Shulou(Shulou.com)06/02 Report--

First, the CA official documents and startup parameters of the device kube-apiserver

Openssl genrsa-out ca.key 2048

Openssl req x509-new nodes-key ca.key-subj "/ CN=yourcompany.com"-days 5000-out ca.crt

Opensll genrsa-out server.key 2048

Prepare the master_ssl.conf file, which is used for the certificate of x509 v3 version

[req]

Req_extensions = v3_req

Distinguished_name = req_distinguished_name

[req_distinguished_name]

[v3_req]

BasicConstraints = CA:FALSE

KeyUsage = nonRepudiation, digitalSignature, keyEncipherment

SubjectAltName = @ alt_names

[alt_names]

DNS.1 = kubernetes

DNS.2 = kubernetes.default

DNS.3 = kubernetes.default.svc

DNS.4 = kubernetes.default.svc.cluster.local

DNS.5 = k8s-master (hostname of the server)

IP.1 = 169.169.0.1 (cluster ip of svc)

IP.2 = 192.168.01. (IP of node)

3. Create server.csr and server.crt files based on maste_ssl.conf. The file specified in "/ CN" in the parameter where server.csr is-subj is the hostname of master.

Openssl req-new-key server.key-subj "/ CN=k8s-master"-config master_ssl.conf-out server.csr

Openssl x509-req-in server.csr-CA ca.crt-CAkey ca.key-CAcreateserial-days 5000-extensions v3_req-extfile master_ssl.conf-out server.crt

After all execution, 6 files will be produced: ca.crt ca.key ca.srl server.crt server.csr server.key

4. Cp the six files produced into a directory, and then set the three startup parameters of kube-apiserver.

-client-ca-file=ca.crt-tls-cert-file=server.key-tls-private-key-file=server.crt

5. Close the non-secure port-- insecure-port=0-- secure-port=6443 and restart kube-apiserver

6. Set client certificate, private key and startup parameters of kube-controller-manager

Openssl genrsa-out cs_client.key 2048

Openssl req-new-key cs_client.key-subj "/ CN=k8s-node-1"-out cs_client.csr

Openssl x509-req-in cs_client.csr-CA ca.crt-CAkey ca.key-- CAcreateserial-days 5000-out cs_client.crt

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.