{"id":21360581,"url":"https://github.com/yuyicai/update-kube-cert","last_synced_at":"2025-10-04T06:46:48.597Z","repository":{"id":37250804,"uuid":"199180380","full_name":"yuyicai/update-kube-cert","owner":"yuyicai","description":"K8s 集群证书过期处理，更新 kubeadm 生成的证书有效期为 10 年; 为新集群生成 100 年证书支持全部版本。A tool to update and extend Kubernetes certificate expiration dates to 10 years. Generate 100 years certificates for new Kubernetes cluster","archived":false,"fork":false,"pushed_at":"2025-05-06T09:19:28.000Z","size":85,"stargazers_count":605,"open_issues_count":4,"forks_count":314,"subscribers_count":17,"default_branch":"master","last_synced_at":"2025-05-29T06:39:51.984Z","etag":null,"topics":["100year","100year-certificate","certificate","expire","k8s-cert-expired","kube-cert-expired","kubeadm-cert-expired","kubernetes","kubernetes-certification"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yuyicai.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-07-27T15:13:07.000Z","updated_at":"2025-05-29T04:49:15.000Z","dependencies_parsed_at":"2023-12-19T11:57:05.147Z","dependency_job_id":"1d6003f3-5f1d-416b-9196-12a244085554","html_url":"https://github.com/yuyicai/update-kube-cert","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/yuyicai/update-kube-cert","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuyicai%2Fupdate-kube-cert","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuyicai%2Fupdate-kube-cert/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuyicai%2Fupdate-kube-cert/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuyicai%2Fupdate-kube-cert/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yuyicai","download_url":"https://codeload.github.com/yuyicai/update-kube-cert/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuyicai%2Fupdate-kube-cert/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278277881,"owners_count":25960430,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-04T02:00:05.491Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["100year","100year-certificate","certificate","expire","k8s-cert-expired","kube-cert-expired","kubeadm-cert-expired","kubernetes","kubernetes-certification"],"created_at":"2024-11-22T05:35:25.806Z","updated_at":"2025-10-04T06:46:48.589Z","avatar_url":"https://github.com/yuyicai.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# update-kube-cert\n\nA tool to update and extend Kubernetes certificate expiration dates in kubeadm-initiated clusters.\n\n## Overview\n\nThis script helps you manage Kubernetes certificates by:  \n\n- Extending certificate validity to 10 years for existing Kubernetes clusters. (includes both cluster with certificate expiration issues and normal cluster)  \n- Generating long-lived CA certificates (100 years) before initializing new clusters\n\n## Usage\n\n### Get the Script\n\n```bash\ngit clone https://github.com/yuyicai/update-kube-cert.git\ncd update-kube-cert\n```\n\n### For Existing Clusters\n\nRenew certificates to 10 years:  \nRun on all control plane nodes (master0, master1, master2...)\n\n```bash\nbash update-kubeadm-cert.sh --cri containerd\n```\n\n\u003cdetails\u003e\n\n\u003csummary\u003eTerminal Output\u003c/summary\u003e\n\n```bash\nroot@master0:~/update-kube-cert# bash update-kubeadm-cert.sh --cri containerd\n[2025-04-01T00:09:48.47+0800] [INFO] checking if all certificate files are existed...\n[2025-04-01T00:09:48.47+0800] [INFO] backup /etc/kubernetes to /etc/kubernetes.old-2025-04-01_00-09-48\n[2025-04-01T00:09:48.48+0800] [INFO] checking certificate expiration before update...\n|-----------------------------------|----------------------------|\n| CERTIFICATE                       | EXPIRES                    |\n| ca.crt                            | Mar 29 16:09:05 2035 GMT   |\n| apiserver.crt                     | Mar 31 16:09:05 2026 GMT   |\n| apiserver-kubelet-client.crt      | Mar 31 16:09:05 2026 GMT   |\n| front-proxy-ca.crt                | Mar 29 16:09:05 2035 GMT   |\n| front-proxy-client.crt            | Mar 31 16:09:05 2026 GMT   |\n|-----------------------------------|----------------------------|\n| controller-manager.conf           | Mar 31 16:09:05 2026 GMT   |\n| scheduler.conf                    | Mar 31 16:09:05 2026 GMT   |\n| admin.conf                        | Mar 31 16:09:05 2026 GMT   |\n| super-admin.conf                  | Mar 31 16:09:05 2026 GMT   |\n|-----------------------------------|----------------------------|\n| etcd/ca.crt                       | Mar 29 16:09:05 2035 GMT   |\n| etcd/server.crt                   | Mar 31 16:09:05 2026 GMT   |\n| etcd/peer.crt                     | Mar 31 16:09:05 2026 GMT   |\n| etcd/healthcheck-client.crt       | Mar 31 16:09:05 2026 GMT   |\n| apiserver-etcd-client.crt         | Mar 31 16:09:05 2026 GMT   |\n|-----------------------------------|----------------------------|\n[2025-04-01T00:09:48.52+0800] [INFO] updating certificates with 3650 days expiration...\n[2025-04-01T00:09:48.53+0800] [INFO] updated /etc/kubernetes/pki/etcd/server.crt\n[2025-04-01T00:09:48.55+0800] [INFO] updated /etc/kubernetes/pki/etcd/peer.crt\n[2025-04-01T00:09:48.56+0800] [INFO] updated /etc/kubernetes/pki/etcd/healthcheck-client.crt\n[2025-04-01T00:09:48.57+0800] [INFO] updated /etc/kubernetes/pki/apiserver-etcd-client.crt\n[2025-04-01T00:09:48.59+0800] [INFO] restarted etcd\n[2025-04-01T00:09:48.61+0800] [INFO] updated /etc/kubernetes/pki/apiserver.crt\n[2025-04-01T00:09:48.62+0800] [INFO] updated /etc/kubernetes/pki/apiserver-kubelet-client.crt\n[2025-04-01T00:09:48.63+0800] [INFO] updated /etc/kubernetes/controller-manager.conf\n[2025-04-01T00:09:48.65+0800] [INFO] updated /etc/kubernetes/scheduler.conf\n[2025-04-01T00:09:48.66+0800] [INFO] updated /etc/kubernetes/admin.conf\n[2025-04-01T00:09:48.68+0800] [INFO] updated /etc/kubernetes/super-admin.conf\n[2025-04-01T00:09:48.69+0800] [INFO] updated /etc/kubernetes/pki/front-proxy-client.crt\n[2025-04-01T00:09:48.71+0800] [INFO] restarted control-plane pod: apiserver\n[2025-04-01T00:09:48.73+0800] [INFO] restarted control-plane pod: controller-manager\n[2025-04-01T00:09:48.76+0800] [INFO] restarted control-plane pod: scheduler\n[2025-04-01T00:09:48.83+0800] [INFO] restarted kubelet\n[2025-04-01T00:09:48.83+0800] [INFO] checking certificate expiration after update...\n|-----------------------------------|----------------------------|\n| CERTIFICATE                       | EXPIRES                    |\n| ca.crt                            | Mar 29 16:09:05 2035 GMT   |\n| apiserver.crt                     | Mar 29 16:09:48 2035 GMT   |\n| apiserver-kubelet-client.crt      | Mar 29 16:09:48 2035 GMT   |\n| front-proxy-ca.crt                | Mar 29 16:09:05 2035 GMT   |\n| front-proxy-client.crt            | Mar 29 16:09:48 2035 GMT   |\n|-----------------------------------|----------------------------|\n| controller-manager.conf           | Mar 29 16:09:48 2035 GMT   |\n| scheduler.conf                    | Mar 29 16:09:48 2035 GMT   |\n| admin.conf                        | Mar 29 16:09:48 2035 GMT   |\n| super-admin.conf                  | Mar 29 16:09:48 2035 GMT   |\n|-----------------------------------|----------------------------|\n| etcd/ca.crt                       | Mar 29 16:09:05 2035 GMT   |\n| etcd/server.crt                   | Mar 29 16:09:48 2035 GMT   |\n| etcd/peer.crt                     | Mar 29 16:09:48 2035 GMT   |\n| etcd/healthcheck-client.crt       | Mar 29 16:09:48 2035 GMT   |\n| apiserver-etcd-client.crt         | Mar 29 16:09:48 2035 GMT   |\n|-----------------------------------|----------------------------|\n[2025-04-01T00:09:48.89+0800] [INFO] DONE!!!enjoy it\n\nplease copy admin.conf to /root/.kube/config manually.\n    # back old config\n    cp /root/.kube/config /root/.kube/config_backup\n    # copy new admin.conf to /root/.kube/config for kubectl manually\n    cp -i /opt/kube/tmp/kubernetes/admin.conf /root/.kube/config\n\n\nroot@master0:~/update-kube-cert# kubectl get po -A\nNAMESPACE     NAME                              READY   STATUS    RESTARTS        AGE\nkube-system   coredns-668d6bf9bc-7kwkk          0/1     Pending   0               37m\nkube-system   coredns-668d6bf9bc-b68dx          0/1     Pending   0               37m\nkube-system   etcd-master0                      1/1     Running   4 (4m21s ago)   37m\nkube-system   kube-apiserver-master0            1/1     Running   2 (60s ago)     37m\nkube-system   kube-controller-manager-master0   1/1     Running   4 (49s ago)     37m\nkube-system   kube-proxy-5mf68                  1/1     Running   0               37m\nkube-system   kube-scheduler-master0            1/1     Running   3 (48s ago)     37m\nroot@master0:~/update-kube-cert#\nroot@master0:~/update-kube-cert# crictl --runtime-endpoint unix:///run/containerd/containerd.sock pods\nPOD ID              CREATED              STATE               NAME                              NAMESPACE           ATTEMPT             RUNTIME\n59935ee07550b       About a minute ago   Ready               kube-apiserver-master0            kube-system         2                   (default)\n37b73945aee1f       About a minute ago   NotReady            kube-apiserver-master0            kube-system         1                   (default)\n5f05c3a5abfac       4 minutes ago        Ready               etcd-master0                      kube-system         4                   (default)\n40c2c1480cbc8       5 minutes ago        Ready               kube-controller-manager-master0   kube-system         1                   (default)\n781806f0cc91d       6 minutes ago        NotReady            etcd-master0                      kube-system         3                   (default)\n75b68162b9476       37 minutes ago       Ready               kube-proxy-5mf68                  kube-system         0                   (default)\ndc3da94fda7f9       37 minutes ago       Ready               kube-scheduler-master0            kube-system         0                   (default)\n```\n\n\u003c/details\u003e\n\n### For New Clusters\n\nGenerate 100 year CA certificates before running `kubeadm init`  \nJust generate CA on the first control plane node (master0, which will run `kubeadm init`)   \n\n```bash\n# master0\n# 1. Generate 100 years CA certificates\nbash update-kubeadm-cert.sh --action gen-ca\n\n# 2. Initialize your cluster with kubeadm\n# kubeadm will use the existing CA certificates generated by the script\nkubeadm init --upload-certs [options]\n\n# 3. Update all certificates to 100 years use extended expiration\nbash update-kubeadm-cert.sh --cri containerd --days 36500\n\n# 4. Join master1, master2 to the cluster and just run 'bash update-kubeadm-cert.sh --cri containerd --days 36500' on them\n```\n\n\u003cdetails\u003e\n\n\u003csummary\u003eKey Kubeadm init Output\u003c/summary\u003e\nkubeadm uses the existing CA certificates generated by the script\n\n```bash\n...\n[certs] Using existing ca certificate authority\n...\n[certs] Using existing front-proxy-ca certificate authority\n...\n[certs] Using existing etcd/ca certificate authority\n...\n```\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\n\n\u003csummary\u003eFull terminal Output\u003c/summary\u003e\n\n```bash\nroot@master0:~/update-kube-cert# bash update-kubeadm-cert.sh --action gen-ca\n[2025-04-01T00:14:35.89+0800] [INFO] generating CA with 36500 days expiration...\n[2025-04-01T00:14:35.90+0800] [INFO] generating k8s CA...\n[2025-04-01T00:14:36.06+0800] [INFO] generated /etc/kubernetes/pki/ca.crt\n[2025-04-01T00:14:36.06+0800] [INFO] generating front-proxy CA...\n[2025-04-01T00:14:36.11+0800] [INFO] generated /etc/kubernetes/pki/front-proxy-ca.crt\n[2025-04-01T00:14:36.11+0800] [INFO] generating etcd CA...\n[2025-04-01T00:14:36.14+0800] [INFO] generated /etc/kubernetes/pki/etcd/ca.crt\n|-----------------------------------|----------------------------|\n| CERTIFICATE                       | EXPIRES                    |\n| ca.crt                            | Mar  7 16:14:36 2125 GMT   |\n| apiserver.crt                     |                            |\n| apiserver-kubelet-client.crt      |                            |\n| front-proxy-ca.crt                | Mar  7 16:14:36 2125 GMT   |\n| front-proxy-client.crt            |                            |\n|-----------------------------------|----------------------------|\n| controller-manager.conf           |                            |\n| scheduler.conf                    |                            |\n| admin.conf                        |                            |\n|-----------------------------------|----------------------------|\n| etcd/ca.crt                       | Mar  7 16:14:36 2125 GMT   |\n| etcd/server.crt                   |                            |\n| etcd/peer.crt                     |                            |\n| etcd/healthcheck-client.crt       |                            |\n| apiserver-etcd-client.crt         |                            |\n|-----------------------------------|----------------------------|\n[2025-04-01T00:14:36.18+0800] [INFO] DONE!!! generated CA for new cluster.\n    # create new cluster after generating CA, you can use the following command:\n      kubeadm init [options]\n    # after running kubeadm init, update certificates for 100 yeas\n      bash update-kubeadm-cert.sh --cri containerd --days 36500\nroot@master0:~/update-kube-cert#\nroot@master0:~/update-kube-cert#\nroot@master0:~/update-kube-cert# kubeadm init\n[init] Using Kubernetes version: v1.32.3\n[preflight] Running pre-flight checks\n\t[WARNING SystemVerification]: cgroups v1 support is in maintenance mode, please migrate to cgroups v2\n[preflight] Pulling images required for setting up a Kubernetes cluster\n[preflight] This might take a minute or two, depending on the speed of your internet connection\n[preflight] You can also perform this action beforehand using 'kubeadm config images pull'\nW0401 00:15:10.683957   13914 checks.go:846] detected that the sandbox image \"\" of the container runtime is inconsistent with that used by kubeadm.It is recommended to use \"registry.k8s.io/pause:3.10\" as the CRI sandbox image.\n[certs] Using certificateDir folder \"/etc/kubernetes/pki\"\n[certs] Using existing ca certificate authority\n[certs] Generating \"apiserver\" certificate and key\n[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local master0] and IPs [10.96.0.1 10.0.0.186]\n[certs] Generating \"apiserver-kubelet-client\" certificate and key\n[certs] Using existing front-proxy-ca certificate authority\n[certs] Generating \"front-proxy-client\" certificate and key\n[certs] Using existing etcd/ca certificate authority\n[certs] Generating \"etcd/server\" certificate and key\n[certs] etcd/server serving cert is signed for DNS names [localhost master0] and IPs [10.0.0.186 127.0.0.1 ::1]\n[certs] Generating \"etcd/peer\" certificate and key\n[certs] etcd/peer serving cert is signed for DNS names [localhost master0] and IPs [10.0.0.186 127.0.0.1 ::1]\n[certs] Generating \"etcd/healthcheck-client\" certificate and key\n[certs] Generating \"apiserver-etcd-client\" certificate and key\n[certs] Generating \"sa\" key and public key\n[kubeconfig] Using kubeconfig folder \"/etc/kubernetes\"\n[kubeconfig] Writing \"admin.conf\" kubeconfig file\n[kubeconfig] Writing \"super-admin.conf\" kubeconfig file\n[kubeconfig] Writing \"kubelet.conf\" kubeconfig file\n[kubeconfig] Writing \"controller-manager.conf\" kubeconfig file\n[kubeconfig] Writing \"scheduler.conf\" kubeconfig file\n[etcd] Creating static Pod manifest for local etcd in \"/etc/kubernetes/manifests\"\n[control-plane] Using manifest folder \"/etc/kubernetes/manifests\"\n[control-plane] Creating static Pod manifest for \"kube-apiserver\"\n[control-plane] Creating static Pod manifest for \"kube-controller-manager\"\n[control-plane] Creating static Pod manifest for \"kube-scheduler\"\n[kubelet-start] Writing kubelet environment file with flags to file \"/var/lib/kubelet/kubeadm-flags.env\"\n[kubelet-start] Writing kubelet configuration to file \"/var/lib/kubelet/config.yaml\"\n[kubelet-start] Starting the kubelet\n[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory \"/etc/kubernetes/manifests\"\n[kubelet-check] Waiting for a healthy kubelet at http://127.0.0.1:10248/healthz. This can take up to 4m0s\n[kubelet-check] The kubelet is healthy after 501.312263ms\n[api-check] Waiting for a healthy API server. This can take up to 4m0s\n[api-check] The API server is healthy after 3.501053598s\n[upload-config] Storing the configuration used in ConfigMap \"kubeadm-config\" in the \"kube-system\" Namespace\n[kubelet] Creating a ConfigMap \"kubelet-config\" in namespace kube-system with the configuration for the kubelets in the cluster\n[upload-certs] Skipping phase. Please see --upload-certs\n[mark-control-plane] Marking the node master0 as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]\n[mark-control-plane] Marking the node master0 as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule]\n[bootstrap-token] Using token: pwjq3f.6vdgdbfy8mk3gq0s\n[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles\n[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes\n[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials\n[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token\n[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster\n[bootstrap-token] Creating the \"cluster-info\" ConfigMap in the \"kube-public\" namespace\n[kubelet-finalize] Updating \"/etc/kubernetes/kubelet.conf\" to point to a rotatable kubelet client certificate and key\n[addons] Applied essential addon: CoreDNS\n[addons] Applied essential addon: kube-proxy\n\nYour Kubernetes control-plane has initialized successfully!\n\nTo start using your cluster, you need to run the following as a regular user:\n\n  mkdir -p $HOME/.kube\n  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\n  sudo chown $(id -u):$(id -g) $HOME/.kube/config\n\nAlternatively, if you are the root user, you can run:\n\n  export KUBECONFIG=/etc/kubernetes/admin.conf\n\nYou should now deploy a pod network to the cluster.\nRun \"kubectl apply -f [podnetwork].yaml\" with one of the options listed at:\n  https://kubernetes.io/docs/concepts/cluster-administration/addons/\n\nThen you can join any number of worker nodes by running the following on each as root:\n\nkubeadm join 10.0.0.186:6443 --token pwjq3f.6vdgdbfy8mk3gq0s \\\n\t--discovery-token-ca-cert-hash sha256:6cef6024c7b0a25a2b81c31907248a2dc124eada0fd7abd565bbe60d6ad775a1\nroot@master0:~/update-kube-cert#\nroot@master0:~/update-kube-cert#\nroot@master0:~/update-kube-cert# bash update-kubeadm-cert.sh --cri containerd --days 36500\n[2025-04-01T00:16:12.09+0800] [INFO] checking if all certificate files are existed...\n[2025-04-01T00:16:12.09+0800] [INFO] backup /etc/kubernetes to /etc/kubernetes.old-2025-04-01_00-16-12\n[2025-04-01T00:16:12.09+0800] [INFO] checking certificate expiration before update...\n|-----------------------------------|----------------------------|\n| CERTIFICATE                       | EXPIRES                    |\n| ca.crt                            | Mar  7 16:14:36 2125 GMT   |\n| apiserver.crt                     | Mar 31 16:15:10 2026 GMT   |\n| apiserver-kubelet-client.crt      | Mar 31 16:15:10 2026 GMT   |\n| front-proxy-ca.crt                | Mar  7 16:14:36 2125 GMT   |\n| front-proxy-client.crt            | Mar 31 16:15:10 2026 GMT   |\n|-----------------------------------|----------------------------|\n| controller-manager.conf           | Mar 31 16:15:10 2026 GMT   |\n| scheduler.conf                    | Mar 31 16:15:10 2026 GMT   |\n| admin.conf                        | Mar 31 16:15:10 2026 GMT   |\n| super-admin.conf                  | Mar 31 16:15:10 2026 GMT   |\n|-----------------------------------|----------------------------|\n| etcd/ca.crt                       | Mar  7 16:14:36 2125 GMT   |\n| etcd/server.crt                   | Mar 31 16:15:10 2026 GMT   |\n| etcd/peer.crt                     | Mar 31 16:15:10 2026 GMT   |\n| etcd/healthcheck-client.crt       | Mar 31 16:15:10 2026 GMT   |\n| apiserver-etcd-client.crt         | Mar 31 16:15:10 2026 GMT   |\n|-----------------------------------|----------------------------|\n[2025-04-01T00:16:12.14+0800] [INFO] updating certificates with 36500 days expiration...\n[2025-04-01T00:16:12.15+0800] [INFO] updated /etc/kubernetes/pki/etcd/server.crt\n[2025-04-01T00:16:12.16+0800] [INFO] updated /etc/kubernetes/pki/etcd/peer.crt\n[2025-04-01T00:16:12.17+0800] [INFO] updated /etc/kubernetes/pki/etcd/healthcheck-client.crt\n[2025-04-01T00:16:12.18+0800] [INFO] updated /etc/kubernetes/pki/apiserver-etcd-client.crt\n[2025-04-01T00:16:12.21+0800] [INFO] restarted etcd\n[2025-04-01T00:16:12.22+0800] [INFO] updated /etc/kubernetes/pki/apiserver.crt\n[2025-04-01T00:16:12.23+0800] [INFO] updated /etc/kubernetes/pki/apiserver-kubelet-client.crt\n[2025-04-01T00:16:12.25+0800] [INFO] updated /etc/kubernetes/controller-manager.conf\n[2025-04-01T00:16:12.26+0800] [INFO] updated /etc/kubernetes/scheduler.conf\n[2025-04-01T00:16:12.28+0800] [INFO] updated /etc/kubernetes/admin.conf\n[2025-04-01T00:16:12.29+0800] [INFO] updated /etc/kubernetes/super-admin.conf\n[2025-04-01T00:16:12.30+0800] [INFO] updated /etc/kubernetes/pki/front-proxy-client.crt\n[2025-04-01T00:16:12.33+0800] [INFO] restarted control-plane pod: apiserver\n[2025-04-01T00:16:12.35+0800] [INFO] restarted control-plane pod: controller-manager\n[2025-04-01T00:16:12.37+0800] [INFO] restarted control-plane pod: scheduler\n[2025-04-01T00:16:12.42+0800] [INFO] restarted kubelet\n[2025-04-01T00:16:12.42+0800] [INFO] checking certificate expiration after update...\n|-----------------------------------|----------------------------|\n| CERTIFICATE                       | EXPIRES                    |\n| ca.crt                            | Mar  7 16:14:36 2125 GMT   |\n| apiserver.crt                     | Mar  7 16:16:12 2125 GMT   |\n| apiserver-kubelet-client.crt      | Mar  7 16:16:12 2125 GMT   |\n| front-proxy-ca.crt                | Mar  7 16:14:36 2125 GMT   |\n| front-proxy-client.crt            | Mar  7 16:16:12 2125 GMT   |\n|-----------------------------------|----------------------------|\n| controller-manager.conf           | Mar  7 16:16:12 2125 GMT   |\n| scheduler.conf                    | Mar  7 16:16:12 2125 GMT   |\n| admin.conf                        | Mar  7 16:16:12 2125 GMT   |\n| super-admin.conf                  | Mar  7 16:16:12 2125 GMT   |\n|-----------------------------------|----------------------------|\n| etcd/ca.crt                       | Mar  7 16:14:36 2125 GMT   |\n| etcd/server.crt                   | Mar  7 16:16:12 2125 GMT   |\n| etcd/peer.crt                     | Mar  7 16:16:12 2125 GMT   |\n| etcd/healthcheck-client.crt       | Mar  7 16:16:12 2125 GMT   |\n| apiserver-etcd-client.crt         | Mar  7 16:16:12 2125 GMT   |\n|-----------------------------------|----------------------------|\n[2025-04-01T00:16:12.48+0800] [INFO] DONE!!!enjoy it\n\nplease copy admin.conf to /root/.kube/config manually.\n    # back old config\n    cp /root/.kube/config /root/.kube/config_backup\n    # copy new admin.conf to /root/.kube/config for kubectl manually\n    cp -i /opt/kube/tmp/kubernetes/admin.conf /root/.kube/config\nroot@master0:/etc/kubernetes#\nroot@master0:/etc/kubernetes# cp /opt/kube/tmp/kubernetes/admin.conf /root/.kube/config\nroot@master0:/etc/kubernetes#\nroot@master0:/etc/kubernetes# kubeadm certs check-expiration\n[check-expiration] Reading configuration from the \"kubeadm-config\" ConfigMap in namespace \"kube-system\"...\n[check-expiration] Use 'kubeadm init phase upload-config --config your-config.yaml' to re-upload it.\n\nCERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED\nadmin.conf                 Mar 07, 2125 16:16 UTC   99y             ca                      no\napiserver                  Mar 07, 2125 16:16 UTC   99y             ca                      no\napiserver-etcd-client      Mar 07, 2125 16:16 UTC   99y             etcd-ca                 no\napiserver-kubelet-client   Mar 07, 2125 16:16 UTC   99y             ca                      no\ncontroller-manager.conf    Mar 07, 2125 16:16 UTC   99y             ca                      no\netcd-healthcheck-client    Mar 07, 2125 16:16 UTC   99y             etcd-ca                 no\netcd-peer                  Mar 07, 2125 16:16 UTC   99y             etcd-ca                 no\netcd-server                Mar 07, 2125 16:16 UTC   99y             etcd-ca                 no\nfront-proxy-client         Mar 07, 2125 16:16 UTC   99y             front-proxy-ca          no\nscheduler.conf             Mar 07, 2125 16:16 UTC   99y             ca                      no\nsuper-admin.conf           Mar 07, 2125 16:16 UTC   99y             ca                      no\n\nCERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED\nca                      Mar 07, 2125 16:14 UTC   99y             no\netcd-ca                 Mar 07, 2125 16:14 UTC   99y             no\nfront-proxy-ca          Mar 07, 2125 16:14 UTC   99y             no\n```\n\n\u003c/details\u003e\n\n## After Running\nCopy the admin configuration to your kubectl config directory\n\n```bash\n# Backup existing config\ncp $HOME/.kube/config $HOME/.kube/config_backup\n\n# Copy new config\ncp -i /etc/kubernetes/admin.conf $HOME/.kube/config\n```\n\n## Options\n``` bash\n    -c, --cri     \u003cdocker|containerd\u003e (default: containerd)\n                    Set the cri type, in order to restart control-plane and etcd service by different command, 'docker' or 'crictl'.\n    -a, --action  \u003cupdate|check|gen-ca\u003e (default: update)\n                    update: Update certificates 10 years for existing clusters\n                    check: Only check the expiration of the certificates without updating them.\n                    gen-ca: Generate 100 years CA before kubeadm init cluster. (only used for new clusters, not for existing clusters)\n    --days        Set the number of days for certificate expiration. (default: 3650)\n    -h, --help    Show this help message and exit.\n```\n\n## Certificate Files Updated\ncertificates files:\n```\n/etc/kubernetes/pki/apiserver.crt\n/etc/kubernetes/pki/apiserver-kubelet-client.crt\n/etc/kubernetes/pki/front-proxy-client.crt\n/etc/kubernetes/pki/apiserver-etcd-client.crt\n/etc/kubernetes/pki/etcd/server.crt\n/etc/kubernetes/pki/etcd/peer.crt\n/etc/kubernetes/pki/etcd/healthcheck-client.crt\n```\nkubeconfig files:\n```\n/etc/kubernetes/admin.conf\n/etc/kubernetes/controller-manager.conf\n/etc/kubernetes/scheduler.conf\n/etc/kubernetes/super-admin.conf (after Kubernetes v1.29.0, this script will check automatically)\n/etc/kubernetes/kubelet.conf (before Kubernetes v1.17.0, this script will check automatically)\n```\n\n## FAQ\n\n- **Can I generate CA for 100 years on an existing cluster by this script?**  \n  No, this script only updates the certificates on existing clusters, not including CA.  \n\n- **How can I Change CA for an existing cluster?**  \n  See: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/\n\n- **If I have a multi-master cluster, do I need to run this on all master?**  \n  Yes, you should run this script on all control plane nodes, by not on worker nodes.\n\n- **How to force restart control-plane pods manually?**  \n  If any control plane components couldn't be automatically restarted, you should manually restart them.\n\n  ```bash\n  # Make sure kubelet is running\n  systemctl restart kubelet\n\n  # Move manifests to trigger kubelet to recreate the pods\n  mv /etc/kubernetes/manifests /etc/kubernetes/manifests_backup\n\n  # Wait for kubelet to remove the old pods\n  sleep 120\n\n  # Restore manifests, kubelet will recreate the pods\n  mv /etc/kubernetes/manifests_backup /etc/kubernetes/manifests\n\n  # Check the status of control-plane pods\n  kubectl get pods -n kube-system -o wide\n  ```\n\n- **What happens if the script fails?**  \n  The script performs backup of critical files before making changes. If it fails, you can find backups in `/etc/kubernetes.old-$(date +%Y-%m-%d_%H-%M-%S)`.\n\n- **Can I run this on worker nodes?**  \n  No, this script should only be run on control plane nodes.\n\n- **Will this cause downtime?**  \n  There might be a brief disruption while control plane components restart with new certificates.  \n  But on multi-master clusters, the disruption should be minimal.\n\n- **How can I skip etcd certificate update?**  \n  You can use the env `KUBE_SKIP_ETCD_CERTS` to skip etcd certificate update.  \n  ```bash\n  # just update kubernetes master certificates, not etcd\n  export KUBE_SKIP_ETCD_CERTS=true\n  bash update-kubeadm-cert.sh --cri containerd\n  ```\n\n\n## License\nMIT License\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyuyicai%2Fupdate-kube-cert","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyuyicai%2Fupdate-kube-cert","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyuyicai%2Fupdate-kube-cert/lists"}