k8s集羣部署v1.15實踐2:建立集羣使用的證書

參考文檔

建立集羣使用的證書

1.安裝CFSSL

使用CloudFlare 的 PKI 工具集 cfssl 來生成 Certificate Authority(CA)證書和祕鑰文件.
CA 是自簽名的證書,用來簽名後續建立的其它 TLS 證書.只須要在k8s-node1節點操做便可.

建立保存證書的目錄

[root@k8s-node1 ~]# mkdir -p /opt/k8s/cert && chown -R k8s /opt/k8s/
[root@k8s-node1 ~]# cd /opt/k8s/

下載CFSSL

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

[root@k8s-node1 k8s]# ls
bin  cert  cfssl-certinfo_linux-amd64  cfssljson_linux-amd64  cfssl_linux-amd64
[root@k8s-node1 k8s]#

複製文件到bin目錄

[root@k8s-node1 k8s]# cp cfssl* bin/
[root@k8s-node1 k8s]# cd bin
[root@k8s-node1 bin]# ls
cfssl-certinfo_linux-amd64  cfssljson_linux-amd64  cfssl_linux-amd64  environment.sh

更名字

[root@k8s-node1 k8s]# ls
bin  cert  cfssl-certinfo_linux-amd64  cfssljson_linux-amd64  cfssl_linux-amd64
[root@k8s-node1 k8s]# cp cfssl* bin
[root@k8s-node1 bin]# for i in *;do mv $i `echo $i |sed 's/\_linux-amd64//g'`;done
[root@k8s-node1 bin]# ls
cfssl  cfssl-certinfo  cfssljson  environment.sh

定義永久執行路徑

[root@k8s-node1 ~]# echo "export PATH=/opt/k8s/bin:$PATH" >>.bashrc

[root@k8s-node1 ~]# cat .bashrc 
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
if [ -f /etc/bashrc ]; then
    . /etc/bashrc
fi
export PATH=/opt/k8s/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin

[root@k8s-node1 ~]# source .bashrc
[root@k8s-node1 ~]# chmod +x /opt/k8s/bin/*
[root@k8s-node1 ~]# cfssl version
Version: 1.2.0
Revision: dev
Runtime: go1.6
[root@k8s-node1 ~]#

2.建立根證書

CA 證書是集羣全部節點共享的,只須要建立一個 CA 證書,後續建立的全部證書都由它簽名.

2.1.建立配置文件

CA 配置文件用於配置根證書的使用場景 (profile) 和具體參數 (usage,過時時間,服務端認證,客戶端認證,加密等),後續在簽名其它證書時須要指定特定場景.

signing:表示該證書可用於簽名其它證書，生成的 ca.pem 證書中 CA=TRUE；

server auth:表示 client 能夠用該該證書對 server 提供的證書進行驗證;

client auth:表示 server 能夠用該該證書對 client 提供的證書進行驗證;

[root@k8s-node1 cfssl]# pwd
/opt/k8s/cfssl
[root@k8s-node1 cfssl]# cat ca-config.json
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "87600h"
      }
    }
  }
}
[root@k8s-node1 cfssl]#

2.2.建立證書籤名請求文件

[root@k8s-node1 cfssl]# cat ca-csr.json 
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SZ",
      "L": "SZ",
      "O": "k8s",
      "OU": "4Paradigm"
    }
  ]
}
[root@k8s-node1 cfssl]#

2.3.生成CA證書和私鑰

[root@k8s-node1 cfssl]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
2019/10/30 00:20:52 [INFO] generating a new CA key and certificate from CSR
2019/10/30 00:20:52 [INFO] generate received request
2019/10/30 00:20:52 [INFO] received CSR
2019/10/30 00:20:52 [INFO] generating key: rsa-2048
2019/10/30 00:20:53 [INFO] encoded CSR
2019/10/30 00:20:53 [INFO] signed certificate with serial number 391616127368805998914414727447083706415301484072
[root@k8s-node1 cfssl]# ls ca*
ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem
[root@k8s-node1 cfssl]#

2.4.分發證書到節點

[root@k8s-node1 cfssl]# cp ca* /etc/kubernetes/cert/
[root@k8s-node1 cfssl]# scp ca* root@k8s-node2:/etc/kubernetes/cert/
ca-config.json                                                                                        100%  292   233.4KB/s   00:00    
ca.csr                                                                                                100%  993   722.2KB/s   00:00    
ca-csr.json                                                                                           100%  201   145.1KB/s   00:00    
ca-key.pem                                                                                            100% 1675   231.0KB/s   00:00    
ca.pem                                                                                                100% 1338     1.2MB/s   00:00    
[root@k8s-node1 cfssl]# scp ca* root@k8s-node3:/etc/kubernetes/cert/
ca-config.json                                                                                        100%  292   293.8KB/s   00:00    
ca.csr                                                                                                100%  993   766.8KB/s   00:00    
ca-csr.json                                                                                           100%  201   229.3KB/s   00:00    
ca-key.pem                                                                                            100% 1675     2.2MB/s   00:00    
ca.pem                                                                                                100% 1338     2.3MB/s   00:00    
[root@k8s-node1 cfssl]#