二进制安装k8s - 02. 二进制文件下载及生成证书

二进制文件下载

----download k8s binary at:
https://dl.k8s.io/v1.15.6/kubernetes-server-linux-amd64.tar.gz

----download etcd binary at:
https://storage.googleapis.com/etcd/v3.3.10/etcd-v3.3.10-linux-amd64.tar.gz

----download docker binary at:
https://download.docker.com/linux/static/stable/x86_64/docker-18.09.8.tgz

----download ca tools at:
https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

----download cni plugins at:
https://github.com/containernetworking/plugins/releases/download/v0.8.5/cni-plugins-linux-amd64-v0.8.5.tgz

创建工作目录并解压须要的二进制文件

[[email protected] data]# mkdir -p /data/k8s/{bin,cert}
# master 节点须要文件
证书：cfssl 、 cfssl-certinfo 、 cfssljson
K8S: kube-apiserver 、 kube-controller-manager 、 kube-scheduler 、 kubectl 

# etcd 节点须要文件
ETCD文件：etcd 、 etcdctl

# node 节点须要文件
网络：bridge 、 
docker: containerd 、 containerd-shim 、 ctr 、 docker 、 dockerd 、docker-init 、 docker-proxy 、 runc
证书：cfssl 、 cfssl-certinfo 、 cfssljson
K8S: kubelet 、 kube-proxy

添加环境变量

[[email protected] /]# echo export PATH=/data/k8s/bin:$PATH >> /etc/profile
[[email protected] /]# source /etc/profile

生成CA证书

创建配置文件

[[email protected] cert]# pwd
/data/k8s/cert
[[email protected] cert]# vim ca-config.json

{
  "signing": {
    "default": {
      "expiry": "876000h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "876000h"
      }
    }
  }
}

注：
① signing ：表示该证书可用于签名其它证书，生成的 ca.pem 证书中CA=TRUE ；
② server auth ：表示 client 可以用该该证书对 server 提供的证书进行验证；
③ client auth ：表示 server 可以用该该证书对 client 提供的证书进行验证；

创建证书签名请求文件

[[email protected] cert]# pwd
/data/k8s/cert
[[email protected] cert]# vim ca-csr.json

{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "k8s",
      "OU": "Lswzw"
    }
  ],
  "ca": {
    "expiry": "876000h"
  }
}

生成证书

[[email protected] cert]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
2020/05/13 13:52:43 [INFO] generating a new CA key and certificate from CSR
2020/05/13 13:52:43 [INFO] generate received request
2020/05/13 13:52:43 [INFO] received CSR
2020/05/13 13:52:43 [INFO] generating key: rsa-2048
2020/05/13 13:52:43 [INFO] encoded CSR
2020/05/13 13:52:43 [INFO] signed certificate with serial number 674406950913508030822972235238493814155570887590
[[email protected] cert]# ls
ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem

准备kubectl使用的admin证书签名请求