二进制安装k8s - 03. 生成所有服务的kubeconfig文件

---

---

准备 kubectl 使用的admin证书签名请求

创建配置文件

[root@master cert]# pwd
/data/k8s/cert
[root@master cert]# vim admin-csr.json

{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "system:masters",
      "OU": "Lswzw"
    }
  ]
}

注：
① signing ：表示该证书可用于签名其它证书，生成的 ca.pem 证书中CA=TRUE ；
② server auth ：表示 client 可以用该该证书对 server 提供的证书进行验证；
③ client auth ：表示 server 可以用该该证书对 client 提供的证书进行验证；

创建admin证书与私钥

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes admin-csr.json | cfssljson -bare admin

设置集群参数

kubectl config set-cluster kubernetes \
  --certificate-authority=ca.pem \
  --embed-certs=true \
  --server={{ KUBE_APISERVER }} \
  --kubeconfig=/data/k8s/conf/kubectl.kubeconfig

我这里的{{ KUBE_APISERVER }} 为 https://192.168.100.59:6443

设置客户端认证参数

kubectl config set-credentials admin \
  --client-certificate=admin.pem \
  --client-key=admin-key.pem \
  --embed-certs=true \
  --kubeconfig=/data/k8s/conf/kubectl.kubeconfig

设置上下文参数

kubectl config set-context /data/k8s/conf/kubectl.kubeconfig \
  --cluster=kubernetes --user=admin

选择默认上下文

kubectl config use-context /data/k8s/conf/kubectl.kubeconfig

---

---

---

---

准备 kube-proxy 证书签名请求

创建配置文件

[root@master cert]# pwd
/data/k8s/cert
[root@master cert]# vim kube-proxy-csr.json

{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "k8s",
      "OU": "Lswzw"
    }
  ]
}

注：
① signing ：表示该证书可用于签名其它证书，生成的 ca.pem 证书中CA=TRUE ；
② server auth ：表示 client 可以用该该证书对 server 提供的证书进行验证；
③ client auth ：表示 server 可以用该该证书对 client 提供的证书进行验证；

创建 kube-proxy证书与私钥

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

设置集群参数

kubectl config set-cluster kubernetes \
  --certificate-authority=ca.pem \
  --embed-certs=true \
  --server={{ KUBE_APISERVER }} \
  --kubeconfig=/data/k8s/conf/kube-proxy.kubeconfig

我这里的{{ KUBE_APISERVER }} 为 https://192.168.100.59:6443

设置客户端认证参数

kubectl config set-credentials kube-proxy \
  --client-certificate=kube-proxy.pem \
  --client-key=kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=/data/k8s/conf/kube-proxy.kubeconfig

设置上下文参数

kubectl config set-context default \
  --cluster=kubernetes \
  --user=kube-proxy \
  --kubeconfig=/data/k8s/conf/kube-proxy.kubeconfig

选择默认上下文

kubectl config use-context default \
  --kubeconfig=/data/k8s/conf/kube-proxy.kubeconfig

---

---

---

---

准备 kube-controller-manager 证书签名请求

创建配置文件

[root@master cert]# pwd
/data/k8s/cert
[root@master cert]# vim kube-controller-manager-csr.json

{
  "CN": "system:kube-controller-manager",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "system:kube-controller-manager",
      "OU": "Lswzw"
    }
  ]
}

注：
① signing ：表示该证书可用于签名其它证书，生成的 ca.pem 证书中CA=TRUE ；
② server auth ：表示 client 可以用该该证书对 server 提供的证书进行验证；
③ client auth ：表示 server 可以用该该证书对 client 提供的证书进行验证；

创建 kube-controller-manager 证书与私钥

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

设置集群参数

kubectl config set-cluster kubernetes \
  --certificate-authority=ca.pem \
  --embed-certs=true \
  --server={{ KUBE_APISERVER }} \
  --kubeconfig=/data/k8s/conf/kube-controller-manager.kubeconfig

我这里的{{ KUBE_APISERVER }} 为 https://192.168.100.59:6443

设置客户端认证参数

kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=kube-controller-manager.pem \
  --client-key=kube-controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=/data/k8s/conf/kube-controller-manager.kubeconfig

设置上下文参数

kubectl config set-context default \
  --cluster=kubernetes \
  --user=system:kube-controller-manager \
  --kubeconfig=/data/k8s/conf/kube-controller-manager.kubeconfig

选择默认上下文

kubectl config use-context default \
  --kubeconfig=/data/k8s/conf/kube-controller-manager.kubeconfig

---

---

---

---

准备 kube-scheduler 证书签名请求

创建配置文件

[root@master cert]# pwd
/data/k8s/cert
[root@master cert]# vim kube-scheduler-csr.json

{
  "CN": "system:kube-scheduler",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "HangZhou",
      "L": "XS",
      "O": "system:kube-scheduler",
      "OU": "System"
    }
  ]
}

注：
① signing ：表示该证书可用于签名其它证书，生成的 ca.pem 证书中CA=TRUE ；
② server auth ：表示 client 可以用该该证书对 server 提供的证书进行验证；
③ client auth ：表示 server 可以用该该证书对 client 提供的证书进行验证；

创建 kube-scheduler 证书与私钥

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes kube-scheduler-csr.json  | cfssljson -bare kube-scheduler

设置集群参数

kubectl config set-cluster kubernetes \
  --certificate-authority=ca.pem \
  --embed-certs=true \
  --server={{ KUBE_APISERVER }} \
  --kubeconfig=/data/k8s/conf/kube-scheduler.kubeconfig

我这里的{{ KUBE_APISERVER }} 为 https://192.168.100.59:6443

设置客户端认证参数

kubectl config set-credentials system:kube-scheduler \
  --client-certificate=kube-scheduler.pem \
  --client-key=kube-scheduler-key.pem \
  --embed-certs=true \
  --kubeconfig=/data/k8s/conf/kube-scheduler.kubeconfig

设置上下文参数

kubectl config set-context default \
  --cluster=kubernetes \
  --user=system:kube-scheduler \
  --kubeconfig=/data/k8s/conf/kube-scheduler.kubeconfig

选择默认上下文

kubectl config use-context default \
  --kubeconfig=/data/k8s/conf/kube-scheduler.kubeconfig

---

---

---

---

最后目录结构

[root@master k8s]# tree 
.
├── bin
│   ├── bridge
│   ├── cfssl
│   ├── cfssl-certinfo
│   ├── cfssljson
│   ├── containerd
│   ├── containerd-shim
│   ├── ctr
│   ├── docker
│   ├── dockerd
│   ├── docker-init
│   ├── docker-proxy
│   ├── etcd
│   ├── etcdctl
│   ├── kubeadm
│   ├── kube-apiserver
│   ├── kube-controller-manager
│   ├── kubectl
│   ├── kubelet
│   ├── kube-proxy
│   ├── kube-scheduler
│   └── runc
├── cert
│   ├── admin.csr
│   ├── admin-csr.json
│   ├── admin-key.pem
│   ├── admin.pem
│   ├── ca-config.json
│   ├── ca.csr
│   ├── ca-csr.json
│   ├── ca-key.pem
│   ├── ca.pem
│   ├── kube-controller-manager.csr
│   ├── kube-controller-manager-csr.json
│   ├── kube-controller-manager-key.pem
│   ├── kube-controller-manager.pem
│   ├── kube-proxy.csr
│   ├── kube-proxy-csr.json
│   ├── kube-proxy-key.pem
│   ├── kube-proxy.pem
│   ├── kube-scheduler.csr
│   ├── kube-scheduler-csr.json
│   ├── kube-scheduler-key.pem
│   └── kube-scheduler.pem
└── conf
    ├── kube-controller-manager.kubeconfig
    ├── kubectl.kubeconfig
    ├── kube-proxy.kubeconfig
    └── kube-scheduler.kubeconfig