ubuntu 16.04 kubernetes1.6安装（一k8s证书）

原创

无湖 2017-12-08 10:34:05 ©著作权

©著作权归作者所有：来自51CTO博客作者无湖的原创作品，请联系作者获取转载授权，否则将追究法律责任

一、环境说明 1、本环境使用系统版本ubuntu16.04 2、环境服务器ip 192.168.15.132 192.168.15.133 192.168.15.134 3、k8s的service ip子网为：10.254.0.0/16 dns的service ip设定为10.254.0.2 docker网络ip为10.253.0.0.0/16 4、本环境参照一步步安装k8s 5、k8s版本1.6.4

二、证书制作注意：证书配置错误会导致后面很多验证错误，请自行注意，如果后续过程报证书错误，自行返回更新证书，再重启api control 等所有受错误证书影响的组件生成的 CA 证书和秘钥文件如下： ca-key.pem ca.pem kubernetes-key.pem kubernetes.pem kube-proxy.pem kube-proxy-key.pem admin.pem admin-key.pem

使用证书的组件如下： etcd：使用 ca.pem、kubernetes-key.pem、kubernetes.pem； kube-apiserver：使用 ca.pem、kubernetes-key.pem、kubernetes.pem； kubelet：使用 ca.pem； kube-proxy：使用 ca.pem、kube-proxy-key.pem、kube-proxy.pem； kubectl：使用 ca.pem、admin-key.pem、admin.pem；

1、下载cfssl工具 wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 chmod +x cfssl_linux-amd64 mv cfssl_linux-amd64 /usr/local/bin/cfssl wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 chmod +x cfssljson_linux-amd64 mv cfssljson_linux-amd64 /usr/local/bin/cfssljson wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 chmod +x cfssl-certinfo_linux-amd64 mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo

2、创建CA mkdir /root/ssl cd /root/ssl cfssl print-defaults config > config.json cfssl print-defaults csr > csr.json 根据模板文件创建ca证书 root@ubuntu132:~/ssl# cat ca-config.json { "signing": { "default": { "expiry": "87600h" }, "profiles": { "kubernetes": { "usages": [ "signing", "key encipherment", "server auth" , "client auth" ], "expiry": "87600h" } } } } root@ubuntu132:~/ssl# cat ca-csr.json { "CN": "kubernetes", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "sichuan", "ST": "chengdu", "O": "K8S", "OU": "System" } ] } 生成ca证书和私钥 cfssl gencert -initca ca-csr.json | cfssljson -bare ca root@ubuntu132:~/ssl# ls ca* ca-config.json ca.csr ca-csr.json ca-key.pem ca.pem

3、创建kubernetes证书 root@ubuntu132:~/ssl# cat kubernetes-csr.json { "CN": "kubernetes", "hosts": [ "127.0.0.1", "192.168.15.132", "192.168.15.133", "192.168.15.134", "127.0.0.1", "10.254.0.1", #为k8s的service第一个ip，不能缺少 "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "sichuan", "ST": "chengdu", "O": "K8S", "OU": "System" } ] }

root# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes root@ubuntu132:~/ssl# ls kubernetes* kubernetes.csr kubernetes-csr.json kubernetes-key.pem kubernetes.pem

3、生成admin证书 root@ubuntu132:~/ssl# cat admin-csr.json { "CN": "admin", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "sichuan", "ST": "chengdu", "O": "system:masters", "OU": "System" } ] }

root# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin root@ubuntu132:~/ssl# ls admin* admin.csr admin-csr.json admin-key.pem admin.pem

4、创建kube-proxy证书 root@ubuntu132:~/ssl# cat kube-proxy-csr.json { "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "sichuan", "ST": "chengdu", "O": "K8S", "OU": "System" } ] }

root# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

5、校验证书

root@ubuntu132:~/ssl# cat kube-proxy-csr.json { "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "sichuan", "ST": "chengdu", "O": "K8S", "OU": "System" } ] }

root@ubuntu132:~/ssl# cfssl-certinfo -cert kubernetes.pem { "subject": { "common_name": "kubernetes", "country": "CN", "organization": "K8S", "organizational_unit": "System", "locality": "sichuan", "province": "chengdu", "names": [ "CN", "chengdu", "sichuan", "K8S", "System", "kubernetes" ] }, "issuer": { "common_name": "kubernetes", "country": "CN", "organization": "K8S", "organizational_unit": "System", "locality": "sichuan", "province": "chengdu", "names": [ "CN", "chengdu", "sichuan", "K8S", "System", "kubernetes" ] }, "serial_number": "21319328974437703439675516504278703829575637313", "sans": [ "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local", "127.0.0.1", "192.168.15.132", "192.168.15.133", "192.168.15.134", "127.0.0.1", "10.254.0.1" ], "not_before": "2017-12-01T09:39:00Z", "not_after": "2027-11-29T09:39:00Z", "sigalg": "SHA256WithRSA", "authority_key_id": "F8:6C:92:4:47:47:26:B4:5B:F:49:65:C9:FD:BF:90:F:96:4D:92", "subject_key_id": "5C:9E:CF:98:85:1E:32:11:C9:17:BF:6D:98:4A:D9:24:6F:57:BD:D2", "pem": "-----BEGIN CERTIFICATE-----\nMIIEizCCA3OgAwIBAgIUA7v95O6TMv/QSTxp+KxYZ2nFmUEwDQYJKoZIhvcNAQEL\nBQAwZTELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB2NoZW5nZHUxEDAOBgNVBAcTB3Np\nY2h1YW4xDDAKBgNVBAoTA0s4UzEPMA0GA1UECxMGU3lzdGVtMRMwEQYDVQQDEwpr\ndWJlcm5ldGVzMB4XDTE3MTIwMTA5MzkwMFoXDTI3MTEyOTA5MzkwMFowZTELMAkG\nA1UEBhMCQ04xEDAOBgNVBAgTB2NoZW5nZHUxEDAOBgNVBAcTB3NpY2h1YW4xDDAK\nBgNVBAoTA0s4UzEPMA0GA1UECxMGU3lzdGVtMRMwEQYDVQQDEwprdWJlcm5ldGVz\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxxQcMjAa7sni50gTBX4Z\nYQVUyHlTahZBivVK8fK6bW3xoV/9ohQ7OUSJ/5ZvwsQZWnAmKJ0U1i12+efflMoB\nQnuikfQTtAksFIlAT6kWmZAfJD1I6NaPJXmA5/olWcMlPQZhfuwEES7bDeNwo4vo\n0C6IBdvFusi/CZPwdyHtPzB62V6UsanYkwZeUhmZXaUe0Mi2opA5IwbswGeTuYd7\nEN0c6FyuXQt1cdIFEwbOs2k+5YdE3vgw+deBW35rshnw9RvaQFHwU+sgXUaaR8G8\nDTNmnnmEPWo38tYonK0hE7uZdnviapYGhCF0lOXtqMdN4nFwt4nFG+S3h3b0oUM0\nRwIDAQABo4IBMTCCAS0wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF\nBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRcns+YhR4yEckX\nv22YStkkb1e90jAfBgNVHSMEGDAWgBT4bJIER0cmtFsPSWXJ/b+QD5ZNkjCBrQYD\nVR0RBIGlMIGiggprdWJlcm5ldGVzghJrdWJlcm5ldGVzLmRlZmF1bHSCFmt1YmVy\nbmV0ZXMuZGVmYXVsdC5zdmOCHmt1YmVybmV0ZXMuZGVmYXVsdC5zdmMuY2x1c3Rl\ncoIka3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FshwR/AAABhwTA\nqA+EhwTAqA+FhwTAqA+GhwR/AAABhwQK/gABMA0GCSqGSIb3DQEBCwUAA4IBAQAn\n1Au3tuEOiimJ+WQYeDTZvG4n1sNbIoMz+Bj3il07s+mjoRPtTz0/GfdFeHVtn6r+\nRVxdA8Ko8NJh9//J+ZlwfyLh809wEwP8JyascqWIHH1vnnIgN4jDaJCJbEDr4M04\nq3Jk5mShwnz1so9Nn2XdDhPnfNfl0hOcR8Qllkj/zHLV4XUBfvLXZrnXHTDkL/Q8\n/zIQSmW5xwOT2V/xcU5S1Kh45z+aXIjhhHdS4xj84U1YfSXC3besWTDIoFg1pli+\nit81HK1evl8KSWo1h67bZ0RGwmDufdvQPoeF5gQH1ZIJIOT3dr0QxluqtzwS1qG4\nsB/9ocHk7vzjyywja6JT\n-----END CERTIFICATE-----\n" }

6、拷贝证书到所有节点

mkdir -p /etc/kubernetes/ssl cp *.pem /etc/kubernetes/ssl