Kubernetes certificate

Kubernetes certificates are used to verify the identity of Kubernetes components when they communicate with each other over the network in a cluster.

View Certificate

When monitoring components are deployed and running properly in the cluster, you can view information about the Kubernetes certificate for the cluster on the Platform Certificate Management page.

Tip: When a certificate is about to expire or has expired, an alert will be triggered and the default notification policy of the platform (cpaas-admin-notification, manually created during platform deployment) will be used to send alert messages to the notification objects. You can also view detailed alert information on the Operations Center > Firing page of the platform.

Update the validity period of Kubernetes certificates for self-built business clusters

The validity period of Kubernetes certificates on the self-built business clusters in the platform is 10 years by default. When the certificates expire or need to be adjusted, you can refer to the content of this article to manually update the validity period of the certificates.

Note:

• The following certificates cannot be updated through the solution provided in this article. The default validity period of these certificates is 10 years. If you need to update the validity period, please contact technical support.

  • /etc/kubernetes/pki/ca.crt

  • /etc/kubernetes/pki/front-proxy-ca.crt

  • /etc/kubernetes/pki/etcd/ca.crt

  • /etc/kubernetes/pki/oidc-ca.crt

• Only the Kubernetes certificates on all control nodes in the cluster need to be updated, and the certificates on the compute nodes will be automatically rotated after expiration.

• During the update, the validity period of the Kubernetes certificates can be set, with a maximum validity period of 3650 days.

Procedure

1. Download the script (gen-certs.sh) (right-click on the link and select “Save link as…”) to your local machine.

2. Copy the script to the /root/ directory on all control nodes of the cluster to be updated.

3. Log in to each control node in the cluster and execute the corresponding script to update the validity period of the certificates.

   • If the container runtime is Docker, execute the following script:

     export DAYS="3650"      # Validity period after certificate renewal，Value cannot be greater than 3650
     bash gen-certs.sh master  <Node IP>   # master Node's IP
     
     # restart Pod Managed container
     master="apiserver controller-manager scheduler"
     for c in ${master}; do
       docker ps | grep "k8s_kube-${c}_" | awk '{print $1}' | xargs docker restart
     done

   • When the container runtime is Containerd, execute the following script:

     export DAYS="3650"
     bash gen-certs.sh master  <Node IP>  # master Node's IP
     
     # restart Pod Managed container
     master="kube-apiserver kube-controller-manager kube-scheduler"
     for c in ${master}; do
       crictl  ps  | grep "$c" | awk '{print $1}'| xargs crictl stop 
       crictl  ps -a  | grep "$c" | awk '{print $1}'| xargs crictl rm 
     done

4. Select and execute the corresponding script on the control node to verify whether the certificate has been successfully updated and whether the cluster functions normally.

   • If the Kubernetes version of the cluster is lower than 1.21, execute the following script:

     kubeadm alpha certs check-expiration

   • When the Kubernetes version of the cluster is 1.21 or higher, execute the following script:

     kubeadm certs check-expiration