Offends/Kubernetes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

synchronization

Browse Source
This commit is contained in:
offends
2025-08-25 17:53:08 +08:00
commit c201eb5ef9
318 changed files with 23092 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

294
部署文档/二进制/Kubernetes手动证书签发.md Normal file
View File

@@ -0,0 +1,294 @@
> 本文作者：丁辉
# Kubernetes手动证书签发
## 环境准备
> 安装 CFSSL
1. 创建证书目录
```bash
mkdir /root/k8s
cd /root/k8s
```
2. 下载 CFSSL 文件
[Github下载地址](https://github.com/cloudflare/cfssl/releases)
```bash
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.4/cfssl_1.6.4_linux_amd64
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.4/cfssljson_1.6.4_linux_amd64
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.4/cfssl-certinfo_1.6.4_linux_amd64
```
3. 授权并移动到可执行目录下
```bash
chmod +x cfssl_*_linux_amd64 cfssljson_*_linux_amd64 cfssl-certinfo_*_linux_amd64
mv cfssl_*_linux_amd64 /usr/local/bin/cfssl
mv cfssljson_*_linux_amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_*_linux_amd64 /usr/bin/cfssl-certinfo
```
## 开始签发证书
1. 创建 CA 证书签名请求
```bash
cat > ca-csr.json <<EOF
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
],
"ca": {
"expiry": "87600h"
}
}
EOF
```
2. 生成 CA 证书和私钥
```bash
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
```
3. 创建 CA 配置文件
```bash
cat > ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"kubernetes": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "87600h"
}
}
}
}
EOF
```
4. 创建 kubernetes 证书
```bash
cat > kubernetes-csr.json <<EOF
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"192.168.1.10",
"192.168.1.20",
"192.168.1.30",
"10.244.0.1",
"kubernetes",
"kubernetes.default",
"kubernetes.default.svc",
"kubernetes.default.svc.cluster",
"kubernetes.default.svc.cluster.local"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF
```
5. 生成 kubernetes 证书和私钥
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
```
6. 创建 admin 证书
```bash
cat > admin-csr.json <<EOF
{
"CN": "admin",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:masters",
"OU": "System"
}
]
}
EOF
```
7. 生成 admin 证书和私钥
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin
```
8. 创建 kube-proxy 证书
```bash
cat > kube-proxy-csr.json <<EOF
{
"CN": "system:kube-proxy",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF
```
9. 生成 kube-proxy 客户端证书和私钥
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
```
10. 创建 kube-controller-manager 证书
```bash
cat > kube-controller-manager-csr.json <<EOF
{
"CN": "system:kube-controller-manager",
"hosts": [
"127.0.0.1",
"192.168.1.10",
"192.168.1.20",
"192.168.1.30"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:kube-controller-manager",
"OU": "System"
}
]
}
EOF
```
11. 生成 kube-scheduler 客户端证书和私钥
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager
```
12. 创建 kube-scheduler 证书
```bash
cat > kube-scheduler-csr.json <<EOF
{
"CN": "system:kube-scheduler",
"hosts": [
"127.0.0.1",
"192.168.1.10",
"192.168.1.20",
"192.168.1.30"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "system:kube-scheduler",
"OU": "System"
}
]
}
EOF
```
13. 生成 kube-scheduler 客户端证书和私钥
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler
```
14. 校验证书
- openssl 校验
```bash
openssl x509 -noout -text -in kubernetes.pem
```
- cfssl-certinfo 校验
```bash
cfssl-certinfo -cert kubernetes.pem
```
15. 分发证书
```bash
mkdir -p /etc/kubernetes/pki
cp *.pem /etc/kubernetes/pki
```
**使用证书的组件如下**
- etcd：使用 kubernetes-key.pem、kubernetes.pem
- kube-apiserver：使用 kubernetes-key.pem、kubernetes.pem
- kubelet：使用 ca.pem
- kube-proxy：使用 kube-proxy-key.pem、kube-proxy.pem
- kubectl：使用 dmin-key.pem、admin.pem
- kube-controller-manager：使用 kube-controller-manager-key.pem、kube-controller-manager.pem
- kube-scheduler ：使用 kube-scheduler-key.pem、kube-scheduler.pem