[Kubernetes] 🔐 kubeadm 인증서 자동 갱신: systemd 타이머로 만료 방지하기

1sudo kubeadm certs check-expiration

 1CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
 2admin.conf                 May 26, 2027 03:00 UTC   364d            ca                      no
 3apiserver                  May 26, 2027 03:00 UTC   364d            ca                      no
 4apiserver-kubelet-client   May 26, 2027 03:00 UTC   364d            ca                      no
 5controller-manager.conf    May 26, 2027 03:00 UTC   364d            ca                      no
 6etcd-server                May 26, 2027 03:00 UTC   364d            etcd-ca                 no
 7front-proxy-client         May 26, 2027 03:00 UTC   364d            front-proxy-ca          no
 8scheduler.conf             May 26, 2027 03:00 UTC   364d            ca                      no
 9
10CERTIFICATE AUTHORITY      EXPIRES                  RESIDUAL TIME
11ca                         May 24, 2036 03:00 UTC   9y
12etcd-ca                    May 24, 2036 03:00 UTC   9y
13front-proxy-ca             May 24, 2036 03:00 UTC   9y

1sudo openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -enddate
2# notAfter=May 26 03:00:00 2027 GMT

 1# 1. 모든 인증서 갱신 (남은 기간과 무관하게 1년 연장)
 2sudo kubeadm certs renew all
 3
 4# 2. 컨트롤 플레인 Pod 재시작 (정적 Pod이므로 컨테이너만 재기동)
 5sudo crictl pods --namespace kube-system \
 6  --name 'kube-apiserver-*|kube-controller-manager-*|kube-scheduler-*|etcd-*' -q \
 7  | xargs sudo crictl rmp -f
 8
 9# 3. admin.conf 백업 후 .kube/config 갱신
10sudo cp /etc/kubernetes/admin.conf /root/.kube/config

 1k8s-certs-renew.timer  (매주 월 03:00)
 2        │ 트리거
 3        ▼
 4k8s-certs-renew.service  (oneshot)
 5        │ ExecStart
 6        ▼
 7/usr/local/bin/kube-scripts/k8s-certs-renew.sh
 8        │
 9        ├─ kubeadm certs check-expiration
10        ├─ 만료까지 30일 미만이면:
11        │    ├─ kubeadm certs renew all
12        │    ├─ crictl로 컨트롤 플레인 Pod 재기동
13        │    └─ admin.conf → /root/.kube/config 복사
14        └─ apiserver 기동 대기 (6443 포트)

 1sudo mkdir -p /usr/local/bin/kube-scripts
 2sudo tee /usr/local/bin/kube-scripts/k8s-certs-renew.sh > /dev/null <<'EOF'
 3#!/bin/bash
 4kubeadmCerts='/usr/local/bin/kubeadm certs'
 5
 6getCertValidDays() {
 7  local earliestExpireDate
 8  earliestExpireDate=$(${kubeadmCerts} check-expiration \
 9    | grep -o "[A-Za-z]\{3,4\}\s\w\w,\s[0-9]\{4,\}\s\w*:\w*\s\w*\s*" \
10    | xargs -I {} date -d {} +%s | sort | head -n 1)
11  local today
12  today="$(date +%s)"
13  echo -n $(( (earliestExpireDate - today) / (24 * 60 * 60) ))
14}
15
16echo "## Expiration before renewal ##"
17${kubeadmCerts} check-expiration
18
19if [ "$(getCertValidDays)" -lt 30 ]; then
20  echo "## Renewing certificates managed by kubeadm ##"
21  ${kubeadmCerts} renew all
22
23  echo "## Restarting control plane pods managed by kubeadm ##"
24  crictl pods --namespace kube-system \
25    --name 'kube-scheduler-*|kube-controller-manager-*|kube-apiserver-*|etcd-*' -q \
26    | xargs crictl rmp -f
27
28  echo "## Updating /root/.kube/config ##"
29  cp /etc/kubernetes/admin.conf /root/.kube/config
30fi
31
32echo "## Waiting for apiserver to be up again ##"
33until printf "" 2>>/dev/null >>/dev/tcp/127.0.0.1/6443; do sleep 1; done
34
35echo "## Expiration after renewal ##"
36${kubeadmCerts} check-expiration
37EOF
38
39sudo chmod +x /usr/local/bin/kube-scripts/k8s-certs-renew.sh

1sudo tee /etc/systemd/system/k8s-certs-renew.service > /dev/null <<EOF
2[Unit]
3Description=Renew K8S control plane certificates
4
5[Service]
6Type=oneshot
7ExecStart=/usr/local/bin/kube-scripts/k8s-certs-renew.sh
8EOF

 1sudo tee /etc/systemd/system/k8s-certs-renew.timer > /dev/null <<EOF
 2[Unit]
 3Description=Timer to renew K8S control plane certificates
 4
 5[Timer]
 6OnCalendar=Mon *-*-* 03:00:00
 7Unit=k8s-certs-renew.service
 8
 9[Install]
10WantedBy=multi-user.target
11EOF

1sudo systemctl daemon-reload
2sudo systemctl enable --now k8s-certs-renew.timer

1# 다음 실행 시각 확인
2systemctl list-timers k8s-certs-renew.timer
3
4# 서비스 로그 확인
5journalctl -u k8s-certs-renew.service --no-pager

1NEXT                        LEFT     LAST PASSED UNIT                       ACTIVATES
2Mon 2026-06-01 03:00:00 UTC 5d 10h   -    -      k8s-certs-renew.timer      k8s-certs-renew.service

1# 수동 실행 (renew 분기는 타지 않고 check-expiration만 출력됨)
2sudo systemctl start k8s-certs-renew.service
3
4# 결과 확인
5journalctl -u k8s-certs-renew.service -f

1sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
2sudo chown $(id -u):$(id -g) $HOME/.kube/config