03.安装前准备-证书环境

因为k8s架构中，各组件通过证书通信，因此需要一台服务器做证书签发。

1.根证书准备，涉及服务器 20.0.0.14
有openssl和cf两种工具，这里使用cf。

2. 下载包

[root@server14 ~]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -O /usr/local/bin/cfssl
--2020-11-24 09:34:46--  https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
Resolving pkg.cfssl.org (pkg.cfssl.org)... 104.16.235.19, 104.16.234.19
Connecting to pkg.cfssl.org (pkg.cfssl.org)|104.16.235.19|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10376657 (9.9M) [application/octet-stream]
Saving to: ‘/usr/local/bin/cfssl’
100%[==============================================================================================================================================================================>] 10,376,657  1.17MB/s   in 8.8s   
2020-11-24 09:34:59 (1.12 MB/s) - ‘/usr/local/bin/cfssl’ saved [10376657/10376657]

[root@server14 ~]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -O /usr/local/bin/cfssl-json
--2020-11-24 09:35:03--  https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
Resolving pkg.cfssl.org (pkg.cfssl.org)... 104.16.235.19, 104.16.234.19, 2606:4700::6810:eb13, ...
Connecting to pkg.cfssl.org (pkg.cfssl.org)|104.16.235.19|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2277873 (2.2M) [application/octet-stream]
Saving to: ‘/usr/local/bin/cfssl-json’
100%[==============================================================================================================================================================================>] 2,277,873   1.01MB/s   in 2.2s   
2020-11-24 09:35:06 (1.01 MB/s) - ‘/usr/local/bin/cfssl-json’ saved [2277873/2277873]

[root@server14 ~]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -O /usr/local/bin/cfssl-certinfo
--2020-11-24 09:35:12--  https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
Resolving pkg.cfssl.org (pkg.cfssl.org)... 104.16.234.19, 104.16.235.19, 2606:4700:1001:ff70::5fbc:d4e8, ...
Connecting to pkg.cfssl.org (pkg.cfssl.org)|104.16.234.19|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6595195 (6.3M) [application/octet-stream]
Saving to: ‘/usr/local/bin/cfssl-certinfo’
100%[==============================================================================================================================================================================>] 6,595,195   1.18MB/s   in 5.3s   
2020-11-24 09:35:18 (1.18 MB/s) - ‘/usr/local/bin/cfssl-certinfo’ saved [6595195/6595195]

3.添加执行权限

[root@server14 ~]# chmod u+x /usr/local/bin/cfssl*
[root@server14 ~]# ls -al /usr/local/bin/cfssl*
-rwxr--r--. 1 root root 10376657 Mar 30  2016 /usr/local/bin/cfssl
-rwxr--r--. 1 root root  6595195 Mar 30  2016 /usr/local/bin/cfssl-certinfo
-rwxr--r--. 1 root root  2277873 Mar 30  2016 /usr/local/bin/cfssl-json
[root@server14 ~]# 

4. 在 server14 签发根证书。

# 根证书配置：
# CN 一般写域名，浏览器会校验
# names 为地区和公司信息
# expiry 为过期时间

[root@server14 certs]# mkdir /opt/certs/ ; cd /opt/certs/
[root@server14 certs]# cat  /opt/certs/ca-csr.json
{
    "CN": "iamleon",
    "hosts": [
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "zhengzhou",
            "L": "zhengzhou",
            "O": "leon",
            "OU": "ops"
        }
    ],
    "ca": {
        "expiry": "175200h"
    }
}
[root@server14 certs]# 


[root@server14 certs]# cfssl gencert -initca ca-csr.json | cfssl-json -bare ca
2020/11/24 09:40:52 [INFO] generating a new CA key and certificate from CSR
2020/11/24 09:40:52 [INFO] generate received request
2020/11/24 09:40:52 [INFO] received CSR
2020/11/24 09:40:52 [INFO] generating key: rsa-2048
2020/11/24 09:40:53 [INFO] encoded CSR
2020/11/24 09:40:53 [INFO] signed certificate with serial number 70659936917783996401168067611982109712047607203

[root@server14 certs]# ls -l ca*
-rw-r--r--. 1 root root 1001 Nov 24 09:40 ca.csr
-rw-r--r--. 1 root root  332 Nov 24 09:40 ca-csr.json
-rw-------. 1 root root 1675 Nov 24 09:40 ca-key.pem
-rw-r--r--. 1 root root 1354 Nov 24 09:40 ca.pem
[root@server14 certs]#