whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #23172 from tengqm/zh-sync-kubeadm-certs

Browse Source 
[zh] Resync kubeadm-certs task
This commit is contained in:
Kubernetes Prow Robot
2020-09-01 23:51:06 -07:00
committed by GitHub
parent 164774c35a 41b796a961
commit 3c837102cb
1 changed files with 231 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
+231 -170
View File
@@ -1,16 +1,13 @@
---
reviewers:
- sig-cluster-lifecycle
title: 使用 kubeadm 进行证书管理
content_type: task
weight: 10
---
<!--
---
reviewers:
- sig-cluster-lifecycle
title: Certificate Management with kubeadm
content_type: task
---
-->
<!-- overview -->
@@ -20,251 +17,319 @@ content_type: task
<!--
Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) expire after 1 year. This page explains how to manage certificate renewals with kubeadm.
-->
由 [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) 生成的客户端证书在 1 年后到期。 本页说明如何使用 kubeadm 管理证书续订。
由 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/kubeadm/) 生成的客户端证书在 1 年后到期。
本页说明如何使用 kubeadm 管理证书续订。
## {{% heading "prerequisites" %}}
<!--
Be familiar with [PKI certificates and requirements in Kubernetes](/docs/setup/certificates/).
-->
熟悉 [Kubernetes 中的 PKI证书和要求](/docs/setup/certificates/)。
<!--
You should be familiar with [PKI certificates and requirements in Kubernetes](/docs/setup/best-practices/certificates/).
-->
您应该熟悉[Kubernetes 中的 PKI 证书和要求](/docs/setup/best-practices/certificates/)。
你应该熟悉 [Kubernetes 中的 PKI 证书和要求](/zh/docs/setup/best-practices/certificates/)。
<!-- steps -->
<!--
### Using custom certificates {#custom-certificates}
By default, kubeadm generates all the certificates needed for a cluster to run.
You can override this behavior by providing your own certificates.
-->
### 使用自定义的证书 {#custom-certificates}
默认情况下, kubeadm 会生成运行一个集群所需的全部证书。
你可以通过提供你自己的证书来改变这个行为策略。
<!--
To do so, you must place them in whatever directory is specified by the
`--cert-dir` flag or `CertificatesDir` configuration file key. By default this
is `/etc/kubernetes/pki`.
-->
如果要这样做, 你必须将证书文件放置在通过 `--cert-dir` 命令行参数或者配置文件里的
`CertificatesDir` 配置项指明的目录中。默认的值是 `/etc/kubernetes/pki`。
<!--
If a given certificate and private key pair exists before running `kubeadm init`,
kubeadm will not overwrite them. This means you can, for example, copy an existing
CA into `/etc/kubernetes/pki/ca.crt` and `/etc/kubernetes/pki/ca.key`,
and kubeadm will use this CA for signing the rest of the certificates.
-->
如果在运行 `kubeadm init` 之前存在给定的证书和私钥对，kubeadm 将不会重写它们。
例如，这意味着您可以将现有的 CA 复制到 `/etc/kubernetes/pki/ca.crt` 和
`/etc/kubernetes/pki/ca.key` 中，而 kubeadm 将使用此 CA 对其余证书进行签名。
<!--
#### External CA mode {#external-ca-mode}
It is also possible to provide just the `ca.crt` file and not the
`ca.key` file (this is only available for the root CA file, not other cert pairs).
If all other certificates and kubeconfig files are in place, kubeadm recognizes
this condition and activates the "External CA" mode. kubeadm will proceed without the
CA key on disk.
-->
#### 外部 CA 模式 {#external-ca-mode}
只提供了 `ca.crt` 文件但是不提供 `ca.key` 文件也是可以的 (这只对 CA 根证书可用，其它证书不可用)。
如果所有的其它证书和 kubeconfig 文件已就绪， kubeadm 检测到满足以上条件就会激活
"外部 CA" 模式。kubeadm 将会在没有 CA 密钥文件的情况下继续执行。
<!--
Instead, run the controller-manager standalone with `--controllers=csrsigner` and
point to the CA certificate and key.
-->
否则, kubeadm 将独立运行 controller-manager，附加一个 `--controllers=csrsigner`
的参数，并且指明 CA 证书和密钥。
<!--
## Check certificate expiration
-->
You can use the `check-expiration` subcommand to check certificate expiration.
-->
## 检查证书是否过期
<!--
`check-expiration` can be used to check certificate expiration.
-->
`check-expiration` 能被用来检查证书是否过期
你可以使用 `check-expiration` 子命令来检查证书是否过期
```
kubeadm alpha certs check-expiration
```
<!--
The output is similar to this:
-->
<!-- The output is similar to this: -->
输出类似于以下内容：
```
CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
admin.conf May 15, 2020 13:03 UTC 364d false
apiserver May 15, 2020 13:00 UTC 364d false
apiserver-etcd-client May 15, 2020 13:00 UTC 364d false
apiserver-kubelet-client May 15, 2020 13:00 UTC 364d false
controller-manager.conf May 15, 2020 13:03 UTC 364d false
etcd-healthcheck-client May 15, 2020 13:00 UTC 364d false
etcd-peer May 15, 2020 13:00 UTC 364d false
etcd-server May 15, 2020 13:00 UTC 364d false
front-proxy-client May 15, 2020 13:00 UTC 364d false
scheduler.conf May 15, 2020 13:03 UTC 364d false
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Dec 30, 2020 23:36 UTC 364d no
apiserver Dec 30, 2020 23:36 UTC 364d ca no
apiserver-etcd-client Dec 30, 2020 23:36 UTC 364d etcd-ca no
apiserver-kubelet-client Dec 30, 2020 23:36 UTC 364d ca no
controller-manager.conf Dec 30, 2020 23:36 UTC 364d no
etcd-healthcheck-client Dec 30, 2020 23:36 UTC 364d etcd-ca no
etcd-peer Dec 30, 2020 23:36 UTC 364d etcd-ca no
etcd-server Dec 30, 2020 23:36 UTC 364d etcd-ca no
front-proxy-client Dec 30, 2020 23:36 UTC 364d front-proxy-ca no
scheduler.conf Dec 30, 2020 23:36 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Dec 28, 2029 23:36 UTC 9y no
etcd-ca Dec 28, 2029 23:36 UTC 9y no
front-proxy-ca Dec 28, 2029 23:36 UTC 9y no
```
<!--
The command shows expiration/residual time for the client certificates in the `/etc/kubernetes/pki` folder and for the client certificate embedded in the KUBECONFIG files used by kubeadm (`admin.conf`, `controller-manager.conf` and `scheduler.conf`).
-->
该命令显示 `/etc/kubernetes/pki` 文件夹中的客户端证书以及 kubeadm 使用的 KUBECONFIG 文件中嵌入的客户端证书的到期时间/剩余时间。
该命令显示 `/etc/kubernetes/pki` 文件夹中的客户端证书以及 kubeadm 使用的 KUBECONFIG
文件中嵌入的客户端证书的到期时间/剩余时间。
<!--
Additionally, kubeadm informs the user if the certificate is externally managed; in this case, the user should take care of managing certificate renewal manually/using other tools.
-->
另外， kubeadm 会通知用户证书是否由外部管理；
在这种情况下，用户应该小心的手动/使用其他工具来管理证书更新。
另外， kubeadm 会通知用户证书是否由外部管理； 在这种情况下，用户应该小心的手动/使用其他工具来管理证书更新。
{{< warning >}}
<!--
`kubeadm` cannot manage certificates signed by an external CA.
-->`kubeadm` 不能管理由外部 CA 签名的证书
-->`
{{< warning >}}
kubeadm` 不能管理由外部 CA 签名的证书
{{< /warning >}}
{{< note >}}
<!--
`kubelet.conf` is not included in the list above because kubeadm configures kubelet for automatic certificate renewal.
-->上面的列表中没有包含 `kubelet.conf` 因为 kubeadm 将 kubelet 配置为自动更新证书。
-->
{{< note >}}
上面的列表中没有包含 `kubelet.conf` 因为 kubeadm 将 kubelet 配置为自动更新证书。
{{< /note >}}
<!--
On nodes created with `kubeadm init`, prior to kubeadm version 1.17, there is a
[bug](https://github.com/kubernetes/kubeadm/issues/1753) where you manually have to modify the contents of `kubelet.conf`. After `kubeadm init` finishes, you should update `kubelet.conf` to point to the
rotated kubelet client certificates, by replacing `client-certificate-data` and `client-key-data` with:
-->
{{< warning >}}
在通过 `kubeadm init` 创建的节点上，在 kubeadm 1.17 版本之前有一个
[缺陷](https://github.com/kubernetes/kubeadm/issues/1753)，该缺陷
使得你必须手动修改 `kubelet.conf` 文件的内容。
`kubeadm init` 操作结束之后，你必须更新 `kubelet.conf` 文件
将 `client-certificate-data` 和 `client-key-data` 改为如下所示的内容
以便使用轮换后的 kubelet 客户端证书：
```yaml
client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
```
{{< /warning >}}
<!--
## Automatic certificate renewal
-->
## 自动更新证书
<!--
`kubeadm` renews all the certificates during control plane [upgrade](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-15/).
-->
`kubeadm` 会在控制面板[升级](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-15/)的时候更新所有证书
## 自动更新证书
`kubeadm` 会在控制面
[升级](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/)
的时候更新所有证书。
<!--
This feature is designed for addressing the simplest use cases;
if you don't have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.
-->
这个功能旨在解决最简单的用例；如果您对此类证书的更新没有特殊要求，并且定期执行 Kubernetes 版本升级（每次升级之间的间隔时间少于 1 年），则 kubeadm 将确保您的集群保持最新状态并保持合理的安全性。
这个功能旨在解决最简单的用例；如果你对此类证书的更新没有特殊要求，
并且定期执行 Kubernetes 版本升级（每次升级之间的间隔时间少于 1 年），
则 kubeadm 将确保你的集群保持最新状态并保持合理的安全性。
{{< note >}}
<!--
It is a best practice to upgrade your cluster frequently in order to stay secure.
-->最佳的做法是经常升级集群以确保安全。
-->
{{< note >}}
最佳的做法是经常升级集群以确保安全。
{{< /note >}}
<!--
If you have more complex requirements for certificate renewal, you can opt out from the default behavior by passing `--certificate-renewal=false` to `kubeadm upgrade apply` or to `kubeadm upgrade node`.
-->
如果你对证书更新有更复杂的需求，则可通过将 `--certificate-renewal=false` 传递给
`kubeadm upgrade apply` 或者 `kubeadm upgrade node`，从而选择不采用默认行为。
如果您对证书更新有更复杂的需求，则可通过将 `--certificate-renewal=false` 传递给 `kubeadm upgrade apply` 或者 `kubeadm upgrade node` ，从而选择不采用默认行为。
<!--
Prior to kubeadm version 1.17 there is a [bug](https://github.com/kubernetes/kubeadm/issues/1818)
where the default value for `--certificate-renewal` is `false` for the `kubeadm upgrade node`
command. In that case, you should explicitly set `--certificate-renewal=true`.
-->
{{< warning >}}
kubeadm 在 1.17 版本之前有一个[缺陷](https://github.com/kubernetes/kubeadm/issues/1818)，
该缺陷导致 `kubeadm update node` 执行时 `--certificate-renewal` 的默认值被设置为 `false`。
在这种情况下，你需要显式地设置 `--certificate-renewal=true`。
{{< /warning >}}
<!--
## Manual certificate renewal
You can renew your certificates manually at any time with the `kubeadm alpha certs renew` command.
-->
## 手动更新证书
<!--
You can renew your certificates manually at any time with the `kubeadm alpha certs renew` command.
-->
您能随时通过 `kubeadm alpha certs renew` 命令手动更新您的证书。
你能随时通过 `kubeadm alpha certs renew` 命令手动更新你的证书。
<!--
This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`.
-->
此命令用 CA （或者 front-proxy-CA ）证书和存储在 `/etc/kubernetes/pki` 中的密钥执行更新。
这个命令用 CA （或者 front-proxy-CA ）证书和存储在 `/etc/kubernetes/pki` 中的密钥执行更新。
{{< warning >}}
<!--
If you are running an HA cluster, this command needs to be executed on all the control-plane nodes.
-->如果您运行了一个 HA 集群，这个命令需要在所有控制面板节点上执行。
-->
{{< warning >}}
如果你运行了一个 HA 集群，这个命令需要在所有控制面板节点上执行。
{{< /warning >}}
{{< note >}}
<!-- `alpha certs renew` uses the existing certificates as the authoritative source for attributes (Common Name, Organization, SAN, etc.) instead of the kubeadm-config ConfigMap. It is strongly recommended to keep them both in sync. -->
`alpha certs renew` 使用现有的证书作为属性 (Common Name、Organization、SAN 等) 的权威来源，而不是 kubeadm-config ConfigMap 。强烈建议使它们保持同步。
{{< note >}}
`alpha certs renew` 使用现有的证书作为属性 (Common Name、Organization、SAN 等) 的权威来源，
而不是 kubeadm-config ConfigMap 。强烈建议使它们保持同步。
{{< /note >}}
<!--
`kubeadm alpha certs renew` provides the following options:
-->
`kubeadm alpha certs renew` 提供下列选项
<!--
The Kubernetes certificates normally reach their expiration date after one year.
-->
Kubernetes 证书通常在一年后到期。
<!--
`kubeadm alpha certs renew` provides the following options:
- `--csr-only` can be used to renew certificats with an external CA by generating certificate signing requests (without actually renewing certificates in place); see next paragraph for more information.
-->
- `--csr-only` 可用于经过一个外部 CA 生成的证书签名请求来更新证书（无需实际替换更新证书）；更多信息请参见下一段。
<!--
- It's also possible to renew a single certificate instead of all.
-->
- 也可以更新单个证书而不是全部证书。
`kubeadm alpha certs renew` 提供下列选项
- `--csr-only` 可用于经过一个外部 CA 生成的证书签名请求来更新证书（无需实际替换更新证书）；
更多信息请参见下节。
- 可以更新单个证书而不是全部证书。
<!--
## Renew certificates with the Kubernetes certificates API
This section provide more details about how to execute manual certificate renewal using the Kubernetes certificates API.
-->
## 用 Kubernetes 证书 API 更新证书
<!--
This section provide more details about how to execute manual certificate renewal using the Kubernetes certificates API.
-->
本节提供有关如何使用 Kubernetes 证书 API 执行手动证书更新的更多详细信息。
{{< caution >}}
<!--
These are advanced topics for users who need to integrate their organization's certificate infrastructure into a kubeadm-built cluster. If the default kubeadm configuration satisfies your needs, you should let kubeadm manage certificates instead.
-->
这些是针对需要将其组织的证书基础结构集成到 kubeadm 构建的集群中的用户的高级主题。如果默认的 kubeadm 配置满足了您的需求，则应让 kubeadm 管理证书。
{{< caution >}}
这些是针对需要将其组织的证书基础结构集成到 kubeadm 构建的集群中的用户的高级主题。
如果默认的 kubeadm 配置满足了你的需求，则应让 kubeadm 管理证书。
{{< /caution >}}
<!--
### Set up a signer
-->
### 设置一个签名者
<!--
The Kubernetes Certificate Authority does not work out of the box.
You can configure an external signer such as [cert-manager][cert-manager-issuer], or you can use the build-in signer.
The built-in signer is part of [`kube-controller-manager`][kcm].
To activate the build-in signer, you pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` arguments.
-->
### 设置一个签名者（Signer）
Kubernetes 证书颁发机构不是开箱即用。
您可以配置外部签名者，例如 [cert-manager][cert-manager-issuer] ，也可以使用内置签名者。
内置签名者是 [`kube-controller-manager`][kcm] 的一部分。
你可以配置外部签名者，例如
[cert-manager](https://docs.cert-manager.io/en/latest/tasks/issuers/setup-ca.html)，
也可以使用内置签名者。
内置签名者是
[`kube-controller-manager`](/zh/docs/reference/command-line-tools-reference/kube-controller-manager/)
的一部分。
要激活内置签名者，请传递`--cluster-signing-cert-file` 和 `--cluster-signing-key-file`参数。
<!--
The built-in signer is part of [`kube-controller-manager`][kcm].
To activate the build-in signer, you must pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` flags.
-->
这个内置签名者是 [`kube-controller-manager`][kcm] 的一部分。
<!-- To activate the build-in signer, you must pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` flags. -->
要激活内置签名者，必须传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。
<!--
If you're creating a new cluster, you can use a kubeadm [configuration file][config]:
-->
如果您正在正在创建一个新的集群，您可以使用 kubeadm 的 [配置文件](config)
如果你正在正在创建一个新的集群，你可以使用 kubeadm 的
[配置文件](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2)。
```yaml
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
controllerManager:
extraArgs:
cluster-signing-cert-file: /etc/kubernetes/pki/ca.crt
cluster-signing-key-file: /etc/kubernetes/pki/ca.key
```
[cert-manager-issuer]: https://cert-manager.readthedocs.io/en/latest/tutorials/ca/creating-ca-issuer.html
[kcm]: /docs/reference/command-line-tools-reference/kube-controller-manager/
[config]: https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2
```yaml
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
controllerManager:
extraArgs:
cluster-signing-cert-file: /etc/kubernetes/pki/ca.crt
cluster-signing-key-file: /etc/kubernetes/pki/ca.key
```
<!--
### Create certificate signing requests (CSR)
You can create the certificate signing requests for the Kubernetes certificates API with `kubeadm alpha certs renew --use-api`.
-->
### 创建证书签名请求 (CSR)
<!--
You can create the certificate signing requests for the Kubernetes certificates API with `kubeadm alpha certs renew --use-api`.
-->
您能用 `kubeadm alpha certs renew --use-api` 为 Kubernetes 证书 API 创建一个证书签名请求。
你可以用 `kubeadm alpha certs renew --use-api` 为 Kubernetes 证书 API 创建一个证书签名请求。
<!--
If you set up an external signer such as [cert-manager][cert-manager], certificate signing requests (CSRs) are automatically approved.
Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command.
The following kubeadm command outputs the name of the certificate to approve, then blocks and waits for approval to occur:
-->
如果您设置例如 [cert-manager][cert-manager] 等外部签名者，则会自动批准证书签名请求（CSRs）。
否者，您必须使用 [`kubectl certificate`][certs] 命令手动批准证书。
以下 kubeadm 命令输出要批准的证书名称，然后缓慢等待批准发生：
如果你设置例如 [cert-manager](https://github.com/jetstack/cert-manager)
等外部签名者，证书签名请求（CSRs）会被自动批准。
否则，你必须使用 [`kubectl certificate`](/zh/docs/setup/best-practices/certificates/)
命令手动批准证书。
以下 kubeadm 命令输出要批准的证书名称，然后阻塞等待批准发生：
```shell
sudo kubeadm alpha certs renew apiserver --use-api &
```
<!--
The output is similar to this:
-->
<!-- The output is similar to this: -->
输出类似于以下内容：
```
[1] 2890
@@ -273,41 +338,42 @@ The output is similar to this:
<!--
### Approve certificate signing requests (CSR)
If you set up an external signer, certificate signing requests (CSRs) are automatically approved.
Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command. e.g.
-->
### 批准证书签名请求 (CSR)
<!--
If you set up an external signer, certificate signing requests (CSRs) are automatically approved.
-->
如果您设置了一个外部签名者， 证书签名请求 (CSRs) 会自动被批准。
如果你设置了一个外部签名者， 证书签名请求 (CSRs) 会自动被批准。
<!-- Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command. e.g. -->
否则，您必须用 [`kubectl certificate`][certs] 命令手动批准证书，例如
否则，你必须用 [`kubectl certificate`](/zh/docs/setup/best-practices/certificates/)
命令手动批准证书，例如：
```shell
kubectl certificate approve kubeadm-cert-kube-apiserver-ld526
```
<!--
The output is similar to this:
-->
The output is similar to this: -->
输出类似于以下内容：
```shell
```
certificatesigningrequest.certificates.k8s.io/kubeadm-cert-kube-apiserver-ld526 approved
```
<!--
You can view a list of pending certificates with `kubectl get csr`.
-->
您可以使用 `kubectl get csr` 查看待处理证书列表。
你可以使用 `kubectl get csr` 查看待处理证书列表。
<!--
## Renew certificates with external CA
This section provide more details about how to execute manual certificate renewal using an external CA.
-->
## 通过外部 CA 更新证书
<!--
This section provide more details about how to execute manual certificate renewal using an external CA.
-->
本节提供有关如何使用外部 CA 执行手动更新证书的更多详细信息。
<!--
@@ -321,70 +387,65 @@ CSR 表示向 CA 请求客户的签名证书。
<!--
### Create certificate signing requests (CSR)
You can create certificate signing requests with `kubeadm alpha certs renew --csr-only`.
Both the CSR and the accompanying private key are given in the output.
You can pass in a directory with `--csr-dir` to output the CSRs to the specified location.
If `--csr-dir` is not specified, the default certificate directory (`/etc/kubernetes/pki`) is used.
-->
### 创建证书签名请求 (CSR)
<!--
You can pass in a directory with `--csr-dir` to output the CSRs to the specified location.
If `--csr-dir` is not specified, the default certificate directory (`/etc/kubernetes/pki`) is used.
Both the CSR and the accompanying private key are given in the output. After a certificate is signed, the certificate and the private key must be copied to the PKI directory (by default `/etc/kubernetes/pki`).
-->
您可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。
你可以通过 `kubeadm alpha certs renew --csr-only` 命令创建证书签名请求。
CSR 和随附的私钥都在输出中给出。
你可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。
如果未指定 `--csr-dir` ，则使用默认证书目录( `/etc/kubernetes/pki` )。
CSR 和随附的私钥都在输出中给出。签署证书后，必须将证书和私钥复制到 PKI 目录（默认情况下为 `/etc/kubernetes/pki`）。
<!--
A CSR represents a request to a CA for a signed certificate for a client.
-->
CSR 代表对 CA 的请求，要求获得客户端的签名证书。
<!--
You can create certificate signing requests with `kubeadm alpha certs renew --csr-only`.
-->
您能用 `kubeadm alpha certs renew --csr-only` 创建一个证书签名请求。
<!--
Both the CSR and the accompanying private key are given in the output; you can pass in a directory with `--csr-dir` to output the CSRs to the specified location.
-->
输出中给出了 CSR 和随附的私钥；您可以输入目录名和 `--csr-dir` ，以将 CSR 输出到指定位置。
<!--
<!--
Certificates can be renewed with `kubeadm alpha certs renew --csr-only`.
As with `kubeadm init`, an output directory can be specified with the `--csr-dir` flag.
To use the new certificates, copy the signed certificate and private key into the PKI directory (by default `/etc/kubernetes/pki`)
-->
证书能用 `kubeadm alpha certs renew --csr-only` 更新。
证书可以通过 `kubeadm alpha certs renew --csr-only` 来续订。
和 `kubeadm init` 一样，可以使用 `--csr-dir` 标志指定一个输出目录。
在 `kubeadm init` ,通过 `--csr-dir` 能指定输出文件夹。
CSR 签署证书后，必须将证书和私钥复制到 PKI 目录（默认情况下为 `/etc/kubernetes/pki`）。
要使用新证书，请将签名的证书和私钥复制到 PKI 目录（默认情况下为 `/etc/kubernetes/pki` ）
<!--
A CSR contains a certificate's name, domain(s), and IPs, but it does not specify usages.
<!--
A CSR contains a certificate's name, domains, and IPs, but it does not specify usages.
It is the responsibility of the CA to specify [the correct cert usages](/docs/setup/best-practices/certificates/#all-certificates)
when issuing a certificate.
-->
一个 CSR 包含一个证书的名字，域和 IP， 但是未指定用法
<!--
It is the responsibility of the CA to specify [the correct cert usages][cert-table] when issuing a certificate.
-->
颁发证书时， CA 有责任指定[正确的证书用法][cert-table] 。
CSR 中包含一个证书的名字，域和 IP，但是未指定用法。
颁发证书时，CA 有责任指定[正确的证书用法](/zh/docs/setup/best-practices/certificates/#all-certificates)
<!--
* In `openssl` this is done with the [`openssl ca` command][openssl-ca].
* In `cfssl` you specify [usages in the config file][cfssl-usages]
-->
* 在 `openssl` 中，这是通过 [`openssl ca` 命令][openssl-ca] 完成的。
* 在 `cfssl` 中，这是通过 [在配置文件中指定用法][cfssl-usages] 来完成的。
* 在 `openssl` 中，这是通过
[`openssl ca` 命令](https://superuser.com/questions/738612/openssl-ca-keyusage-extension)
来完成的。
* 在 `cfssl` 中，这是通过
[在配置文件中指定用法](https://github.com/cloudflare/cfssl/blob/master/doc/cmd/cfssl.txt#L170)
来完成的。
<!--
After a certificate is signed using your preferred method, the certificate and the private key must be copied to the PKI directory (by default `/etc/kubernetes/pki`).
-->
使用首选方法对证书签名后，必须将证书和私钥复制到 PKI 目录（默认为 `/etc/kubernetes/pki` ）。
使用首选方法对证书签名后，必须将证书和私钥复制到 PKI 目录（默认为 `/etc/kubernetes/pki` ）。
<!--
## Certificate authority (CA) rotation {#certificate-authority-rotation}
[openssl-ca]: https://superuser.com/questions/738612/openssl-ca-keyusage-extension
[cfssl-usages]: https://github.com/cloudflare/cfssl/blob/master/doc/cmd/cfssl.txt#L170
[certs]: /docs/setup/best-practices/certificates/
[cert-cas]: /docs/setup/best-practices/certificates/#single-root-ca
[cert-table]: /docs/setup/best-practices/certificates/#all-certificates
Kubeadm does not support rotation or replacement of CA certificates out of the box.
For more information about manual rotation or replacement of CA, see [manual rotation of CA certificates](/docs/tasks/tls/manual-rotation-of-ca-certificates/).
-->
## 证书机构（CA）轮换 {#certificate-authority-rotation}
kubeadm 并不直接支持对 CA 证书的轮换或者替换。
关于手动轮换或者置换 CA 的更多信息，可参阅
[手动轮换 CA 证书](/zh/docs/tasks/tls/manual-rotation-of-ca-certificates/)。