kubernetes 证书制作工具

最新推荐文章于 2024-05-26 12:43:54 发布

qinzhao168

最新推荐文章于 2024-05-26 12:43:54 发布

阅读量1k

点赞数

分类专栏： kubetnetes 文章标签： kubernetes 证书

本文链接：https://blog.csdn.net/qq_21816375/article/details/80028662

版权

kubetnetes 专栏收录该内容

106 篇文章 8 订阅

订阅专栏

Creating Certificates
本文介绍三种制作证书的工具，分别是easyrsa, openssl or cfssl

easyrsa
下载并解压easyrsa

curl -LO https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
tar xzf easy-rsa.tar.gz
cd easy-rsa-master/easyrsa3
./easyrsa init-pki

[root@kubernetes-build easyrsa3]# ls -l pki/
总用量 0
drwx------. 2 root root 6 4月  21 13:50 private
drwx------. 2 root root 6 4月  21 13:50 reqs

生成证书 (–batch //设置自动模式. –req-cn 默认使用CN.)

./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass

root@kubernetes-build pki]# ls -l
总用量 8
-rw-------. 1 root root 1172 4月  21 13:51 ca.crt
drwx------. 2 root root    6 4月  21 13:51 certs_by_serial
-rw-------. 1 root root    0 4月  21 13:51 index.txt
drwx------. 2 root root    6 4月  21 13:51 issued
drwx------. 2 root root   20 4月  21 13:51 private
drwx------. 2 root root    6 4月  21 13:50 reqs
-rw-------. 1 root root    3 4月  21 13:51 serial

生成服务器证书和密钥。

参数--subject-alt-name设置API服务器将访问的可能的IP和DNS名称。 MASTER_CLUSTER_IP通常是来自服务CIDR的第一个IP，它被指定为API服务器和控制器管理器组件的--service-cluster-ip-range参数。参数 --days用于设置证书过期的天数。下面的示例还假定您使用cluster.local作为默认的DNS域名。

./easyrsa --subject-alt-name="IP:192.168.1.43,"\
"IP:192.168.1.43,"\
"DNS:kubernetes,"\
"DNS:kubernetes.default,"\
"DNS:kubernetes.default.svc,"\
"DNS:kubernetes.default.svc.cluster,"\
"DNS:kubernetes.default.svc.cluster.local" \
--days=10000 \
build-server-full server nopass

[root@kubernetes-build pki]# ls -l private/
总用量 8
-rw-------. 1 root root 1704 4月  21 13:51 ca.key
-rw-------. 1 root root 1704 4月  21 13:59 server.key
[root@kubernetes-build pki]# ls -l reqs/
总用量 4
-rw-------. 1 root root 1123 4月  21 13:59 server.req

复制 pki/ca.crt, pki/issued/server.crt, and pki/private/server.key 指定存放证书目录

然后通过api-server的启动参数使用证书

--client-ca-file=/yourdirectory/ca.crt
--tls-cert-file=/yourdirectory/server.crt
--tls-private-key-file=/yourdirectory/server.key

openssl
生成2048字节的ca.key

[root@kubernetes-build openssl]# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
....+++
..............+++
e is 65537 (0x10001)
[root@kubernetes-build openssl]# ls -l
总用量 4
-rw-r--r--. 1 root root 1679 4月  21 14:05 ca.key

使用ca.key生成ca.crt

[root@kubernetes-build openssl]# openssl req -x509 -new -nodes -key ca.key -subj "/CN=192.168.1.43" -days 10000 -out ca.crt
[root@kubernetes-build openssl]# ls -l
总用量 8
-rw-r--r--. 1 root root 1103 4月  21 14:06 ca.crt
-rw-r--r--. 1 root root 1679 4月  21 14:05 ca.key

生成服务server.key

[root@kubernetes-build openssl]# openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
.................................................................+++
..............................................+++
e is 65537 (0x10001)
[root@kubernetes-build openssl]# ls -l
总用量 12
-rw-r--r--. 1 root root 1103 4月  21 14:06 ca.crt
-rw-r--r--. 1 root root 1679 4月  21 14:05 ca.key
-rw-r--r--. 1 root root 1679 4月  21 14:07 server.key

创建一个用于生成证书签名请求（CSR）的配置文件。在将其保存到文件csr.conf,使用cluster.local作为默认的DNS域名。

[root@kubernetes-build openssl]# cat scr.conf 
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C = CH
ST = Beijing
L = Beijing
O = xinao
OU = xinao
CN = 192.168.1.43

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster
DNS.5 = kubernetes.default.svc.cluster.local
IP.1 = 192.168.1.43
IP.2 = 192.168.1.43

[ v3_ext ]
authorityKeyIdentifier=keyid,issuer:always
basicConstraints=CA:FALSE
keyUsage=keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=@alt_names

根据scr.conf文件创建证书

[root@kubernetes-build openssl]# openssl req -new -key server.key -out server.csr -config scr.conf 
[root@kubernetes-build openssl]# ls -l
总用量 20
-rw-r--r--. 1 root root 1103 4月  21 14:06 ca.crt
-rw-r--r--. 1 root root 1679 4月  21 14:05 ca.key
-rw-r--r--. 1 root root  649 4月  21 14:20 scr.conf
-rw-r--r--. 1 root root 1240 4月  21 14:20 server.csr
-rw-r--r--. 1 root root 1679 4月  21 14:07 server.key

如出现以下错误

[root@kubernetes-build openssl]# openssl req -new -key server.key -out server.csr -config scr.conf 
problems making Certificate Request
140274975688608:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:158:maxsize=2

就把国家修改只由两个字符

根据文件ca.key, ca.crt and server.csr生成服务证书

[root@kubernetes-build openssl]# openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000 -extensions v3_ext -extfile scr.conf
Signature ok
subject=/C=CH/ST=Beijing/L=Beijing/O=xinao/OU=xinao/CN=192.168.1.43
Getting CA Private Key

查看证书

[root@kubernetes-build openssl]# openssl x509  -noout -text -in ./server.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            92:91:0d:2b:62:56:2a:71
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=192.168.1.43
        Validity
            Not Before: Apr 21 06:24:12 2018 GMT
            Not After : Sep  6 06:24:12 2045 GMT
        Subject: C=CH, ST=Beijing, L=Beijing, O=xinao, OU=xinao, CN=192.168.1.43
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ae:e1:5a:d6:4c:b9:76:eb:c9:0d:95:31:97:59:
                    8f:18:72:2d:6d:3b:8f:b1:d5:8f:54:79:50:09:06:
                    02:ec:65:aa:8c:5d:03:19:3c:3a:88:11:12:4c:b5:
                    e3:d2:93:d1:85:0d:0a:9b:a4:a9:7c:7a:8a:58:8d:
                    d9:1d:41:85:01:f6:98:a2:22:40:ce:bb:f7:9e:d4:
                    1f:d0:47:57:95:05:da:d7:3f:4f:f8:23:d0:b6:eb:
                    2b:64:bf:b9:53:28:94:81:fe:e3:fc:c4:00:89:6a:
                    ce:72:1b:43:ea:10:44:6d:e8:6b:b1:6f:dc:cc:7c:
                    ab:bf:7a:30:f7:70:e4:0e:3a:2d:16:fa:b0:0f:b8:
                    e2:96:4c:82:68:c4:82:3b:d9:ef:77:18:72:08:d9:
                    12:7b:82:4b:39:f3:91:37:01:34:b4:fa:d5:28:48:
                    d6:43:72:e3:c9:4b:5c:c3:a6:66:aa:06:4b:31:74:
                    d6:8b:86:1a:1b:3a:c9:e0:49:a9:c8:d5:b4:31:d8:
                    72:c4:8c:02:56:af:e3:02:8b:4d:2a:2b:d2:b7:17:
                    63:1d:3d:75:6c:53:6d:f7:fd:02:ee:d8:b9:d4:58:
                    31:5b:9e:96:85:5e:41:9a:9d:ed:d1:a9:02:f4:18:
                    36:98:79:dc:db:3a:87:b5:90:07:ce:00:89:61:9b:
                    d6:2f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:C9:BB:16:09:DD:5F:EC:5A:B4:BF:1A:E1:4D:79:62:67:3A:45:84:DF
                DirName:/CN=192.168.1.43
                serial:E9:0B:50:52:AC:6F:3D:3A

            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Key Encipherment, Data Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Alternative Name: 
                DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster, DNS:kubernetes.default.svc.cluster.local, IP Address:192.168.1.43, IP Address:192.168.1.43
    Signature Algorithm: sha256WithRSAEncryption
         26:f7:3a:82:be:92:a3:c3:ca:16:6a:9f:c9:5c:2a:e7:24:f3:
         fa:a4:e9:d9:bd:59:40:bb:4a:a2:27:4b:1b:11:52:72:b9:39:
         d3:8d:8e:58:18:7c:7a:11:94:fe:4b:0c:e3:e1:b9:dd:3b:b1:
         31:85:3c:cf:a2:b9:21:fb:d2:7a:9e:2d:8e:75:62:8b:b1:e4:
         3f:e5:f3:ca:6e:b1:ed:98:ff:7b:9f:60:cf:d1:76:f3:ab:e4:
         0c:4a:79:12:86:cf:c9:f0:a8:3a:ff:d8:04:73:01:2d:d4:c2:
         28:33:5f:76:cd:b0:52:21:d0:d2:6f:a5:98:22:af:10:79:71:
         de:bc:30:cd:2a:e7:a4:89:a3:8f:60:eb:80:30:8f:93:cd:71:
         15:4a:b4:3e:be:ad:64:40:bd:4d:65:37:54:0b:58:33:b4:10:
         63:a9:47:27:bf:bc:27:a2:8f:1b:d4:eb:8f:94:aa:79:20:93:
         aa:1b:c7:5e:19:52:f5:6a:fc:f9:de:9c:f6:6e:2b:0f:92:11:
         71:c1:eb:58:89:cb:db:03:ea:36:b9:7d:f7:3c:6d:ac:e3:f4:
         80:65:25:b2:1b:3a:de:20:a4:a3:da:60:5c:2e:97:cf:46:3b:
         85:22:a7:d7:a8:62:be:79:c8:ed:91:36:89:92:33:54:44:f9:
         7b:ce:73:d4

然后通过api-server的启动参数使用证书

--client-ca-file=/yourdirectory/ca.crt
--tls-cert-file=/yourdirectory/server.crt
--tls-private-key-file=/yourdirectory/server.key

cfssl
下载解压cfssl

curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o cfssl
chmod +x cfssl
curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o cfssljson
chmod +x cfssljson
curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o cfssl-certinfo
chmod +x cfssl-certinfo

[root@kubernetes-build cfssl]# ls -l
总用量 18808
-rwxr-xr-x. 1 root root 10376657 4月  21 14:31 cfssl
-rwxr-xr-x. 1 root root  6595195 4月  21 14:34 cfssl-certinfo
-rwxr-xr-x. 1 root root  2277873 4月  21 14:32 cfssljson

初始化cfssl

mkdir cert
cd cert
../cfssl print-defaults config > config.json
../cfssl print-defaults csr > csr.json

创建ca的配置文件

vi ca-config.json

{
  "signing": {
    "default": {
      "expiry": "8760h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ],
        "expiry": "8760h"
      }
    }
  }
}

创建ca-csr.json文件

{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names":[{
    "C": "CH",
    "ST": "Beijing",
    "L": "Beijing",
    "O": "xinao",
    "OU": "xinao"
  }]
}

生成ca-key.pem ca.pem证书文件

../cfssl gencert -initca ca-csr.json | ../cfssljson -bare ca

-rw-------. 1 root root 1675 4月  21 14:38 ca-key.pem
-rw-r--r--. 1 root root 1363 4月  21 14:38 ca.pem

创建服务证书的配置文件server-csr.json

vi server-csr.json
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "192.168.1.43",
    "192.168.1.144",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CH",
    "ST": "Beijing",
    "L": "Beijing",
    "O": "xiaoao",
    "OU": "xinao"
  }]
}

生成服务证书

[root@kubernetes-build cert]# ../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem --config=ca-config.json -profile=kubernetes server-csr.json | ../cfssljson -bare server
2018/04/21 14:51:23 [INFO] generate received request
2018/04/21 14:51:23 [INFO] received CSR
2018/04/21 14:51:23 [INFO] generating key: rsa-2048
2018/04/21 14:51:23 [INFO] encoded CSR
2018/04/21 14:51:23 [INFO] signed certificate with serial number 713854579205162235239808671777172304454503834002
2018/04/21 14:51:23 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").



-rw-------. 1 root root 1679 4月  21 14:51 server-key.pem
-rw-r--r--. 1 root root 1614 4月  21 14:51 server.pem

然后通过api-server的启动参数使用证书

--client-ca-file=/yourdirectory/ca.crt
--tls-cert-file=/yourdirectory/server.crt
--tls-private-key-file=/yourdirectory/server.key

参考:
certificates

qinzhao168

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
kubernetes 证书制作工具

Creating Certificates 本文介绍三种制作证书的工具，分别是easyrsa, openssl or cfssleasyrsa 下载并解压easyrsacurl -LO https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gztar xzf easy-rsa.tar.gz...
复制链接

扫一扫

专栏目录