etcd单节点安装;
1, 生成 TLS 秘钥对
生成步骤:
1,下载 cfssl
2,初始化证书颁发机构
3,配置 CA 选项
4,生成服务器端证书
5,生成对等证书
6,生成客户端证书
1,下载 cfssl
mkdir ~/bin
curl -s -L -o ~/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
curl -s -L -o ~/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x ~/bin/{cfssl,cfssljson}
export PATH=$PATH:~/bin
2,初始化证书颁发机构
mkdir ~/cfssl
cd ~/cfssl
cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json
证书类型介绍:
client certificate 用于通过服务器验证客户端。例如etcdctl,etcd proxy,fleetctl或docker客户端。
server certificate 由服务器使用,并由客户端验证服务器身份。例如docker服务器或kube-apiserver。
peer certificate 由 etcd 集群成员使用,供它们彼此之间通信使用。
3,配置 CA 选项
$ cat << EOF > ca-config.json
{
"expiry": "175200h",
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"server": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
},
"client": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"client auth"
]
},
"peer": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
cat << EOF > ca-csr.json
{
"CN": "k8s root CA",
"ca": {
"expiry": "175200h"