Kubernetes集群部署之二CA证书制作详解架构师

[[email protected] ~]# cd /usr/local/src 

[[email protected]-master src]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 

[[email protected] src]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 

[[email protected] src]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 

[[email protected] src]# chmod +x cfssl* 

[[email protected]-master src]# mv cfssl-certinfo_linux-amd64 /opt/kubernetes/bin/cfssl-certinfo 

[[email protected]-master src]# mv cfssljson_linux-amd64 /opt/kubernetes/bin/cfssljson 

[[email protected]-master src]# mv cfssl_linux-amd64 /opt/kubernetes/bin/cfssl

复制cfssl命令文件到k8s-node1和k8s-node2节点。如果实际中多个节点，就都需要同步复制。

[[email protected] ~]# scp /opt/kubernetes/bin/cfssl* 10.200.3.106:/opt/kubernetes/bin 

[[email protected]-master ~]# scp /opt/kubernetes/bin/cfssl* 10.200.3.107:/opt/kubernetes/bin

设置环境变量

[[email protected] ~]#vim /etc/profile 

 export PATH=/opt/kubernetes/bin/:$PATH 

[[email protected]-master ~]# source /etc/profile

2. 初始化cfssl,并创建临时证书目录:

[[email protected] src]# mkdir ssl cd ssl 

[[email protected]-master ssl]# cfssl print-defaults config config.json 

[[email protected]-master ssl]# cfssl print-defaults csr csr.json

3. 创建用来生成 CA 文件的 JSON 配置文件

[[email protected] ssl]#cat ca-config.json EOF 

 "signing": { 

 "default": { 

 "expiry": "8760h" 

 "profiles": { 

 "kubernetes": { 

 "usages": [ 

 "signing", 

 "key encipherment", 

 "server auth", 

 "client auth" 

 "expiry": "8760h" 

EOF

4. 创建用来生成 CA 证书签名请求（CSR）的 JSON 配置文件

[[email protected] ssl]# cat ca-csr.json EOF 

 "CN": "kubernetes", 

 "key": { 

 "algo": "rsa", 

 "size": 2048 

 "names": [ 

 "C": "CN", 

 "ST": "BeiJing", 

 "L": "BeiJing", 

 "O": "k8s", 

 "OU": "System" 

EOF

5. 生成CA证书（ca.pem）和密钥（ca-key.pem）

[[email protected] ssl]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca 

[[email protected] ssl]# ls -l ca* 

-rw-r--r-- 1 root root 290 Mar 4 13:45 ca-config.json 

-rw-r--r-- 1 root root 1001 Mar 4 14:09 ca.csr 

-rw-r--r-- 1 root root 208 Mar 4 13:51 ca-csr.json 

-rw------- 1 root root 1679 Mar 4 14:09 ca-key.pem 

-rw-r--r-- 1 root root 1359 Mar 4 14:09 ca.pem 

6.分发证书

[[email protected] ssl]# cp ca.csr ca.pem ca-key.pem ca-config.json /opt/kubernetes/ssl 

SCP证书到k8s-node1和k8s-node2节点 

[[email protected]-master ssl]# scp ca.csr ca.pem ca-key.pem ca-config.json 10.200.3.106:/opt/kubernetes/ssl 

[[email protected]-master ssl]# scp ca.csr ca.pem ca-key.pem ca-config.json 10.200.3.107:/opt/kubernetes/ssl

6899.html