1. 下载并安装 CFSSL:
[[email protected] ~]# cd /usr/local/src [[email protected]-master src]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 [[email protected] src]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 [[email protected] src]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 [[email protected] src]# chmod +x cfssl* [[email protected]-master src]# mv cfssl-certinfo_linux-amd64 /opt/kubernetes/bin/cfssl-certinfo [[email protected]-master src]# mv cfssljson_linux-amd64 /opt/kubernetes/bin/cfssljson [[email protected]-master src]# mv cfssl_linux-amd64 /opt/kubernetes/bin/cfssl
复制cfssl命令文件到k8s-node1和k8s-node2节点。如果实际中多个节点，就都需要同步复制。
[[email protected] ~]# scp /opt/kubernetes/bin/cfssl* 10.200.3.106:/opt/kubernetes/bin [[email protected]-master ~]# scp /opt/kubernetes/bin/cfssl* 10.200.3.107:/opt/kubernetes/bin
设置环境变量
[[email protected] ~]#vim /etc/profile export PATH=/opt/kubernetes/bin/:$PATH [[email protected]-master ~]# source /etc/profile
2. 初始化cfssl,并创建临时证书目录:
[[email protected] src]# mkdir ssl && cd ssl [[email protected]-master ssl]# cfssl print-defaults config > config.json [[email protected]-master ssl]# cfssl print-defaults csr > csr.json
3. 创建用来生成 CA 文件的 JSON 配置文件
[[email protected] ssl]#cat > ca-config.json <<EOF { "signing": { "default": { "expiry": "8760h" }, "profiles": { "kubernetes": { "usages": [ "signing", "key encipherment", "server auth", "client auth" ], "expiry": "8760h" } } } } EOF
4. 创建用来生成 CA 证书签名请求（CSR）的 JSON 配置文件
[[email protected] ssl]# cat > ca-csr.json <<EOF { "CN": "kubernetes", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ] } EOF
5. 生成CA证书（ca.pem）和密钥（ca-key.pem）
[[email protected] ssl]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca [[email protected] ssl]# ls -l ca* -rw-r--r-- 1 root root 290 Mar 4 13:45 ca-config.json -rw-r--r-- 1 root root 1001 Mar 4 14:09 ca.csr -rw-r--r-- 1 root root 208 Mar 4 13:51 ca-csr.json -rw------- 1 root root 1679 Mar 4 14:09 ca-key.pem -rw-r--r-- 1 root root 1359 Mar 4 14:09 ca.pem
6.分发证书
[[email protected] ssl]# cp ca.csr ca.pem ca-key.pem ca-config.json /opt/kubernetes/ssl SCP证书到k8s-node1和k8s-node2节点 [[email protected]-master ssl]# scp ca.csr ca.pem ca-key.pem ca-config.json 10.200.3.106:/opt/kubernetes/ssl [[email protected]-master ssl]# scp ca.csr ca.pem ca-key.pem ca-config.json 10.200.3.107:/opt/kubernetes/ssl
原创文章，作者：奋斗，如若转载，请注明出处：https://blog.ytso.com/6899.html