1. 自签证书颁发机构（CA）

cd ~/TLS/k8s/

添加证书配置

cat > ca-config.json<< EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
     },
      "profiles": {
      "kubernetes": {
        "expiry": "87600h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ]
      }
    }
  }
}
EOF

ca-k8s证书文件

cat > ca-csr.json<< EOF
{
    "CN": "kubernetes",
    "key": {
      "algo": "rsa",
      "size": 2048
  },    
  "names": [
      {
        "C": "CN",
        "L": "Beijing",
        "ST": "Beijing",
        "O": "k8s",
        "OU": "System"
       }
   ]    
}

EOF

生成证书

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

返回

2020/12/10 10:30:39 [INFO] generating a new CA key and certificate from CSR
2020/12/10 10:30:39 [INFO] generate received request
2020/12/10 10:30:39 [INFO] received CSR
2020/12/10 10:30:39 [INFO] generating key: rsa-2048
2020/12/10 10:30:39 [INFO] encoded CSR
2020/12/10 10:30:39 [INFO] signed certificate with serial number 508765048193684533254237079649547252392799853230

 

2. 使用自签 CA 签发 kube-apiserver HTTPS 证书

添加api证书文件配置模板

#把你现有集群的主机ip写在下面
cat > server-csr.json<< EOF
{
    "CN": "kubernetes",
    "hosts": [
      "10.0.0.1",
      "127.0.0.1",
      "192.168.1.20",
      "192.168.1.21",
      "192.168.1.22",
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
],
"key": {
  "algo": "rsa",
  "size": 2048
},
"names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

基于模板生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

返回

2020/12/10 10:33:12 [INFO] generate received request
2020/12/10 10:33:12 [INFO] received CSR
2020/12/10 10:33:12 [INFO] generating key: rsa-2048
2020/12/10 10:33:12 [INFO] encoded CSR
2020/12/10 10:33:12 [INFO] signed certificate with serial number 632900405188531087137693603849237688048281011443
2020/12/10 10:33:12 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

3.查看证书文件

[root@k8s-master01 k8s]# ls server*.pem
server-key.pem  server.pem