k8s-1.9.1-步骤三（创建证书）

----------------------------------------------------------------------------------------------------------------------------执行主机：192.168.1.15or16or18创建admin-csr.jsoncat >/root/kubernetes/server

wzz_ccr

2693人浏览 · 2018-04-05 23:03:27

wzz_ccr · 2018-04-05 23:03:27 发布

  ---------------------------------------------------------------------------------------------------------------------------- 

 
 执行主机：192.168.1.15or16or18 

 
 创建admin-csr.json 

  cat >/root/kubernetes/server/bin/ssl/admin-csr.json <<'HERE' 

{

  "CN": "admin", 

  "hosts": [], 

  "key": { 

  "algo": "rsa", 

  "size": 2048 

},

  "names": [ 

{

  "C": "CN", 

  "ST": "Shenzhen", 

  "L": "Shenzhen", 

  "O": "system:masters", 

  "OU": "System" 

}

]

}

  HERE 

 
 创建k8s-gencert.json 

  cat >/root/kubernetes/server/bin/ssl/k8s-gencert.json <<'HERE' 

{

  "signing": { 

  "default": { 

  "expiry": "87600h" 

},

  "profiles": { 

  "kubernetes": { 

  "usages": [ 

  "signing", 

  "key encipherment", 

  "server auth", 

  "client auth" 

],

  "expiry": "87600h" 

}

}

}

}

  HERE 

 
 创建k8s-root-ca-csr.json 

  cat >/root/kubernetes/server/bin/ssl/k8s-root-ca-csr.json <<'HERE' 

{

  "CN": "kubernetes", 

  "key": { 

  "algo": "rsa", 

  "size": 4096 

},

  "names": [ 

{

  "C": "CN", 

  "ST": "Shenzhen", 

  "L": "Shenzhen", 

  "O": "k8s", 

  "OU": "System" 

}

]

}

  HERE 

 
 创建kube-proxy-csr.json 

  cat >/root/kubernetes/server/bin/ssl/kube-proxy-csr.json <<'HERE' 

{

  "CN": "system:kube-proxy", 

  "hosts": [], 

  "key": { 

  "algo": "rsa", 

  "size": 2048 

},

  "names": [ 

{

  "C": "CN", 

  "ST": "Shenzhen", 

  "L": "Shenzhen", 

  "O": "k8s", 

  "OU": "System" 

}

]

}

  HERE 

 
 创建kubernetes-csr.json 

 
 #注:此处需要将dns首ip,etcd,k8s-master,k8s-node节点的ip都填上 

  cat >/root/kubernetes/server/bin/ssl/kubernetes-csr.json <<'HERE' 

{

  "CN": "kubernetes", 

  "hosts": [ 

  "127.0.0.1", 

  "192.168.1.15", 

  "192.168.1.16", 

  "192.168.1.18", 

  "10.254.0.1", 

  "kubernetes", 

  "kubernetes.default", 

  "kubernetes.default.svc", 

  "kubernetes.default.svc.cluster", 

  "kubernetes.default.svc.cluster.local" 

],

  "key": { 

  "algo": "rsa", 

  "size": 2048 

},

  "names": [ 

{

  "C": "CN", 

  "ST": "Shenzhen", 

  "L": "Shenzhen", 

  "O": "k8s", 

  "OU": "System" 

}

]

}

  HERE 

  ---------------------------------------------------------------------------------------------------------------------------- 

 
 执行主机：192.168.1.15or16or18 

 
 生成通用证书以及kubeconfig 

 
 进入ssl目录,共创建了五个文件cd /root/kubernetes/server/bin/ssl/ 

 
 生成证书 

  cfssl gencert --initca=true k8s-root-ca-csr.json | cfssljson --bare k8s-root-ca 

  for targetName in kubernetes admin kube-proxy; do cfssl gencert --ca k8s-root-ca.pem --ca-key k8s-root-ca-key.pem --config k8s-gencert.json --profile kubernetes $targetName-csr.json | cfssljson --bare $targetName done 

  ---------------------------------------------------------------------------------------------------------------------------- 

 
 执行主机：192.168.1.15or16or18 

 
 生成kubectl配置 

 
 注：此处定义api-server的服务ip，此处用为以后HA模式准备，所以配置127.0.0.1，如果你的master是单节点，请配置成单个apiserver:6443的ip即可 

 
 注：我做的3master+node,但是没做ha，这里要每台指定各自的ip 

 
 export KUBE_APISERVER="https://192.168.1.15:6443" 

  cd /root/kubernetes/server/bin/ssl/ 

  export KUBE_APISERVER="https://192.168.1.15:6443" 

  export BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ') 

  echo "Tokne: ${BOOTSTRAP_TOKEN}" 

  cat > token.csv <<EOF${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,"system:kubelet-bootstrap"EOF 

 
 注：会创建一个token.csv文件 

 
 echo "Create kubelet bootstrapping kubeconfig..." 

 
 将k8s-root-ca.pem，apiserver地址写入bootstrap.kubeconfig文件 

  kubectl config set-cluster kubernetes \ 

  --certificate-authority=k8s-root-ca.pem \ 

  --embed-certs=true \ 

  --server=${KUBE_APISERVER} \ 

  --kubeconfig=bootstrap.kubeconfig 

 
 注：会创建一个bootstrap.kubeconfig文件 

 
 bootstrap.kubeconfig文件内容 

 
 将token.csv文件内容写入bootstrap.kubeconfig文件 

  kubectl config set-credentials kubelet-bootstrap \ 

  --token=${BOOTSTRAP_TOKEN} \ 

  --kubeconfig=bootstrap.kubeconfig 

 
 bootstrap.kubeconfig文件内容 

 
 设置set-context环境项，kubelet-bootstrap用户 

  kubectl config set-context default \ --cluster=kubernetes \ --user=kubelet-bootstrap \ --kubeconfig=bootstrap.kubeconfig 

 
 bootstrap.kubeconfig文件内容 

 
 将set-context写入bootstrap.kubeconfig文件 

  kubectl config use-context default --kubeconfig=bootstrap.kubeconfig 

 
 bootstrap.kubeconfig文件内容 

 
 echo "Create kube-proxy kubeconfig..." 

 
 将k8s-root-ca.pem，apiserver地址写入kube-proxy.kubeconfig文件 

  kubectl config set-cluster kubernetes \ 

  --certificate-authority=k8s-root-ca.pem \ 

  --embed-certs=true \ 

  --server=${KUBE_APISERVER} \ 

  --kubeconfig=kube-proxy.kubeconfig 

 
 注：会创建一个kube-proxy.kubeconfig文件 

 
 kube-proxy.kubeconfig文件内容 

 
 将kube-proxy.pem写入kube-proxy.kubeconfig文件 

  kubectl config set-credentials kube-proxy \ 

  --client-certificate=kube-proxy.pem \ 

  --client-key=kube-proxy-key.pem \ 

  --embed-certs=true \ 

  --kubeconfig=kube-proxy.kubeconfig 

 
 kube-proxy.kubeconfig文件内容 

 
 设置set-context环境项，kube-proxy用户 

  kubectl config set-context default \ 

  --cluster=kubernetes \ 

  --user=kube-proxy \ 

  --kubeconfig=kube-proxy.kubeconfig 

 
 kube-proxy.kubeconfig文件内容 

 
 将set-context写入bootstrap.kubeconfig文件 

  kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig 

 
 kube-proxy.kubeconfig文件内容 

 
 生成高级审计配置 

  cat >> audit-policy.yaml <<EOF 

  # Log all requests at the Metadata level. 

  apiVersion: audit.k8s.io/v1beta1 

  kind: Policy 

  rules: 

  - level: Metadata 

EOF

 
 注：会生成一个audit-policy.yaml文件 

 
 生成集群管理员admin kubeconfig配置文件供kubectl调用 

 
 #admin set-cluster 

  kubectl config set-cluster kubernetes \ 

  --certificate-authority=k8s-root-ca.pem\ 

  --embed-certs=true \ 

  --server=${KUBE_APISERVER} \ 

  --kubeconfig=./kubeconfig 

 
 注：会生成一个kubeconfig文件 

 
 kubeconfig文件内容 

 
 #admin set-credentials 

  kubectl config set-credentials kubernetes-admin \ 

  --client-certificate=admin.pem \ 

  --client-key=admin-key.pem \ 

  --embed-certs=true \ 

  --kubeconfig=./kubeconfig 

 
 kubeconfig文件内容 

 
 #admin set-context 

  kubectl config set-context kubernetes-admin@kubernetes \ 

  --cluster=kubernetes \ 

  --user=kubernetes-admin \ 

  --kubeconfig=./kubeconfig 

 
 kubeconfig文件内容 

 
 #admin set default context 

  kubectl config use-context kubernetes-admin@kubernetes \ 

  --kubeconfig=./kubeconfig 

 
 kubeconfig文件内容 

 
 #创建ssl文件夹 

  for node in {k8s-master-1,k8s-master-2,k8s-master-3};do 

  ssh ${node} "mkdir -p /etc/kubernetes/ssl/ " 

  done 

 
 #下发证书文件 

  for ssl in {k8s-master-1,k8s-master-2,k8s-master-3};do 

  rsync -avzP /root/kubernetes/server/bin/ssl/ ${ssl}:/etc/kubernetes/ssl/ 

  done 

 
 注：下发后需要更改kubeconfig的apiserver地址 

 
 server:  
 https://192.168.1.15:6443 

 
 server:  
 https://192.168.1.16:6443 

 
 server: https://192.168.1.18:6443 

 
 #创建master /root/.kube 目录,复制超级admin授权config 

  for master in {k8s-master-1,k8s-master-2,k8s-master-3};do 

  ssh ${master} "mkdir -p /root/.kube ; \cp -f /etc/kubernetes/ssl/kubeconfig /root/.kube/config " 

  done 

 
 注：最后注意每台kubelet的配置文件需要更改kube-apiserver地址的有 

  /lib/systemd/system/kubelet.service 

  /root/.kube/config 

  /etc/kubernetes/ssl/bootstrap.kubeconfig 

  /etc/kubernetes/ssl/kubelet.kubeconfig 

  /etc/kubernetes/ssl/kube-proxy.kubeconfig 

K8S/Kubernetes

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐

【深度】阿里巴巴万级规模 K8s 集群全局高可用体系之美

作者 | 韩堂、柘远、沉醉来源 | 阿里巴巴云原生公众号前言台湾作家林清玄在接受记者采访的时候，如此评价自己 30 多年写作生涯：“第一个十年我才华横溢，‘贼光闪现’，令周边黯然失色；第二个十年，我终于‘宝光现形’，不再去抢风头，反而与身边的美丽相得益彰；进入第三个十年，繁华落尽见真醇，我进入了‘醇光初现’的阶段，真正体味到了境界之美”。长夜有穷，真水无香。领略过了 K8s“身在江

K8S/Kubernetes

如何基于 K8s 构建下一代 DevOps 平台？

作者 | 孙健波（天元）导读：当前云原生 DevOps 体系现状如何？面临哪些挑战？如何通过 OAM 解决云原生 DevOps 场景下的诸多问题？云原生开发应用模型 OAM(Open Application Model) 社区核心成员孙健波将为大家一一解答，并分享如何基于 OAM 和 Kubernetes 打造无限能力的下一代 DevOps 平台。什么是 DevOps？为什么基于 Kub