kubeadm init 生成私钥与证书
1,自建CA,生成ca.crt 和cd,key
2,apiserver 的私钥与公钥证书
3,apiserver 访问Kubelet使用的客户端私钥与证书
4,sa.key 和sa.pub
5,etcd相关私钥和数字证书
路径:/etc/kubernete/pki
[root@k8s-master pki]# pwd
/etc/kubernetes/pki
[root@k8s-master pki]# ls
apiserver.crt apiserver.key ca.crt front-proxy-ca.crt front-proxy-client.key
apiserver-etcd-client.crt apiserver-kubelet-client.crt ca.key front-proxy-ca.key sa.key
apiserver-etcd-client.key apiserver-kubelet-client.key etcd front-proxy-client.crt sa.pub
kubeadm 自建ca.crt ca.key,签发集群需要的其他证书
ca.crt是标准的x509版本的证书,查看ca.crt
[root@k8s-master pki]# openssl x509 -in ca.crt -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=kuber