繼續(xù)上一篇文章《負(fù)載均衡器高可用部署》下面介紹一下etcd證書生成配置。其中涉及到的ip地址和證書基本信息請?zhí)鎿Q成你自己的信息。

安裝cfssl工具

下載cfssl安裝包

https://github.com/cloudflare/cfssl/releases/download/v1.6.4/cfssl_1.6.4_linux_amd64

chmod +x cfssl_1.6.4_linux_amd64
mv cfssl_1.6.4_linux_amd64 /usr/local/bin/cfssl

下載cfssljson安裝包

https://github.com/cloudflare/cfssl/releases/download/v1.6.4/cfssljson_1.6.4_linux_amd64

chmod +x cfssljson_1.6.4_linux_amd64
mv cfssljson_1.6.4_linux_amd64 /usr/local/bin/cfssljson

下載cfssl-certinfo安裝包

https://github.com/cloudflare/cfssl/releases/download/v1.6.4/cfssl-certinfo_1.6.4_linux_amd64

chmod +x cfssl-certinfo_1.6.4_linux_amd64
mv cfssl-certinfo_1.6.4_linux_amd64 /usr/local/bin/cfssl-certinfo

驗(yàn)證cfssl是否安裝

cfssl version

配置CA證書請求文件

cat > ca-csr.json <<"EOF"
{"CN":"kubernetes","key":{"algo":"rsa","size":2048},"names":[{"C":"CN","ST":"zhejiang","L":"hangzhou","O":"eyinfo","OU":"CN"}],"ca":{"expiry":"876000h"}
}
EOF

創(chuàng)建CA證書

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

#輸出內(nèi)容：
2024/07/17 14:05:27 [INFO] generating a new CA key and certificate from CSR
2024/07/17 14:05:27 [INFO] generate received request
2024/07/17 14:05:27 [INFO] received CSR
2024/07/17 14:05:27 [INFO] generating key: rsa-2048
2024/07/17 14:05:28 [INFO] encoded CSR
2024/07/17 14:05:28 [INFO] signed certificate with serial number 204637901880970253758340254603897378959705254552

創(chuàng)建CA證書策略

server auth 表示client可以對使用該ca由server提供的證書進(jìn)行驗(yàn)證
client auth 表示server可以使用該ca由client提供的證書進(jìn)行驗(yàn)證

cat > ca-config.json <<"EOF"
{"signing": {"default": {"expiry":"876000h"},"profiles": {"kubernetes": {"usages": ["signing","key encipherment","server auth","client auth"],"expiry": "876000h"}}}
}
EOF

配置etcd證書請求文件

cat > etcd-csr.json <<"EOF"
{"CN": "etcd","hosts": ["127.0.0.1","192.168.3.41","192.168.3.42","192.168.3.43"],"key": {"algo": "rsa","size": 2048},"names": [{"C":"CN","ST":"zhejiang","L":"hangzhou","O":"eyinfo","OU":"CN"}]
}
EOF

生成etcd證書

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

#輸出結(jié)果
2024/07/17 14:54:50 [INFO] generate received request
2024/07/17 14:54:50 [INFO] received CSR
2024/07/17 14:54:50 [INFO] generating key: rsa-2048
2024/07/17 14:54:50 [INFO] encoded CSR
2024/07/17 14:54:50 [INFO] signed certificate with serial number 190216768305198849016248800228208888865087276362