mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-10-29 22:03:22 -02:30
Ali AfsharzadehandChengHao Yang
ae329ee192
* Fix k8s-certs-renew renewing all certificates on every timer run Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com> * Strip trailing whitespace from systemd-analyze calendar output Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com> * Remove issue link Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> --------- Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com> Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
43 lines
2.0 KiB
Django/Jinja
43 lines
2.0 KiB
Django/Jinja
#!/bin/bash
|
|
|
|
echo "## Check Expiration before renewal ##"
|
|
|
|
{{ bin_dir }}/kubeadm certs check-expiration
|
|
|
|
days_buffer=7 # set a time margin, because we should not renew at the last moment
|
|
# systemctl show reports an empty NextElapseUSecRealtime while the timer's unit is
|
|
# running, so use the calendar spec to get the next scheduled run.
|
|
next_time=$(LC_ALL=C systemd-analyze calendar "{{ auto_renew_certificates_systemd_calendar }}" | grep -oP 'Next elapse:\s*\K.*\S')
|
|
|
|
if [ "${next_time}" == "" ] || [ "${next_time}" == "never" ]; then
|
|
echo "## Skip expiry comparison due to fail to parse next elapse from systemd calendar,do renewal directly ##"
|
|
else
|
|
current_time=$(date +%s)
|
|
target_time=$(date -d "${next_time} + ${days_buffer} days" +%s) # $next_time - $days_buffer days
|
|
expiry_threshold=$(( ${target_time} - ${current_time} ))
|
|
expired_certs=$({{ bin_dir }}/kubeadm certs check-expiration -o jsonpath="{.certificates[?(@.residualTime<${expiry_threshold}.0)]}")
|
|
if [ "${expired_certs}" == "" ];then
|
|
echo "## Skip cert renew and K8S container restart, since all residualTimes are beyond threshold ##"
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
echo "## Renewing certificates managed by kubeadm ##"
|
|
{{ bin_dir }}/kubeadm certs renew all
|
|
|
|
echo "## Restarting control plane pods managed by kubeadm ##"
|
|
{% if container_manager == "docker" %}
|
|
{{ docker_bin_dir }}/docker ps -af 'name=k8s_POD_(kube-apiserver|kube-controller-manager|kube-scheduler|etcd)-*' -q | /usr/bin/xargs {{ docker_bin_dir }}/docker rm -f
|
|
{% else %}
|
|
{{ bin_dir }}/crictl pods --namespace kube-system --name 'kube-scheduler-*|kube-controller-manager-*|kube-apiserver-*|etcd-*' -q | /usr/bin/xargs {{ bin_dir }}/crictl rmp -f
|
|
{% endif %}
|
|
|
|
echo "## Updating /root/.kube/config ##"
|
|
cp {{ kube_config_dir }}/admin.conf /root/.kube/config
|
|
|
|
echo "## Waiting for apiserver to be up again ##"
|
|
until printf "" 2>>/dev/null >>/dev/tcp/127.0.0.1/{{ kube_apiserver_port | default(6443) }}; do sleep 1; done
|
|
|
|
echo "## Expiration after renewal ##"
|
|
{{ bin_dir }}/kubeadm certs check-expiration
|