kubernetes部署秘钥配置

curl -s -L -o /bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
curl -s -L -o /bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
curl -s -L -o /bin/cfssl-certinfo https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x /bin/cfssl*

cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
 -ca-key=/opt/kubernetes/ssl/ca-key.pem \
 -config=/opt/k8s_ssl/ca/ca-config.json \
 -profile=kubernetes admin-csr.json | cfssljson -bare admin

kubectl config set-cluster kubernetes --certificate-authority=/opt/kubernetes/ssl/ca.pem --server=https://192.168.50.30:6443
kubectl config set-credentials admin --client-certificate=/opt/kubernetes/ssl/admin.pem --client-key=/opt/kubernetes/ssl/admin-key.pem
kubectl config set-context kubernetes --cluster=kubernetes --user=admin
kubectl config use-context kubernetes

1、cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

2、etcd、kube-apiserver
cfssl gencert -ca=../ca/ca.pem -ca-key=../ca/ca-key.pem -config=../ca/ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

3、kube-controller-manager
cfssl gencert -ca=/opt/k8s_ssl/ca/ca.pem \
-ca-key=/opt/k8s_ssl/ca/ca-key.pem \
-config=/opt/k8s_ssl/ca/ca-config.json \
-profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

kubectl config set-cluster kubernetes \
--certificate-authority=/opt/kubernetes/ssl/ca.pem \
--server=https://192.168.50.30:6443 \
--kubeconfig=/opt/kubernetes/cfg/kube-controller-manager.kubeconfig

kubectl config set-credentials system:kube-controller-manager \
--client-certificate=/opt/kubernetes/ssl/kube-controller-manager.pem \
--client-key=/opt/kubernetes/ssl/kube-controller-manager-key.pem \
--kubeconfig=/opt/kubernetes/cfg/kube-controller-manager.kubeconfig

kubectl config set-context system:kube-controller-manager@kubernetes \
--cluster=kubernetes \
--user=system:kube-controller-manager \
--kubeconfig=/opt/kubernetes/cfg/kube-controller-manager.kubeconfig

kubectl config use-context system:kube-controller-manager@kubernetes --kubeconfig=/opt/kubernetes/cfg/kube-controller-manager.kubeconfig

4、kube-scheduler
cfssl gencert -ca=/opt/k8s_ssl/ca/ca.pem \
-ca-key=/opt/k8s_ssl/ca/ca-key.pem \
-config=/opt/k8s_ssl/ca/ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

kubectl config set-cluster kubernetes \
--certificate-authority=/opt/kubernetes/ssl/ca.pem \
--server=https://192.168.50.30:6443 \
--kubeconfig=/opt/kubernetes/cfg/kube-scheduler.kubeconfig

kubectl config set-credentials system:kube-scheduler \
--client-certificate=/opt/kubernetes/ssl/kube-scheduler.pem \
--client-key=/opt/kubernetes/ssl/kube-scheduler-key.pem \
--kubeconfig=/opt/kubernetes/cfg/kube-scheduler.kubeconfig

kubectl config set-context system:kube-scheduler@kubernetes \
--cluster=kubernetes \
--user=system:kube-scheduler \
--kubeconfig=/opt/kubernetes/cfg/kube-scheduler.kubeconfig

kubectl config use-context system:kube-scheduler@kubernetes --kubeconfig=/opt/kubernetes/cfg/kube-scheduler.kubeconfig

5、kubelet
/opt/kubernetes/bin/kubectl create clusterrolebinding kubelet-bootstrap \
--clusterrole=system:node-bootstrapper \
--user=kubelet-bootstrap

export KUBE_APISERVER="https://192.168.50.30:6443"
export BOOTSTRAP_TOKEN=674c457d4dcf2eefe4920d7dbb6b0ddc

/opt/kubernetes/bin/kubectl config set-cluster kubernetes \
--certificate-authority=/opt/kubernetes/ssl/ca.pem \
--server=${KUBE_APISERVER} \
--kubeconfig=kubelet-bootstrap.kubeconfig

/opt/kubernetes/bin/kubectl config set-credentials kubelet-bootstrap \
--token=${BOOTSTRAP_TOKEN} \
--kubeconfig=kubelet-bootstrap.kubeconfig

/opt/kubernetes/bin/kubectl config set-context default \
--cluster=kubernetes \
--user=kubelet-bootstrap \
--kubeconfig=kubelet-bootstrap.kubeconfig

/opt/kubernetes/bin/kubectl config use-context default --kubeconfig=kubelet-bootstrap.kubeconfig

kubectl get csr
kubectl certificate approve node-csr-vRVNCJT48G9I8g2k9A7vVDkCj1cmFpdrxXQnCLhrwe0

6、kube-proxy
cfssl gencert -ca=/opt/k8s_ssl/ca/ca.pem \
-ca-key=/opt/k8s_ssl/ca/ca-key.pem \
-config=/opt/k8s_ssl/ca/ca-config.json \
-profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

kubectl config set-cluster kubernetes \
--certificate-authority=/opt/kubernetes/ssl/ca.pem \
--server=https://192.168.50.30:6443 \
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig

kubectl config set-credentials kube-proxy \
--client-certificate=/opt/kubernetes/ssl/kube-proxy.pem \
--client-key=/opt/kubernetes/ssl/kube-proxy-key.pem \
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig

kubectl config set-context kube-proxy@kubernetes \
--cluster=kubernetes \
--user=kube-proxy \
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig

kubectl config use-context kube-proxy@kubernetes --kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig