kubernetes-dashboard自定义证书，解决一些浏览器无法访问dashboard问题

创建自签名CA

[root@docker9-230 ~]# mkdir /ssl && cd /ssl
[root@docker9-230 ssl]# openssl genrsa -out ca.key 2048
[root@docker9-230 ssl]# openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=CA" 
[root@docker9-230 ssl]# openssl x509 -in ca.crt -noout -text

签发Dashboard证书

[root@docker9-230 ssl]# openssl genrsa -out dashboard.key 2048
[root@docker9-230 ssl]# openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=192.168.9.230"
[root@docker9-230 ssl]# vi dashboard.cnf
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:192.168.9.230,DNS:localhost
[root@docker9-230 ssl]# openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf
[root@docker9-230 ssl]# openssl x509 -in dashboard.crt -noout -text

挂载证书到kubernetes-dashboard

[root@docker9-230 ssl]# kubectl delete -f kubernetes-dashboard.yaml
[root@docker9-230 ssl]# kubectl create namespace kubernetes-dashboard
[root@docker9-230 ssl]# kubectl create secret generic kubernetes-dashboard-certs --from-file="./dashboard.crt,./dashboard.key" -n kubernetes-dashboard
[root@docker9-230 ssl]# kubectl apply -f /root/recommended.yaml

此时谷歌浏览器已经可以加例外了

参考资料https://github.com/kubernetes/dashboard/wiki/Certificate-management#public-trusted-certificate-authority