k8s-01一键生成k8s证书
2018-10-02 11:03
549 查看
下面直接写成脚本就行 放在/root/ssl下面直接执行就行 备注:此为master节点生成的证书都在/opt/kubernetes/ssl下面,如果node节点想用 直接scp过去 192.168.56.10 为master 192.168.56.11 node01 192.168.56.12 node02 hosts也可以只写master节点的ip地址 mkdir -p /opt/kubernetes/{cfg,bin,ssl} mkdir -p /root/ssl yum -y install wget cd /root/ssl/ wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64 \mv cfssl_linux-amd64 /opt/kubernetes/bin/cfssl \mv cfssljson_linux-amd64 /opt/kubernetes/bin/cfssljson \mv cfssl-certinfo_linux-amd64 /opt/kubernetes/bin/cfssl-certinfo echo "PATH=\$PATH:/opt/kubernetes/bin" >>/etc/profile source /etc/profile cfssl=/opt/kubernetes/bin/cfssl cfssl-certinfo=/opt/kubernetes/bin/cfssl-certinfo cfssljson=/opt/kubernetes/bin/cfssljson cat > ca-config.json <<EOF { "signing": { "default": { "expiry": "87600h" }, "profiles": { "kubernetes": { "expiry": "87600h", "usages": [ "signing", "key encipherment", "server auth", "client auth" ] } } } } EOF cat > ca-csr.json <<EOF { "CN": "kubernetes", "key": { "algo": "rsa", "size": 2048 }, "names 5b4 ": [ { "C": "CN", "L": "Beijing", "ST": "Beijing", "O": "k8s", "OU": "System" } ] } EOF cfssl gencert -initca ca-csr.json | cfssljson -bare ca - #----------------------- cat > server-csr.json <<EOF { "CN": "kubernetes", "hosts": [ "127.0.0.1", "192.168.56.10", "192.168.56.11", "192.168.56.12", "10.10.10.1", "kubernetes", "kubernetes.default", &nbs 5b4 p;"kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "k8s", "OU": "System" } ] } EOF cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server #----------------------- cat > admin-csr.json << 60dc EOF { "CN": "admin", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "system:masters", "OU": "System" } ] } EOF cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin #----------------------- cat > kube-proxy-csr.json <<EOF { "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "k8s", "OU": "System" } ] } EOF cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy rm -f /opt/kubernetes/ssl/*.pem ls -l|grep pem|awk '{print $9}'|xargs -i mv {} /opt/kubernetes/ssl/
[root@k8s-master ssl]# ll /opt/kubernetes/ssl/
total 32
-rw------- 1 root root 1679 Oct 2 10:57 admin-key.pem
-rw-r--r-- 1 root root 1399 Oct 2 10:57 admin.pem
-rw------- 1 root root 1675 Oct 2 10:57 ca-key.pem
-rw-r--r-- 1 root root 1359 Oct 2 10:57 ca.pem
-rw------- 1 root root 1675 Oct 2 10:57 kube-proxy-key.pem
-rw-r--r-- 1 root root 1403 Oct 2 10:57 kube-proxy.pem
-rw------- 1 root root 1675 Oct 2 10:57 server-key.pem
-rw-r--r-- 1 root root 1627 Oct 2 10:57 server.pem
[root@k8s-master ssl]#
[root@k8s-master ~]# ll /opt/kubernetes/bin/
total 18808
-rwxr-xr-x 1 root root 10376657 Mar 30 2016 cfssl
-rwxr-xr-x 1 root root 6595195 Mar 30 2016 cfssl-certinfo
-rwxr-xr-x 1 root root 2277873 Mar 30 2016 cfssljson
[root@k8s-master ~]#
相关文章推荐
- k8s-04-一键生成bootstrap.kubeconfig和kube-proxy.kubecon
- 内网一键生成 LetsEncrypt HTTPS证书 - 1
- [k8s]通过openssl生成证书
- 内网一键生成 LetsEncrypt HTTPS证书 - 2 - ngrok
- 内网一键生成 LetsEncrypt HTTPS证书 - 3 - 生成证书
- 01.fabric的swarm集群布署:fabric工具cryptogen修改证书生成信息
- Windows证书的生成导出以及使用证书验证文件是否被修改
- 给控件做数字签名之二:生成证书文件
- sslforfree 生成证书
- java生成数字证书方法
- java keytool 工具生成https 证书指令
- Java web 加密之keytool生成自己的证书
- 一键生成表结构说明文档的参考,数据字典生成方式参考
- Xcode 4.1~4.6 + iOS 5、iOS 6免证书(iDP)开发+真机调试+生成IPA全攻略
- openssl 生成证书 本人验证通过
- Linux下使用OpenSSL生成证书
- cas4.1证书生成,服务端搭建,注意事项
- Xcode 证书生成、设置、应用
- 修改FileZilla生成证书的有效期