参考https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md
可以在任意一台机器上生成证书,之后再复制到各个节点即可。我图方便,直接在master上生成。
以下操作基于文章《配置virtualbox虚拟机》中配置的集群,理论上也适用于其他机器,但建议你也配置一个同样的集群以便先跟上。
安装cfssl
wget http://hw.files.jiankangyouyi.com/cfssl_linux-amd64 -O /usr/local/bin/cfssl
wget http://hw.files.jiankangyouyi.com/cfssl-certinfo_linux-amd64 -O /usr/local/bin/cfssl-certinfo
wget http://hw.files.jiankangyouyi.com/cfssljson_linux-amd64 -O /usr/local/bin/cfssljson
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo
生成ca证书、私钥、配置文件
{
cat > ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"kubernetes": {
"usages": ["signing", "key encipherment", "server auth", "client auth"],
"expiry": "8760h"
}
}
}
}
EOF
cat > ca-csr.json <<EOF
{
"CN": "Kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "US",
"L": "Portland",
"O": "Kubernetes",
"OU":