kubernetes 集群部署 自签 TLS 证书

kubernetes 集群之间的通信需要加密，可以使用自签 TLS 证书。具体证书如下：

1. 下载3个工具

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

2. 增加执行权限

chmod +x cf*

3.  放到 /usr/local/bin 目录，并重命名。

cp cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfocp cfssljson_linux-amd64 /usr/local/bin/cfssljsoncp cfssl_linux-amd64 /usr/local/bin/cfssl

4. 用下面的命令，可以导出默认配置

cfssl print-defaults config > config.json
cfssl print-defaults csr > csr.json

5. 创建一个文件 certification.sh，用于生成 kubernetes 中用到的自签证书。内容如下：

#!/bin/bash
cat > ca-config.json <<EOF
{
  "signing": {
    "default":{
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
        "expiry": "87600h",
        "usages": [
           "signing",
           "key encipherment",
           "server auth",
           "client auth"
         ]
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

#-------------------

cat > server-csr.json <<EOF
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "192.168.137.81",
    "192.168.137.82",
    "192.168.137.83","kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

#----------------
cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing",
      "O": "System:masters",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

#---------
cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

6. 给 certification.sh 增加执行权限后，运行这个脚本，会生成很多文件，其中 *-key.pem 文件是私钥文件，其它以 pem 结尾的文件是公钥文件。

原文地址：https://www.cnblogs.com/langfanyun/p/10499462.html