k8s部署之使用CFSSL创建证书

墨蓝 2023-07-10 11:29 13阅读 0赞

# k8s部署之使用CFSSL创建证书 #

# 安装CFSSL #

curl -L -o /data/opt/cfsslbase/cfssl [https://pkg.cfssl.org/R1.2/cfssl\_linux-amd64][https_pkg.cfssl.org_R1.2_cfssl_linux-amd64]  
curl -L -o /data/opt/cfsslbase/cfssljson [https://pkg.cfssl.org/R1.2/cfssljson\_linux-amd64][https_pkg.cfssl.org_R1.2_cfssljson_linux-amd64]  
curl -L -o /data/opt/cfsslbase/cfssl-certinfo [https://pkg.cfssl.org/R1.2/cfssl-certinfo\_linux-amd64][https_pkg.cfssl.org_R1.2_cfssl-certinfo_linux-amd64]  
chmod +x /bin/cfssl\*

注意：如果文件存放的目录非默认目录 /usr/bin，则需添加存放这些文件的目录到环境变量：

export PATH=/data/opt/cfsslbasse:$PATH

# 容器相关证书类型 #

client certificate： 用于服务端认证客户端,例如etcdctl、etcd proxy、fleetctl、docker客户端
    server certificate: 服务端使用，客户端以此验证服务端身份,例如docker服务端、kube-apiserver
    peer certificate: 双向证书，用于etcd集群成员间通信

# 创建CA证书 #

## 生成默认CA配置 ##

mkdir /opt/ssl
    cd /opt/ssl
    cfssl print-defaults config > ca-config.json
    cfssl print-defaults csr > ca-csr.json

### 修改ca-config.json,分别配置针对三种不同证书类型的profile,其中有效期43800h为5年 ###

{
        "signing": {
            "default": {
                "expiry": "43800h"
            },
            "profiles": {
                "server": {
                    "expiry": "43800h",
                    "usages": [
                        "signing",
                        "key encipherment",
                        "server auth"
                    ]
                },
                "client": {
                    "expiry": "43800h",
                    "usages": [
                        "signing",
                        "key encipherment",
                        "client auth"
                    ]
                },
                "peer": {
                    "expiry": "43800h",
                    "usages": [
                        "signing",
                        "key encipherment",
                        "server auth",
                        "client auth"
                    ]
                }
            }
        }
    }

### 修改ca-csr.config ###

{
        "CN": "Self Signed Ca",
        "key": {
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            {
                "C": "CN",
                "L": "SH",
                "O": "Netease",
                "ST": "SH",            
                "OU": "OT"
            }    ]
    }

## 生成CA证书和私钥 ##

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -  
生成ca.pem、ca.csr、ca-key.pem(CA私钥,需妥善保管)

### 签发Server Certificate ###

cfssl print-defaults csr > server-csr.json

vim server-csr.json
    {
        "CN": "Server",
        "hosts": [
            "192.168.1.1"
           ],
        "key": {
            "algo": "ecdsa",
            "size": 256
        },
        "names": [
            {
                "C": "CN",
                "L": "SH",
                "ST": "SH"
            }
        ]
    }

### 生成服务端证书和私钥 ###

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

签发Client Certificate

cfssl print-defaults csr > admin-csr.json

vim admin-csr.json
    {
        "CN": "Client",
        "hosts": [],
        "key": {
            "algo": "ecdsa",
            "size": 256
        },
        "names": [
            {
                "C": "CN",
                "L": "SH",
                "ST": "SH"
            }
        ]
    }

### 生成客户端证书和私钥 ###

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

签发peer certificate

cfssl print-defaults csr > kube-proxy-csr.json
    vim kube-proxy-csr.json
    {
        "CN": "member1",
        "hosts": [
            "192.168.1.1"
        ],
        "key": {
            "algo": "ecdsa",
            "size": 256
        },
        "names": [
            {
                "C": "CN",
                "L": "SH",
                "ST": "SH"
            }
        ]
    }

### 为节点member1生成证书和私钥: ###

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

针对etcd服务,每个etcd节点上按照上述方法生成相应的证书和私钥

## 最后校验证书 ##

校验生成的证书是否和配置相符

openssl x509 -in ca.pem -text -noout
    openssl x509 -in server.pem -text -noout
    openssl x509 -in client.pem -text -noout

[https_pkg.cfssl.org_R1.2_cfssl_linux-amd64]: https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
[https_pkg.cfssl.org_R1.2_cfssljson_linux-amd64]: https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
[https_pkg.cfssl.org_R1.2_cfssl-certinfo_linux-amd64]: https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64