K8S搭建过程随笔_证书CFSSL

  安装CFSSL

mkdir -p /opt/k8s/cert && cd /opt/k8s
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
mv cfssl_linux-amd64 /opt/k8s/bin/cfssl

wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
mv cfssljson_linux-amd64 /opt/k8s/bin/cfssljson

wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
mv cfssl-certinfo_linux-amd64 /opt/k8s/bin/cfssl-certinfo

chmod +x /opt/k8s/bin/*
export PATH=/opt/k8s/bin:$PATH

  创建根证书 (CA)

根证书只需要创建一个,其他证书需要他来签名

  创建配置文件

cd /opt/k8s/work
cat > ca-config.json <{
  "signing": {
    "default": {
      "expiry": "87600h"
  },
  "profiles": {
    "kubernetes": {
      "usages": [
        "signing",
        "key encipherment",
        "server auth",
        "client auth"
        ],
      "expiry": "87600h"
      }
    }
  }
}
EOF

###

ca-config.json:可以定义多个 profiles,分别指定不同的过期时间、使用场景等参数;后续在签名证书时使用某个 profile;此实例只有一个kubernetes模板。
signing:表示该证书可用于签名其它证书;生成的 ca.pem 证书中 CA=TRUE;
server auth:表示client可以用该 CA 对server提供的证书进行验证;
client auth:表示server可以用该CA对client提供的证书进行验证;

###

  创建证书签名请求文件

cd /opt/k8s/work
cat > ca-csr.json <{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
   {
    "C": "CN",
    "ST": "BeiJing",
    "L": "BeiJing",
    "O": "k8s",
    "OU": "grt"
   }
  ]
}
EOF

###

"CN":Common Name,kube-apiserver 从证书中提取该字段作为请求的用户名 (User Name)

"O":Organization,kube-apiserver 从证书中提取该字段作为请求用户所属的组 (Group)

###

  生成CA证书

cd /opt/k8s/work
cfssl gencert -initca ca-csr.json | cfssljson -bare ca

 将会生成 ca-key.pem(私钥) ca.pem(公钥)

将公钥发送给 所有节点

cd /opt/k8s/work
source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
  do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p /etc/kubernetes/cert"
    scp ca.pem  root@${node_ip}:/etc/kubernetes/cert
  done

将公钥、私钥、配置文件移动到/etc/kubernetes/cert目录

### ETCD 集群证书 

创建证书签名请求:

cd /opt/k8s/work
cat > etcd-csr.json <{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.11.188"
  ],
  "key": {
  "algo": "rsa",
  "size": 2048
  },
  "names": [
   {
    "C": "CN",
    "ST": "BeiJing",
    "L": "BeiJing",
    "O": "k8s",
    "OU": "grt"
   }
  ]
}
EOF

###生成证书和私钥:

cfssl gencert -ca=/opt/k8s/work/ca.pem \
-ca-key=/opt/k8s/work/ca-key.pem \
-config=/opt/k8s/work/ca-config.json \
-profile=kubernetes etcd-csr.json | cfssljson -bare etcd

###发送到ETCD节点

source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
echo ">>> ${node_ip}"
ssh root@${node_ip} "mkdir -p /etc/etcd/cert"
scp etcd*.pem root@${node_ip}:/etc/etcd/cert/
done

###    flannel 证书和私钥

创建证书签名请求:

cd /opt/k8s/work
cat > flanneld-csr.json <{
 "CN": "flanneld",
 "hosts": [],
 "key": {
  "algo": "rsa",
  "size": 2048
 },
 "names": [
  {
   "C": "CN",
   "ST": "BeiJing",
   "L": "BeiJing",
   "O": "k8s",
   "OU": "grt"
  }
 ]
}
EOF

###生成证书和私钥

cfssl gencert -ca=/opt/k8s/work/ca.pem \
-ca-key=/opt/k8s/work/ca-key.pem \
-config=/opt/k8s/work/ca-config.json \
-profile=kubernetes flanneld-csr.json | cfssljson -bare flanneld

###发送到所有节点

source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
do
echo ">>> ${node_ip}"
ssh root@${node_ip} "mkdir -p /etc/flanneld/cert"
scp flanneld*.pem root@${node_ip}:/etc/flanneld/cert
done

### kubectl 证书

创建证书签名

cd /opt/k8s/work
cat > admin-csr.json <{
 "CN": "admin",
 "hosts": [],
 "key": {
  "algo": "rsa",
  "size": 2048
 },
 "names": [
  {  
   "C": "CN",
   "ST": "BeiJing",
   "L": "BeiJing",
   "O": "system:masters",
   "OU": "grt"
  }
 ]
}
EOF

### 生成证书和私钥

cfssl gencert -ca=/opt/k8s/work/ca.pem \
-ca-key=/opt/k8s/work/ca-key.pem \
-config=/opt/k8s/work/ca-config.json \
-profile=kubernetes admin-csr.json | cfssljson -bare admin

### apiserver 

签名请求

cat > kubernetes-csr.json <{
  "CN": "kubernetes",
  "hosts": [
  "127.0.0.1",
  "192.168.11.188",
  "${CLUSTER_KUBERNETES_SVC_IP}",
  "kubernetes",
  "kubernetes.default",
  "kubernetes.default.svc",
  "kubernetes.default.svc.cluster",
  "kubernetes.default.svc.cluster.local."
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
   {
    "C": "CN",
    "ST": "BeiJing",
    "L": "BeiJing",
    "O": "k8s",
    "OU": "grt"
   }
  ]
}
EOF

### 生成证书和私钥

cfssl gencert -ca=/opt/k8s/work/ca.pem \
-ca-key=/opt/k8s/work/ca-key.pem \
-config=/opt/k8s/work/ca-config.json \
-profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes

### 发送到master节点

source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
  do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p /etc/kubernetes/cert"
    scp kubernetes*.pem root@${node_ip}:/etc/kubernetes/cert/
  done

 ###    kube-controller-manager 集群

创建证书签名请求

cd /opt/k8s/work
cat > kube-controller-manager-csr.json <{
  "CN": "system:kube-controller-manager",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "hosts": [
    "127.0.0.1",
    "192.168.11.188"
  ],
  "names": [
   {
    "C": "CN",
    "ST": "BeiJing",
    "L": "BeiJing",
    "O": "system:kube-controller-manager",
    "OU": "grt"
   }
  ]
}
EOF

生成证书和私钥:

cfssl gencert -ca=/opt/k8s/work/ca.pem \
-ca-key=/opt/k8s/work/ca-key.pem \
-config=/opt/k8s/work/ca-config.json \
-profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

将生成的证书和私钥分发到所有 master 节点:

source /opt/k8s/bin/environment.sh
for node_ip in ${NODE_IPS[@]}
  do
    echo ">>> ${node_ip}"
    scp kube-controller-manager*.pem root@${node_ip}:/etc/kubernetes/cert/
  done

 

你可能感兴趣的:(K8S搭建过程随笔_证书CFSSL)