第三篇 PKI基础概念、cfssl工具介绍及kubernetes中证书

#!/bin/bash

# download cfssl tools
while true;
do
        echo "Download cfssl, please wait a monment." &&\
        curl -L -C - -O https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 && \
        curl -L -C - -O https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 && \
        curl -L -C - -O https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
        if [ $? -eq 0 ];then
                echo "cfssl download success."
                break
        else
                echo "cfssl download failed."
                break
        fi
done

# Whether the bin directory exists.
if [ ! -d data/k8s/bin/ ];then
        mkdir -p data/k8s/bin/
fi

# Copy from current directory to bin directory
mv cfssl_linux-amd64 data/k8s/bin/cfssl
mv cfssljson_linux-amd64 data/k8s/bin/cfssljson
mv cfssl-certinfo_linux-amd64 data/k8s/bin/cfssl-certinfo
chmod +x data/k8s/bin/{cfssl,cfssljson,cfssl-certinfo}

# add environment variables
[ $(cat etc/profile|grep 'PATH=/data/k8s/bin'|wc -l ) -eq 0 ] && echo 'PATH=/data/k8s/bin:$PATH' >>/etc/profile && source /etc/profile || source /etc/profile

cfssl print-defaults config > ca-config.json

#!/bin/bash
CA_SSL=/data/k8s/work
cat > ${CA_SSL}/ca-config.json << EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cfssl print-defaults csr > ca-csr.json

#!/bin/bash
CA_SSL=/data/k8s/work
cat > ${CA_SSL}/ca-csr.json <<EOF
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "k8s",
           "OU": "System"
        }
    ]
}
EOF

[root@master01 work]# cd /data/k8s/work
[root@master01 work]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
[root@master01 work]# ls -l ca*
-rw-r--r-- 1 root root 294 Dec 26 20:42 ca-config.json
-rw-r--r-- 1 root root 1001 Dec 26 20:54 ca.csr
-rw-r--r-- 1 root root 263 Dec 26 20:41 ca-csr.json
-rw------- 1 root root 1675 Dec 26 20:54 ca-key.pem
-rw-r--r-- 1 root root 1359 Dec 26 20:54 ca.pem
[root@master01 work]#

#!/bin/bash

cd /data/k8s/work
source /data/k8s/bin/env.sh
for node_ip in ${NODE_IPS[@]}
do
  echo ">>> ${node_ip}"
  ssh root@${node_ip} "mkdir -p etc/kubernetes/cert"
  scp ca*.pem ca-config.json root@${node_ip}:/etc/kubernetes/cert
done

for node_ip in ${ETCD_IPS[@]}
do
  echo ">>> ${node_ip}"
  ssh root@${node_ip} "mkdir -p etc/kubernetes/cert"
  scp ca.pem ca-config.json root@${node_ip}:/etc/kubernetes/cert
done

gencert: 生成新的key(密钥)和签名证书
-initca：初始化一个新ca
-ca：指明ca的证书
-ca-key：指明ca的私钥文件
-config：指明请求证书的json文件
-profile：与-config中的profile对应，是指根据config中的profile段来生成证书的相关信息

#!/bin/bash

source /etc/profile
ETCD_SSL="/data/k8s/work"

[ ! -d ${ETCD_SSL} ] && mkdir ${ETCD_SSL}
cat >$ETCD_SSL/etcd-csr.json << EOF
{
    "CN": "etcd",
    "hosts": [
    "127.0.0.1",
    "192.168.16.101",
    "192.168.16.102",
    "192.168.16.103",
    "etcd01.k8s.vip",
    "etcd02.k8s.vip",
    "etcd03.k8s.vip"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
           "O": "k8s",
           "OU": "System"
        }
    ]
}
EOF

[root@master01 work]# cd /data/k8s/work
[root@master01 work]# cfssl gencert -ca=/data/k8s/work/ca.pem \
  -ca-key=/data/k8s/work/ca-key.pem \
  -config=/data/k8s/work/ca-config.json \
  -profile=kubernetes etcd-csr.json | cfssljson -bare etcd
[root@master01 work]# ls -l etcd*
-rw-r--r-- 1 root root 1127 Dec 27 10:32 etcd.csr
-rw-r--r-- 1 root root 423 Dec 27 10:32 etcd-csr.json
-rw------- 1 root root 1679 Dec 27 10:32 etcd-key.pem
-rw-r--r-- 1 root root 1501 Dec 27 10:32 etcd.pem
[root@master01 work]#

#!/bin/bash
source /data/k8s/bin/env.sh
cd /data/k8s/work/
for node_ip in ${ETCD_IPS[@]}
do
  echo ">>> ${node_ip}"
  ssh root@${node_ip} "mkdir -p etc/etcd/cert"
  scp etcd*.pem root@${node_ip}:/etc/etcd/cert
done

#!/bin/bash

cd /data/k8s/work
source /data/k8s/bin/env.sh

cat > kubernetes-csr.json << EOF
{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "192.168.16.104",
    "192.168.16.105",
    "192.168.16.106",
    "192.168.16.253",
    "master01.k8s.vip",
    "master02.k8s.vip",
    "master03.k8s.vip",
    "api.k8s.vip",
    "10.254.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local."
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
      {
        "C": "CN",
        "L": "Beijing",
        "ST": "Beijing",
        "O": "k8s",
        "OU": "System"
      }
  ]
}

EOF

#!/bin/bash
[root@master01 work] cd /data/k8s/work
[root@master01 work] source /data/k8s/bin/env.sh
[root@master01 work] cfssl gencert -ca=/data/k8s/work/ca.pem \
    -ca-key=/data/k8s/work/ca-key.pem \
    -config=/data/k8s/work/ca-config.json \
    -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes
[root@master01 work]# ls -l kubernetes*
-rw-r--r-- 1 root root 1362 Dec 27 14:18 kubernetes.csr
-rw-r--r-- 1 root root 607 Dec 27 14:17 kubernetes-csr.json
-rw------- 1 root root 1679 Dec 27 14:18 kubernetes-key.pem
-rw-r--r-- 1 root root 1728 Dec 27 14:18 kubernetes.pem
[root@master01 work]#

cd data/k8s/work
source data/k8s/bin/env.sh
for node_ip in ${MASTER_IPS[@]}
do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p etc/kubernetes/cert"
    scp kubernetes*.pem root@${node_ip}:/etc/kubernetes/cert/
done

#!/bin/bash
cd /data/k8s/work
cat > kube-controller-manager-csr.json <<EOF
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
        "127.0.0.1",
      "192.168.16.104",
      "192.168.16.105",
      "192.168.16.106",
      "192.168.16.253",
      "master01.k8s.vip",
      "master02.k8s.vip",
      "master03.k8s.vip",
      "api.k8s.vip"
    ],
    "names": [
      {
        "C": "CN",
        "ST": "BeiJing",
        "L": "BeiJing",
        "O": "system:kube-controller-manager",
        "OU": "System"
      }
    ]
}
EOF

[root@master01 work]# cd /data/k8s/work
[root@master01 work]# cfssl gencert -ca=/data/k8s/work/ca.pem \
  -ca-key=/data/k8s/work/ca-key.pem \
  -config=/data/k8s/work/ca-config.json \
  -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

[root@master01 work]# ls -l kube-controller-manager*
-rw-r--r-- 1 root root 1216 Dec 28 20:40 kube-controller-manager.csr
-rw-r--r-- 1 root root 485 Dec 28 20:39 kube-controller-manager-csr.json
-rw------- 1 root root 1675 Dec 28 20:40 kube-controller-manager-key.pem
-rw-r--r-- 1 root root 1590 Dec 28 20:40 kube-controller-manager.pem
[root@master01 work]#

#!/bin/bash
cd /data/k8s/work
source /data/k8s/bin/env.sh
for node_ip in ${MASTER_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-controller-manager*.pem root@${node_ip}:/etc/kubernetes/cert/
done

#!/bin/bash
cd /data/k8s/work
cat > kube-scheduler-csr.json <<EOF
{
    "CN": "system:kube-scheduler",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
        "127.0.0.1",
      "192.168.16.104",
      "192.168.16.104",
      "192.168.16.104",
      "192.168.16.253",
      "master01.k8s.vip",
      "master02.k8s.vip",
      "master03.k8s.vip",
      "api.k8s.vip"
    ],
    "names": [
      {
        "C": "CN",
        "ST": "BeiJing",
        "L": "BeiJing",
        "O": "system:system:kube-scheduler",
        "OU": "System"
      }
    ]
}
EOF

[root@master01 work]# cd /data/k8s/work
[root@master01 work]# cfssl gencert -ca=/data/k8s/work/ca.pem \
  -ca-key=/data/k8s/work/ca-key.pem \
  -config=/data/k8s/work/ca-config.json \
  -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler
[root@master01 work]# ls -l kube-scheduler*
-rw-r--r-- 1 root root 1204 Dec 28 21:45 kube-scheduler.csr
-rw-r--r-- 1 root root 474 Dec 28 21:44 kube-scheduler-csr.json
-rw------- 1 root root 1679 Dec 28 21:45 kube-scheduler-key.pem
-rw-r--r-- 1 root root 1574 Dec 28 21:45 kube-scheduler.pem
[root@master01 work]#

#!/bin/bash
cd /data/k8s/work
source /data/k8s/bin/env.sh
for node_ip in ${MASTER_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp kube-scheduler*.pem root@${node_ip}:/etc/kubernetes/cert/
done

#!/bin/bash
cd /data/k8s/work
cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}
EOF

[root@master01 work]# cd /data/k8s/work
[root@master01 work]# cfssl gencert -ca=/data/k8s/work/ca.pem \
  -ca-key=/data/k8s/work/ca-key.pem \
  -config=/data/k8s/work/ca-config.json \
  -profile=kubernetes admin-csr.json | cfssljson -bare admin
[root@master01 work]# ls -l admin*
-rw-r--r-- 1 root root 1009 Dec 28 20:20 admin.csr
-rw-r--r-- 1 root root 229 Dec 28 20:15 admin-csr.json
-rw------- 1 root root 1675 Dec 28 20:20 admin-key.pem
-rw-r--r-- 1 root root 1399 Dec 28 20:20 admin.pem
[root@master01 work]#

#!/bin/bash
cd /data/k8s/work
cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

[root@master01 work]# cd /data/k8s/work
[root@master01 work]# cfssl gencert -ca=/data/k8s/work/ca.pem \
  -ca-key=/data/k8s/work/ca-key.pem \
  -config=/data/k8s/work/ca-config.json \
  -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
[root@master01 work]# ls -lrth kube-proxy*
-rw-r--r-- 1 root root 215 Dec 29 19:09 kube-proxy-csr.json
-rw-r--r-- 1 root root 1.4K Dec 29 19:10 kube-proxy.pem
-rw------- 1 root root 1.7K Dec 29 19:10 kube-proxy-key.pem
-rw-r--r-- 1 root root 1009 Dec 29 19:10 kube-proxy.csr
[root@master01 work]#

#!/bin/bash
cd /data/k8s/work
cat > flanneld-csr.json <<EOF
{
  "CN": "flanneld",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

[root@master01 work]# cfssl gencert -ca=/data/k8s/work/ca.pem \
  -ca-key=/data/k8s/work/ca-key.pem \
  -config=/data/k8s/work/ca-config.json \
  -profile=kubernetes flanneld-csr.json | cfssljson -bare flanneld
[root@master01 work]# ls -l flanneld*
-rw-r--r-- 1 root root 997 Dec 28 22:17 flanneld.csr
-rw-r--r-- 1 root root 221 Dec 28 22:16 flanneld-csr.json
-rw------- 1 root root 1675 Dec 28 22:17 flanneld-key.pem
-rw-r--r-- 1 root root 1391 Dec 28 22:17 flanneld.pem
[root@master01 work]#

cd data/k8s/work
source data/k8s/bin/env.sh
for node_ip in ${NODE_IPS[@]}
do
    echo ">>> ${node_ip}"
    ssh root@${node_ip} "mkdir -p /etc/flanneld/cert"
    scp flanneld*.pem root@${node_ip}:/etc/flanneld/cert
done

#!/bin/bash
cd /data/k8s/work
source /data/k8s/bin/env.sh
cat > proxy-client-csr.json <<EOF
{
  "CN": "aggregator",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

[root@master01 work]# cfssl gencert -ca=/etc/kubernetes/cert/ca.pem \
  -ca-key=/etc/kubernetes/cert/ca-key.pem \
  -config=/etc/kubernetes/cert/ca-config.json \
  -profile=kubernetes proxy-client-csr.json | cfssljson -bare proxy-client
[root@master01 work]# ls -l proxy*
-rw-r--r-- 1 root root 1005 Dec 28 19:22 proxy-client.csr
-rw-r--r-- 1 root root 226 Dec 28 19:21 proxy-client-csr.json
-rw------- 1 root root 1675 Dec 28 19:22 proxy-client-key.pem
-rw-r--r-- 1 root root 1395 Dec 28 19:22 proxy-client.pem
[root@master01 work]#

#!/bin/bash
source /data/k8s/bin/env.sh
for node_ip in ${MASTER_IPS[@]}
do
    echo ">>> ${node_ip}"
    scp proxy-client*.pem root@${node_ip}:/etc/kubernetes/cert/
done