Skip to content

Latest commit

 

History

History
155 lines (124 loc) · 4.21 KB

03-ca-cert.md

File metadata and controls

155 lines (124 loc) · 4.21 KB

Generate Own CA and self-signed certificates, kubeconfig

This chapter create own CA and self-signed certificates

Own CA

This is own CA, we should add trust CA into OS to avoid the alert unknown ca.

Generate CA: Because we have custom hostname, we need to config ca.conf from repo

openssl genrsa -out ca.key 4096
openssl req -x509 -new -sha512 -noenc \
    -key ca.key -days 3653 \
    -config ca.conf \
    -out ca.crt

Generate master-151, worker-152, worker-154 and component k8s cert-key pairs from own root CA

certs=(
  "master-151" "worker-152" "worker-154"
  "kube-proxy" "kube-scheduler"
  "kube-controller-manager"
  "kube-api-server"
  "service-accounts"
)

for i in ${certs[*]}; do
  openssl genrsa -out "${i}.key" 4096

  openssl req -new -key "${i}.key" -sha256 \
    -config "ca.conf" -section ${i} \
    -out "${i}.csr"
  
  openssl x509 -req -days 3653 -in "${i}.csr" \
    -copy_extensions copyall \
    -sha256 -CA "ca.crt" \
    -CAkey "ca.key" \
    -CAcreateserial \
    -out "${i}.crt"
done

Kubeconfig

This script generate config and associated with the cert-key generated before

for host in worker-152 worker-154; do
  kubectl config set-cluster kubernetes-so-hard-huhu \
    --certificate-authority=ca.crt \
    --embed-certs=true \
    --server=https://master-151.sre.local:6443 \
    --kubeconfig=${host}.kubeconfig

  kubectl config set-credentials system:node:${host} \
    --client-certificate=${host}.crt \
    --client-key=${host}.key \
    --embed-certs=true \
    --kubeconfig=${host}.kubeconfig

  kubectl config set-context default \
    --cluster=kubernetes-so-hard-huhu \
    --user=system:node:${host} \
    --kubeconfig=${host}.kubeconfig

  kubectl config use-context default \
    --kubeconfig=${host}.kubeconfig
done

------

kubectl config set-cluster kubernetes-so-hard-huhu \
  --certificate-authority=ca.crt \
  --embed-certs=true \
  --server=https://master-151.sre.local:6443 \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config set-credentials system:kube-proxy \
  --client-certificate=kube-proxy.crt \
  --client-key=kube-proxy.key \
  --embed-certs=true \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config set-context default \
  --cluster=kubernetes-so-hard-huhu \
  --user=system:kube-proxy \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config use-context default \
  --kubeconfig=kube-proxy.kubeconfig
  
----

kubectl config set-cluster kubernetes-so-hard-huhu \
  --certificate-authority=ca.crt \
  --embed-certs=true \
  --server=https://master-151.sre.local:6443 \
  --kubeconfig=kube-controller-manager.kubeconfig

kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=kube-controller-manager.crt \
  --client-key=kube-controller-manager.key \
  --embed-certs=true \
  --kubeconfig=kube-controller-manager.kubeconfig

kubectl config set-context default \
  --cluster=kubernetes-so-hard-huhu \
  --user=system:kube-controller-manager \
  --kubeconfig=kube-controller-manager.kubeconfig

kubectl config use-context default \
  --kubeconfig=kube-controller-manager.kubeconfig

`----`

kubectl config set-cluster kubernetes-so-hard-huhu \
  --certificate-authority=ca.crt \
  --embed-certs=true \
  --server=https://master-151.sre.local:6443 \
  --kubeconfig=kube-scheduler.kubeconfig

kubectl config set-credentials system:kube-scheduler \
  --client-certificate=kube-scheduler.crt \
  --client-key=kube-scheduler.key \
  --embed-certs=true \
  --kubeconfig=kube-scheduler.kubeconfig

kubectl config set-context default \
  --cluster=kubernetes-so-hard-huhu \
  --user=system:kube-scheduler \
  --kubeconfig=kube-scheduler.kubeconfig

kubectl config use-context default \
  --kubeconfig=kube-scheduler.kubeconfig
  
  
-----

kubectl config set-cluster kubernetes-so-hard-huhu \
  --certificate-authority=ca.crt \
  --embed-certs=true \
  --server=https://127.0.0.1:6443 \
  --kubeconfig=admin.kubeconfig

kubectl config set-credentials admin \
  --client-certificate=admin.crt \
  --client-key=master-151.key \
  --embed-certs=true \
  --kubeconfig=admin.kubeconfig

kubectl config set-context default \
  --cluster=kubernetes-so-hard-huhu \
  --user=admin \
  --kubeconfig=admin.kubeconfig

kubectl config use-context default \
  --kubeconfig=admin.kubeconfig