修改 etcd 证书

  1. 备份旧的 etcd 证书

    [root@enxe etcd]# cd /etc/ssl/etcd/
[root@enxe etcd]# ls
ssl
[root@enxe etcd]# cp -r ssl ssl-bak
[root@enxe etcd]# 
[root@enxe etcd]# ls
ssl  ssl-bak

  2. 查看旧的etcd中包含的IP及DNS

    [root@enxe etcd]# openssl x509 -in /etc/ssl/etcd/ssl/node-enxe.pem -noout -text|grep DNS
                DNS:enxe, DNS:etcd, DNS:etcd.kube-system, DNS:etcd.kube-system.svc, DNS:etcd.kube-system.svc.cluster.local, DNS:lb.kubesphere.local, DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, IP Address:192.168.31.4

  3. 删除旧的证书

    rm -f /etc/ssl/etcd/ssl/*

  4. 编写配置文件

    cat > /etc/ssl/etcd/ssl/openssl.conf <<EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ ssl_client ]
extendedKeyUsage = clientAuth, serverAuth
basicConstraints = CA:FALSE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName = @alt_names

[ v3_ca ]
basicConstraints = CA:TRUE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
authorityKeyIdentifier=keyid:always,issuer

[alt_names]
DNS.1 = enxe
DNS.2 = etcd
DNS.3 = etcd.kube-system
DNS.4 = etcd.kube-system.svc
DNS.5 = etcd.kube-system.svc.cluster.local
DNS.6 = lb.kubesphere.local
DNS.7 = localhost
IP.1 = 127.0.0.1
IP.2 = 0:0:0:0:0:0:0:1
IP.3 = 192.168.31.4
IP.4 = 192.168.234.100
IP.5 = 192.168.232.100
EOF

  5. 生成etcd证书

    cd /etc/ssl/etcd/ssl
# 生成一个 2048 位的 RSA 私钥，并将其保存到 ca-key.pem 文件中。这个私钥通常用于后续创建证书签名请求或直接生成自签名证书，是构建安全通信链路的基础。
openssl genrsa -out ca-key.pem 2048

# 基于已有的私钥 ca-key.pem 创建一个有效期为10年的自签名 CA 证书，并将其保存为 ca.pem，这个证书可以用作 etcd 集群的根证书，用于集群内部的节点间通信或其他需要证书验证的场景。
openssl req -x509 -new -nodes -key ca-key.pem -days 3650 -out ca.pem -subj "/CN=etcd-ca"

#### 设置host为当前节点的hostname
export host=enxe

# 为指定的主机生成一个 2048 位的 RSA 私钥，并将其保存到相应命名的文件中，这些私钥通常用于后续生成证书请求（CSR），进而获取由 CA 签发的公钥证书，或者直接自签名生成证书，用于诸如 HTTPS 服务器身份验证、数据加密传输等安全目的。
openssl genrsa -out admin-${host}-key.pem 2048

# 生成一个证书签名请求 CSR 文件，这个文件可以提交给证书颁发机构 (Certificate Authority, CA)，由 CA 验证信息后签发对应的公钥证书。如果使用自签名证书，则可以直接基于此 CSR 自行签署证书。CSR 中包含了公钥信息以及申请证书的实体信息，是申请证书过程中的关键步骤。
openssl req -new -key admin-${host}-key.pem -out admin-${host}.csr -subj "/CN=etcd-admin-${host}"

# 根据之前的证书签名请求 (CSR) 和一个根证书权威 (CA) 来签署一个新的由指定CA签发的、有效期为10年的管理员证书文件admin-${host}.pem，可用于相应的安全认证需求，比如在etcd集群中作为客户端或管理员的身份验证。记得替换${host}为实际的主机名或IP。
openssl x509 -req -in admin-${host}.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out admin-${host}.pem -days 3650 -extensions ssl_client -extfile openssl.conf


openssl genrsa -out member-${host}-key.pem 2048

openssl req -new -key member-${host}-key.pem -out member-${host}.csr -subj "/CN=etcd-member-${host}" -config openssl.conf

openssl x509 -req -in member-${host}.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out member-${host}.pem -days 3650 -extensions ssl_client -extfile openssl.conf

openssl genrsa -out node-${host}-key.pem 2048

openssl req -new -key node-${host}-key.pem -out node-${host}.csr -subj "/CN=etcd-node-${host}"

openssl x509 -req -in node-${host}.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out node-${host}.pem -days 3650 -extensions ssl_client -extfile openssl.conf

  6. 替换配置文件中的IP

    oldip1=192.168.31.4
newip1=192.168.234.100
sed -i "s/$oldip1/$newip1/" /usr/local/bin/kube-scripts/etcd-backup.sh
sed -i "s/$oldip1/$newip1/" /etc/hosts
sed -i "s/$oldip1/$newip1/" /etc/etcd.env

  7. 重启etcd 节点并查看状态

    systemctl daemon-reload && systemctl restart etcd && systemctl status etcd
[root@enxe ssl]# etcdctl --write-out=table --endpoints=127.0.0.1:2379 --cacert=/etc/ssl/etcd/ssl/ca.pem --cert=/etc/ssl/etcd/ssl/member-enxe.pem --key=/etc/ssl/etcd/ssl/member-enxe-key.pem endpoint status
+----------------+-----------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
|    ENDPOINT    |       ID        | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+----------------+-----------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| 127.0.0.1:2379 | f3e91de802f018a |  3.4.13 |  143 MB |      true |      false |        22 |  305976760 |          305976760 |        |
+----------------+-----------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
[root@enxe ssl]# etcdctl --write-out=table --endpoints=192.168.234.100:2379 --cacert=/etc/ssl/etcd/ssl/ca.pem --cert=/etc/ssl/etcd/ssl/member-enxe.pem --key=/etc/ssl/etcd/ssl/member-enxe-key.pem endpoint status
+----------------------+-----------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
|       ENDPOINT       |       ID        | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+----------------------+-----------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| 192.168.234.100:2379 | f3e91de802f018a |  3.4.13 |  143 MB |      true |      false |        22 |  305976823 |          305976823 |        |
+----------------------+-----------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+

修改节点IP

  1. 备份k8s的配置文件

    cp -R /etc/kubernetes/ /etc/kubernetes-bak

  2. 配置新旧IP对应关系并在相应配置文件中进行替换

    export oldip=192.168.31.4
export newip=192.168.234.100
find /etc/kubernetes -type f | xargs sed -i "s/$oldip/$newip/"
sed -i "s/$oldip/$newip/" /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
sed -i "s/$oldip/$newip/" /usr/local/bin/kube-scripts/initOS.sh
sed -i "s/$oldip/$newip/" /etc/kubernetes/kubeadm-config.yaml
sed -i "s/$oldip/$newip/" /etc/hosts

  3. 删除包含旧IP的证书并重新生成新的证书

    rm -f /etc/kubernetes/pki/apiserver*
kubeadm init phase certs all --config /etc/kubernetes/kubeadm-config.yaml

  4. 进入k8s的配置文件夹，删除包含旧IP的配置文件并重新生成新的配置文件

    cd /etc/kubernetes
rm -f admin.conf kubelet.conf controller-manager.conf scheduler.conf
kubeadm init phase kubeconfig all --config /etc/kubernetes/kubeadm-config.yaml
cp /etc/kubernetes/admin.conf $HOME/.kube/config

  5. 重启服务，并查看服务状态

systemctl daemon-reload && systemctl restart docker && systemctl restart kubelet && systemctl status kubelet
reboot