《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.7环境中验证

文章目录

  • API 用证书
    • External API 用证书
    • Internal API 用证书
  • Kube Controller Manager
    • Client 端用证书
    • Server 端用证书
  • Kube Scheduler
    • Client 端用证书
    • Server 端用证书
  • ETCD 用证书
    • ETCD Peer 证书
    • ETCD Serving 证书
    • ETCD Serving Metrics 证书
  • Node 证书
  • Ingress 证书
  • Service CA 签发用证书
  • 列出将在1年内过期的证书
  • 参考

API 用证书

External API 用证书

$ oc get secret external-loadbalancer-serving-certkey -n openshift-kube-apiserver -o yaml -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

或者

$ oc get secret external-loadbalancer-serving-certkey -n openshift-kube-apiserver -o jsonpath='{.metadata.annotations}' | jq '"auth.openshift.io/certificate-not-before   "+."auth.openshift.io/certificate-not-before","auth.openshift.io/certificate-not-after    "+."auth.openshift.io/certificate-not-after"'

或者

$ ssh core@master_hostname
$ sudo -i
$ openssl x509 -in  /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/external-loadbalancer-serving-certkey/tls.crt -noout -dates

Internal API 用证书

$ oc get secret -n openshift-kube-apiserver internal-loadbalancer-serving-certkey -o yaml -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

或者

$ oc get secret internal-loadbalancer-serving-certkey -n openshift-kube-apiserver -o jsonpath='{.metadata.annotations}' | jq '"auth.openshift.io/certificate-not-before   "+."auth.openshift.io/certificate-not-before","auth.openshift.io/certificate-not-after    "+."auth.openshift.io/certificate-not-after"'

或者

$ ssh core@master_hostname
$ sudo -i
$ openssl x509 -in  /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/internal-loadbalancer-serving-certkey/tls.crt -noout -dates

Kube Controller Manager

Client 端用证书

$ oc get secret kube-controller-manager-client-cert-key -n openshift-kube-controller-manager -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

或者

$ oc get secret kube-controller-manager-client-cert-key -n openshift-kube-controller-manager -o jsonpath='{.metadata.annotations}' | jq '"auth.openshift.io/certificate-not-before   "+."auth.openshift.io/certificate-not-before","auth.openshift.io/certificate-not-after    "+."auth.openshift.io/certificate-not-after"'

或者

$ ssh core@master_hostname
$ sudo -i
$ openssl x509 -in /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/secrets/kube-controller-manager-client-cert-key/tls.crt -noout -dates

Server 端用证书

$ oc get secret serving-cert -n openshift-kube-controller-manager -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

或者

$ ssh core@master_hostname
$ sudo -i
$ openssl x509 -in /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-xy/secrets/serving-cert/tls.crt -noout -dates

Kube Scheduler

Client 端用证书

$ oc get secret kube-scheduler-client-cert-key -n openshift-kube-scheduler -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

或者

$ oc get secret kube-scheduler-client-cert-key -n openshift-kube-scheduler -o jsonpath='{.metadata.annotations}' | jq '"auth.openshift.io/certificate-not-before   "+."auth.openshift.io/certificate-not-before","auth.openshift.io/certificate-not-after    "+."auth.openshift.io/certificate-not-after"'

或者

$ ssh core@master_hostname
$ sudo -i
$ openssl x509 -in /etc/kubernetes/static-pod-resources/kube-scheduler-certs/secrets/kube-scheduler-client-cert-key/tls.crt -noout -dates

Server 端用证书

$ oc get secret serving-cert -n openshift-kube-scheduler -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

或者

$ ssh core@master_hostname
$ sudo -i
$ openssl x509 -in /etc/kubernetes/static-pod-resources/kube-scheduler-pod-xy/secrets/serving-cert/tls.crt -noout -dates

ETCD 用证书

ETCD Peer 证书

for name in $(oc get node -o custom-columns=NAME:metadata.name | grep master)
do
echo etcd-peer-$name
oc get secret etcd-peer-$name -n openshift-etcd -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates
done

或者

$ ssh core@master_hostname
$ sudo -i
$ for i in /etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-peer/*.crt; do echo $i; openssl x509 -in $i -noout -dates; done

ETCD Serving 证书

for name in $(oc get node -o custom-columns=NAME:metadata.name | grep master)
do
echo etcd-serving-$name
oc get secret etcd-serving-$name -n openshift-etcd -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates
done

或

$ ssh core@master_hostname
$ sudo -i
$ for i in /etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-serving/*.crt; do echo $i; openssl x509 -in $i -noout -dates; done

ETCD Serving Metrics 证书

for name in $(oc get node -o custom-columns=NAME:metadata.name | grep master)
do
echo etcd-serving-metrics-$name
oc get secret etcd-serving-metrics-$name -n openshift-etcd -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates
done

或

$ ssh core@master_hostname
$ sudo -i
$ for i in /etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-serving-metrics/*.crt; do echo $i; openssl x509 -in $i -noout -dates; done

Node 证书

在所有节点查看kubelet的证书。

$ ssh core@all_hostname
$ sudo -i
for cert in /var/lib/kubelet/pki/kubelet-{client,server}-current.pem; do echo $cert; openssl x509 -in $cert -noout -dates; done

Ingress 证书

$ oc get secret router-certs-default -n openshift-ingress -o=custom-columns=":.data.tls\.crt" | tail -1 | base64 -d | openssl x509 -noout -dates

Service CA 签发用证书

The service CA certificate, which issues the service certificates, is valid for 26 months and is automatically rotated when there is less than six months validity left. After rotation, the previous service CA configuration is still trusted until its expiration.

$ oc get secrets signing-key -n openshift-service-ca -o template='{{index .data "tls.crt"}}' | base64 -d | openssl x509 -noout -dates

To check the expiry date of all service-signer certs:

$ oc get secrets -A -o custom-columns=SERVICENAME:.metadata.name,NAMESPACE:.metadata.namespace,EXPIRY:.metadata.annotations."service\.beta\.openshift\.io/expiry" | grep -v "<none>"

列出将在1年内过期的证书

列出将在1年内过期的证书

$ yum install util-linux jq -y
$ oc get secret -A -o json | jq -r ' .items[] | select( .metadata.annotations."auth.openshift.io/certificate-not-after" | .!=null and fromdateiso8601<='$( date --date='+1year' +%s )') | "expiration: \( .metadata.annotations."auth.openshift.io/certificate-not-after" ) \( .metadata.namespace ) \( .metadata.name )" ' | sort | column -t
expiration:  2021-06-13T13:11:13Z  openshift-kube-apiserver                    control-plane-node-admin-client-cert-key
expiration:  2021-06-13T13:11:14Z  openshift-config-managed                    kube-controller-manager-client-cert-key
expiration:  2021-06-13T13:11:14Z  openshift-config-managed                    kube-scheduler-client-cert-key
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    check-endpoints-client-cert-key
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    external-loadbalancer-serving-certkey
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    internal-loadbalancer-serving-certkey
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-10
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-3
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-5
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-6
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-7
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-8
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    kubelet-client-9
expiration:  2021-06-13T13:11:14Z  openshift-kube-apiserver                    localhost-serving-cert-certkey
expiration:  2021-06-13T13:11:14Z  openshift-kube-controller-manager           kube-controller-manager-client-cert-key
。。。

更新将在1年内过期的证书

$ oc get secret -A -o json | jq -r '.items[] | select(.metadata.annotations."auth.openshift.io/certificate-not-after" | .!=null and fromdateiso8601<='$( date --date='+1year' +%s )') | "-n \(.metadata.namespace) \(.metadata.name)"' | xargs -n3 oc patch secret -p='{"metadata": {"annotations": {"auth.openshift.io/certificate-not-after": null}}}'

参考

https://access.redhat.com/solutions/5925951

OpenShift 4 - 查看关键证书到期日期相关推荐

  1. java证书过期时间_我想用代码方式查看ca证书到期时间，以下是我的代码，可以显示日期，但是和实际的截止日期不一致...

    我想用代码方式查看ca证书到期时间,以下是我的代码,可以显示日期,但是和实际的截止日期不一致 希望各位大牛帮忙看一下问题出在哪,多谢啦 import java.io.*; import java.se ...

  2. 查看https证书到期时间

    查看https证书到期时间 浏览器打开网址,点击安全,之后查看证书选项,就可以看到当前域名配置的https证书内容了,包括颁发日期.截止日期等 end

  3. 查看IOS-app证书到期时间

    参照: iOS企业版证书到期 https://www.jianshu.com/p/44b0dc46ef37 如果不能十分确定每一个打出来的ipa的有效期(过期时间),而又需要关注它具体什么时候需要强制 ...

  4. 查看域名证书到期时间

    参考:https://www.cnblogs.com/dingkailinux/p/8408929.html 一.通过域名查询: 以淘宝京东为例 root@server01:~/scripts# ec ...

  5. ssl证书到期时间查询的三种方法

    之前,有一个域名使用了网上免费的 ssl 证书,然后想在该证书过期后更换为 Let's encrypt 的免费证书,便想查询下该域名 ssl 证书还剩多少天过期. 查询证书到期时间的方法还是很简单的, ...

  6. 基于embedded.mobileprovision描述文件查看iOS苹果证书到期时间三种方案

    在iOS开发中,embedded.mobileprovision描述文件是开发人员非常熟悉的,里面包含了证书信息,如调试设备UDID.Entitlements.AppIDName.DeveloperC ...

  7. chromebook刷机_如何查看Chromebook的停产日期

    chromebook刷机 Google 谷歌 There comes a time in your Chromebook's life when it no longer receives updat ...

  8. OpenShift 4 - 用CA证书或Token访问Internal Registry中的容器

    <OpenShift 4.x HOL教程汇总> 说明:本文已经在OpenShift 4.7环境中验证 文章目录 获得OpenShift Internal Registry的访问证书 准备环 ...

  9. 证书到期了_您的PMP证书到期了吗？

    您的PMP证书到期了吗? 众所周知,PMP证书只有三年有效期,每三年需要进行一次续证操作,保证 PMP证书持续有效. PMP证书续证需要满足以下2个条件,缺一不可: 首先,每三年要积累满60个PDU ...

最新文章

  1. Cannot open precompiled header file:'Debug/password.pch' No such file or directory
  2. 利用Spring的ApplicationEvent执行自定义方法
  3. 农林行业的系统应用 php专业,农林|类专业
  4. matlab文件读写监听,matlab对文件的读写
  5. Android之自定义checkbox并解决内容和复选框之间的具体问题
  6. 2017.9.26 货币兑换 失败总结
  7. Linux 安装MySql 5.7.21 操作步骤
  8. 撸羊毛的一些心得体会
  9. 后台管理系统 - 权限设计
  10. python学习态度_python基础一 day29 学习方法（课前谈心）
  11. 人的一生，到底在追求什么？
  12. Emacs-206-Windows上实现org-pomodoro的声音提示播放
  13. 怎样降低计算机屏幕亮度,如何调低电脑屏幕亮度【解决步骤】
  14. 我的Android读书笔记——（1）
  15. 03——axios配置对象以及默认配置
  16. 单片机8位抢答器实训机电报告_16路抢答器单片机实训报告.docx
  17. Linux下编译so文件
  18. 精通正则表达式学习记录 第一章 正则表达式入门
  19. AKA简单翻译 认证与密钥协商
  20. zt我的Delphi开发经验谈

热门文章

  1. mysql用navicat无法远程连接,mysql 发现 navicat 可以远程连接，代码无法远程连接
  2. python interactive slider_python3----练习题(过滑块验证)
  3. python按照日期筛选数据_python – 按时间戳列筛选/选择pandas dataframe行
  4. java怎么改变数组的名,java – Spring HATEOASHAL：在_embedded中更改数组名称
  5. cmw500综合测试仪使用_网络性能测试仪该怎么选
  6. UI设计素材干货|可临摹的时尚播放页面模板
  7. 极其良心的设计导航网站
  8. libvirt Installation
  9. eBPF 入门之编程
  10. 分布式定时器的实现原理