-manager
Edit /etc/kubernetes/manifests/kube-controller-manager.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-controller-manager
tier: control-plane
name: kube-controller-manager
namespace: kube-system
spec:
containers:
- command:
- kube-controller-manager
...
- --experimental-cluster-signing-duration=87600h
...
...
87600h ~ 10 years
Renew all certs
kubeadm alpha certs renew all --config /etc/kubernetes/kubeadm-config.yaml --use-api
Approve the cert request
kubectl get csr
kubectl certificate approve <cert_request>
Update the kubeconfig file
kubeadm init phase kubeconfig all --config /etc/kubernetes/kubeadm-config.yaml
Overwrite the original admin file with the newly generated admin configuration file
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
Restart components
docker restart $(docker ps | grep etcd | awk '{ print $1 }')
docker restart $(docker ps | grep kube-apiserver | awk '{ print $1 }')
docker restart $(docker ps | grep kube-scheduler | awk '{ print $1 })
docker restart $(docker ps | grep kube-controller | awk '{ print $1 }')
systemctl daemon-reload && systemctl restart kubelet
Check api-server cert expiration
echo | openssl s_client -showcerts -connect 127.0.0.1:6443 -servername api 2>/dev/null | openssl x509 -noout -enddate