kubernetes1.8.4安装指南 -- 5. 证书生成

下载cfssl工具
cd /usr/local/src/
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o cfssl-certinfo
chmod +x cfssl*
加入PATH

mkdir -p /etc/kubernetes/pki

cd /etc/kubernetes/pki

ca-config.json

{"signing":{"default":{"expiry":"87600h"},"profiles":{"kubernetes":{"usages":["signing","key encipherment","server auth","client auth"],"expiry":"87600h"}}}}

ca-csr.json

{"CN":"kubernetes","key":{"algo":"rsa","size":2048},"names":[{"C":"CN","ST":"Shanghai","L":"Shanghai","O":"Kubernetes","OU":"Kubernetes-manual"}]}

生成CA私钥和证书

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

apiserver-csr.json

{"CN":"kube-apiserver","hosts":["127.0.0.1","10.96.0.1","10.0.0.210","kubernetes","kubernetes.default","kubernetes.default.svc","kubernetes.default.svc.cluster","kubernetes.default.svc.cluster.local","node210"],"key":{"algo":"rsa","size":2048},"names":[{"C":"CN","ST":"Shanghai","L":"Shanghai","O":"Kubernetes","OU":"Kubernetes-manual"}]}

生成kube-apiserver私钥和证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes apiserver-csr.json | cfssljson -bare apiserver

生成Front proxy CA私钥和证书

front-proxy-ca-csr.json

{"CN":"kubernetes","key":{"algo":"rsa","size":2048}}

cfssl gencert -initca front-proxy-ca-csr.json | cfssljson -bare front-proxy-ca

生成Front proxy client 私钥和证书

front-proxy-client-csr.json

{"CN":"front-proxy-client","key":{"algo":"rsa","size":2048}}

cfssl gencert -ca=front-proxy-ca.pem -ca-key=front-proxy-ca-key.pem -config=ca-config.json -profile=kubernetes front-proxy-client-csr.json | cfssljson -bare front-proxy-client

使用Bootstrap Token

$ head -c 16 /dev/urandom | od -An -t x | tr -d ' '

生成/etc/kubernetes/token.csv文件，第一项内容为上面命令的输出结果。

a9ccc6ef5dd93b83f02080f5c022f42c,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

生成kubeconfig文件bootstrap.conf

kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=https://10.0.0.210:6443 --kubeconfig=../bootstrap.conf

kubectl config set-credentials kubelet-bootstrap --token=a9ccc6ef5dd93b83f02080f5c022f42c --kubeconfig=../bootstrap.conf

kubectl config set-context default --cluster=kubernetes --user=kubelet-bootstrap --kubeconfig=../bootstrap.conf

kubectl config use-context default --kubeconfig=../bootstrap.conf

生成admin的私钥和证书

admin-csr.json

{"CN":"admin","key":{"algo":"rsa","size":2048},"names":[{"C":"CN","ST":"Shanghai","L":"Shanghai","O":"system:masters","OU":"Kubernetes-manual"}]}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

生成kubeconfig文件admin.conf

kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=https://10.0.0.210:6443 --kubeconfig=../admin.conf

kubectl config set-credentials kubernetes-admin --client-certificate=admin.pem --client-key=admin-key.pem --embed-certs=true --kubeconfig=../admin.conf

kubectl config set-context kubernetes-admin@kubernetes --cluster=kubernetes --user=kubernetes-admin --kubeconfig=../admin.conf

kubectl config use-context kubernetes-admin@kubernetes --kubeconfig=../admin.conf

生成controller-manager的私钥和证书

manager-csr.json

{"CN":"system:kube-controller-manager","key":{"algo":"rsa","size":2048},"names":[{"C":"CN","ST":"Shanghai","L":"Shanghai","O":"system:kube-controller-manager","OU":"Kubernetes-manual"}]}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes manager-csr.json | cfssljson -bare controller-manager

生成kubeconfig文件controller-manager.conf

kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=https://10.0.0.210:6443 --kubeconfig=../controller-manager.conf

kubectl config set-credentials system:kube-controller-manager --client-certificate=controller-manager.pem --client-key=controller-manager-key.pem --embed-certs=true --kubeconfig=../controller-manager.conf

kubectl config set-context system:kube-controller-manager@kubernetes --cluster=kubernetes --user=system:kube-controller-manager --kubeconfig=../controller-manager.conf

kubectl config use-context system:kube-controller-manager@kubernetes --kubeconfig=../controller-manager.conf

生成sheduler的私钥和证书

scheduler-csr.json

{"CN":"system:kube-scheduler","key":{"algo":"rsa","size":2048},"names":[{"C":"CN","ST":"Shanghai","L":"Shanghai","O":"system:kube-scheduler","OU":"Kubernetes-manual"}]}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes scheduler-csr.json | cfssljson -bare scheduler

生成kubeconfig文件scheduler.conf

kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=https://10.0.0.210:6443 --kubeconfig=../scheduler.conf

kubectl config set-credentials system:kube-scheduler --client-certificate=scheduler.pem --client-key=scheduler-key.pem --embed-certs=true --kubeconfig=../scheduler.conf

kubectl config set-context system:kube-scheduler@kubernetes --cluster=kubernetes --user=system:kube-scheduler --kubeconfig=../scheduler.conf

kubectl config use-context system:kube-scheduler@kubernetes --kubeconfig=../scheduler.conf

kubernetes master节点kubelet证书生成

kubelet-csr.json

{"CN":"system:node:node210","key":{"algo":"rsa","size":2048},"names":[{"C":"CN","L":"Shanghai","ST":"Shanghai","O":"system:nodes","OU":"Kubernetes-manual"}]}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -hostname=node210,10.0.0.210 -profile=kubernetes kubelet-csr.json | cfssljson -bare kubelet

生成kubeconfig文件kubelet.conf

kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=https://10.0.0.210:6443 --kubeconfig=../kubelet.conf

kubectl config set-credentials system:node:node210 --client-certificate=kubelet.pem --client-key=kubelet-key.pem --embed-certs=true --kubeconfig=../kubelet.conf

kubectl config set-context system:node:node210@kubernetes --cluster=kubernetes --user=system:node:node210 --kubeconfig=../kubelet.conf

kubectl config use-context system:node:node210@kubernetes --kubeconfig=../kubelet.conf

service account 私钥和证书生成

openssl genrsa -out sa.key 2048

openssl rsa -in sa.key -pubout -out sa.pub

最终结果如下

备注说明：kube-proxy.conf， kube-proxy.pem, kube-proxy-key.pem会在后面的步骤生成。

kubernetes1.8.4安装指南 -- 5. 证书生成相关推荐

数字证书应用综合揭秘(包括证书生成、加密、解密、签名、验签)
引言数字证书是一个经证书授权中心数字签名的包含公开密钥拥有者信息以及公开密钥的文件.为现实网络安全化标准如今大部分的 B2B.B2C.P2P.O2O 等商业网站含有重要企业资料个人资料的信息资信网站 ...
xcode 证书生成、加载
Xcode 证书生成.设置.应用,与大家分享.如果按下面步骤还不能编译成功,我手把手教你. 开发环境: Mac OS lion 10.7.4 XCode 4.3.3 1 点击钥匙图标 ...
Window+Java环境证书生成说明，pfx证书已经生成
Window+Java环境证书生成说明阅读说明:给具备基本开发能力的人提供自制证书的生成步骤,证书属于敏感信息,生产证书请勿泄漏. 前置条件:Windows系统.JDK1.6以上版本.java编译工 ...
Xcode 证书生成、设置、应用(转)
Xcode 证书生成.设置.应用,与大家分享.如果按下面步骤还不能编译成功,我手把手教你. 开发环境: Mac OS lion 10.7.4 XCode 4.3.3 1 点击钥匙图标 ...
ssl证书生成详细流程
ssl证书生成详细流程 SSL单向认证概念 1 keystore以及服务器密钥对儿的生成 2 验证新生成的keystore文件以及证书信息 3 导出公钥证书 4 Truststore的生成以及公钥证 ...
uniapp 安卓证书生成
uniapp android私有证书的生成一.基本概念了解 1.什么是证书:证书是一个开发者的身份标志,对Android系统而言.使用一个证书签发的App,是属于同一个开发者的App,强化了App的 ...
fiddler证书生成ca证书命令及抓包配置
fiddler证书生成ca证书命令下载OpenSSL fiddler配置https fiddler导出证书将文件直接放到openssl的bin目录下执行cmd命令生成ca证书将证书放到andr ...
kubernetes中证书生成
kubernetes中证书生成为了安全起见,建议在kubernetes中使用安全证书.在之前的文章中,而是统一在集群搭建中制造,并没有单独介绍证书的生成.本文将介绍kubernetes中证书生成.一 ...
免费https证书生成
在线证书生成工具网站 freessl.cn 生成csr 证书管理工具 KeyManager

kubernetes1.8.4安装指南 -- 5. 证书生成

kubernetes1.8.4安装指南 -- 5. 证书生成相关推荐

最新文章

热门文章