一、环境说明
1、本环境使用系统版本ubuntu16.04
2、环境服务器ip 192.168.15.132 192.168.15.133 192.168.15.134
3、k8s的service ip子网为：10.254.0.0/16 dns的service ip设定为10.254.0.2 docker网络ip为10.253.0.0.0/16
4、本环境参照一步步安装k8s
5、k8s版本1.6.4
二、证书制作
注意：证书配置错误会导致后面很多验证错误，请自行注意，如果后续过程报证书错误，自行返回更新证书，再重启api control 等所有受错误证书影响的组件
生成的 CA 证书和秘钥文件如下：
ca-key.pem
ca.pem
kubernetes-key.pem
kubernetes.pem
kube-proxy.pem
kube-proxy-key.pem
admin.pem
admin-key.pem
使用证书的组件如下：
etcd：使用 ca.pem、kubernetes-key.pem、kubernetes.pem；
kube-apiserver：使用 ca.pem、kubernetes-key.pem、kubernetes.pem；
kubelet：使用 ca.pem；
kube-proxy：使用 ca.pem、kube-proxy-key.pem、kube-proxy.pem；
kubectl：使用 ca.pem、admin-key.pem、admin.pem；
1、下载cfssl工具
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
chmod +x cfssl_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x cfssljson_linux-amd64
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl-certinfo_linux-amd64
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
2、创建CA
mkdir /root/ssl
cd /root/ssl
cfssl print-defaults config > config.json
cfssl print-defaults csr > csr.json
根据模板文件创建ca证书
root@ubuntu132:~/ssl# cat ca-config.json
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"kubernetes": {
"usages": [
"signing",
"key encipherment",
"server auth" ,
"client auth"
],
"expiry": "87600h"
}
}
}
}
root@ubuntu132:~/ssl# cat ca-csr.json
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "sichuan",
"ST": "chengdu",
"O": "K8S",
"OU": "System"
}
]
}
生成ca证书和私钥
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
root@ubuntu132:~/ssl# ls ca*
ca-config.json ca.csr ca-csr.json ca-key.pem ca.pem
3、创建kubernetes证书
root@ubuntu132:~/ssl# cat kubernetes-csr.json
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"192.168.15.132",
"192.168.15.133",
"192.168.15.134",
"127.0.0.1",
"10.254.0.1", #为k8s的service第一个ip，不能缺少
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "sichuan",
"ST": "chengdu",
"O": "K8S",
"OU": "System"
}
]
}
root# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
root@ubuntu132:~/ssl# ls kubernetes*
kubernetes.csr kubernetes-csr.json kubernetes-key.pem kubernetes.pem
3、生成admin证书
root@ubuntu132:~/ssl# cat admin-csr.json
{
"CN": "admin",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "sichuan",
"ST": "chengdu",
"O": "system:masters",
"OU": "System"
}
]
}
root# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin
root@ubuntu132:~/ssl# ls admin*
admin.csr admin-csr.json admin-key.pem admin.pem
4、创建kube-proxy证书
root@ubuntu132:~/ssl# cat kube-proxy-csr.json
{
"CN": "system:kube-proxy",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "sichuan",
"ST": "chengdu",
"O": "K8S",
"OU": "System"
}
]
}
root# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
5、校验证书
root@ubuntu132:~/ssl# cat kube-proxy-csr.json
{
"CN": "system:kube-proxy",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "sichuan",
"ST": "chengdu",
"O": "K8S",
"OU": "System"
}
]
}
root@ubuntu132:~/ssl# cfssl-certinfo -cert kubernetes.pem
{
"subject": {
"common_name": "kubernetes",
"country": "CN",
"organization": "K8S",
"organizational_unit": "System",
"locality": "sichuan",
"province": "chengdu",
"names": [
"CN",
"chengdu",
"sichuan",
"K8S",
"System",
"kubernetes"
]
},
"issuer": {
"common_name": "kubernetes",
"country": "CN",
"organization": "K8S",
"organizational_unit": "System",
"locality": "sichuan",
"province": "chengdu",
"names": [
"CN",
"chengdu",
"sichuan",
"K8S",
"System",
"kubernetes"
]
},
"serial_number": "21319328974437703439675516504278703829575637313",
"sans": [
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local",
"127.0.0.1",
"192.168.15.132",
"192.168.15.133",
"192.168.15.134",
"127.0.0.1",
"10.254.0.1"
],
"not_before": "2017-12-01T09:39:00Z",
"not_after": "2027-11-29T09:39:00Z",
"sigalg": "SHA256WithRSA",
"authority_key_id": "F8:6C:92:4:47:47:26:B4:5B:F:49:65:C9:FD:BF:90:F:96:4D:92",
"subject_key_id": "5C:9E:CF:98:85:1E:32:11:C9:17:BF:6D:98:4A:D9:24:6F:57:BD:D2",
"pem": "-----BEGIN CERTIFICATE-----\nMIIEizCCA3OgAwIBAgIUA7v95O6TMv/QSTxp+KxYZ2nFmUEwDQYJKoZIhvcNAQEL\nBQAwZTELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB2NoZW5nZHUxEDAOBgNVBAcTB3Np\nY2h1YW4xDDAKBgNVBAoTA0s4UzEPMA0GA1UECxMGU3lzdGVtMRMwEQYDVQQDEwpr\ndWJlcm5ldGVzMB4XDTE3MTIwMTA5MzkwMFoXDTI3MTEyOTA5MzkwMFowZTELMAkG\nA1UEBhMCQ04xEDAOBgNVBAgTB2NoZW5nZHUxEDAOBgNVBAcTB3NpY2h1YW4xDDAK\nBgNVBAoTA0s4UzEPMA0GA1UECxMGU3lzdGVtMRMwEQYDVQQDEwprdWJlcm5ldGVz\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxxQcMjAa7sni50gTBX4Z\nYQVUyHlTahZBivVK8fK6bW3xoV/9ohQ7OUSJ/5ZvwsQZWnAmKJ0U1i12+efflMoB\nQnuikfQTtAksFIlAT6kWmZAfJD1I6NaPJXmA5/olWcMlPQZhfuwEES7bDeNwo4vo\n0C6IBdvFusi/CZPwdyHtPzB62V6UsanYkwZeUhmZXaUe0Mi2opA5IwbswGeTuYd7\nEN0c6FyuXQt1cdIFEwbOs2k+5YdE3vgw+deBW35rshnw9RvaQFHwU+sgXUaaR8G8\nDTNmnnmEPWo38tYonK0hE7uZdnviapYGhCF0lOXtqMdN4nFwt4nFG+S3h3b0oUM0\nRwIDAQABo4IBMTCCAS0wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF\nBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRcns+YhR4yEckX\nv22YStkkb1e90jAfBgNVHSMEGDAWgBT4bJIER0cmtFsPSWXJ/b+QD5ZNkjCBrQYD\nVR0RBIGlMIGiggprdWJlcm5ldGVzghJrdWJlcm5ldGVzLmRlZmF1bHSCFmt1YmVy\nbmV0ZXMuZGVmYXVsdC5zdmOCHmt1YmVybmV0ZXMuZGVmYXVsdC5zdmMuY2x1c3Rl\ncoIka3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FshwR/AAABhwTA\nqA+EhwTAqA+FhwTAqA+GhwR/AAABhwQK/gABMA0GCSqGSIb3DQEBCwUAA4IBAQAn\n1Au3tuEOiimJ+WQYeDTZvG4n1sNbIoMz+Bj3il07s+mjoRPtTz0/GfdFeHVtn6r+\nRVxdA8Ko8NJh9//J+ZlwfyLh809wEwP8JyascqWIHH1vnnIgN4jDaJCJbEDr4M04\nq3Jk5mShwnz1so9Nn2XdDhPnfNfl0hOcR8Qllkj/zHLV4XUBfvLXZrnXHTDkL/Q8\n/zIQSmW5xwOT2V/xcU5S1Kh45z+aXIjhhHdS4xj84U1YfSXC3besWTDIoFg1pli+\nit81HK1evl8KSWo1h67bZ0RGwmDufdvQPoeF5gQH1ZIJIOT3dr0QxluqtzwS1qG4\nsB/9ocHk7vzjyywja6JT\n-----END CERTIFICATE-----\n"
}
6、拷贝证书到所有节点
mkdir -p /etc/kubernetes/ssl
cp *.pem /etc/kubernetes/ssl