Kubernetes證書相關(CFSSL)

使用CFSSL創建證書

CFSSL是CloudFlare開源的一款PKI/TLS工具。 CFSSL 包含一個命令行工具和一個用於簽名，驗證並且捆綁TLS證書的 HTTP API 服務。使用Go語言編寫。
Github 地址： https://github.com/cloudflare/cfssl
官網地址： https://pkg.cfssl.org/

curl -s -L -o /bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
curl -s -L -o /bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
curl -s -L -o /bin/cfssl-certinfo https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x /bin/cfssl*

容器相關證書類型

client certificate：用於服務端認證客戶端,例如etcdctl、etcd proxy、fleetctl、docker客戶端
server certificate: 服務端使用，客戶端以此驗證服務端身份,例如docker服務端、kube-apiserver
peer certificate: 雙向證書，用於etcd集羣成員間通信

創建CA證書

生成默認CA配置

mkdir /opt/ssl

cd /opt/ssl

cfssl print-defaults config > ca-config.json

cfssl print-defaults csr > ca-csr.json

修改ca-config.json,分別配置針對三種不同證書類型的profile,其中有效期43800h爲5年

{
"signing": {
    "default": {
        "expiry": "43800h"
    },
    "profiles": {
        "server": {
            "expiry": "43800h",
            "usages": [
                "signing",
                "key encipherment",
                "server auth"
            ]
        },
        "client": {
            "expiry": "43800h",
            "usages": [
                "signing",
                "key encipherment",
                "client auth"
            ]
        },
        "peer": {
            "expiry": "43800h",
            "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
            ]
        }
    }
}
}

字段說明

ca-config.json：可以定義多個 profiles，分別指定不同的過期時間、使用場景等參數；後續在簽名證書時使用某個 profile；

signing：表示該證書可用於簽名其它證書；生成的 ca.pem 證書中 CA:TRUE；

server auth：表示client可以用該 CA 對server提供的證書進行驗證；

client auth：表示server可以用該CA對client提供的證書進行驗證；

修改ca-csr.json

{
"CN": "Self Signed Ca",
"key": {
    "algo": "rsa",
    "size": 2048
},
"names": [
    {
        "C": "CN",
        "L": "SH",
        "O": "Netease",
        "ST": "SH",            
        "OU": "OT"
    }    ]
}

“CN”：Common Name，kube-apiserver 從證書中提取該字段作爲請求的用戶名 (User Name)；

“O”：Organization，kube-apiserver 從證書中提取該字段作爲請求用戶所屬的組 (Group)；

“C”: Country，國家

“L”: Locality，地區，城市

“O”: Organization Name，組織名稱，公司名稱

“OU”: Organization Unit Name，組織單位名稱，公司部門

“ST”: State，州，省

生成CA證書和私鑰

[root@master-1 ssl]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
生成ca.pem、ca.csr、ca-key.pem(CA私鑰,需妥善保管)

簽發Server Certificate

cfssl print-defaults csr > server.json
vim server.json
{
    "CN": "Server",
    "hosts": [
        "192.168.1.1"
       ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "SH",
            "ST": "SH"
        }
    ]
}

#生成服務端證書和私鑰
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server server.json | cfssljson -bare server

簽發Client Certificate

cfssl print-defaults csr > client.json
vim client.json
{
    "CN": "Client",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "SH",
            "ST": "SH"
        }
    ]
}

#生成客戶端證書和私鑰
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client.json | cfssljson -bare client

簽發peer certificate

cfssl print-defaults csr > member1.json
vim member1.json
{
    "CN": "member1",
    "hosts": [
        "192.168.1.1"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "CN",
            "L": "SH",
            "ST": "SH"
        }
    ]
}

#爲節點member1生成證書和私鑰:
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer member1.json | cfssljson -bare member1

校驗生成的證書是否和配置相符

openssl x509 -in ca.pem -text -noout
openssl x509 -in server.pem -text -noout
openssl x509 -in client.pem -text -noout

cfssl常用命令：

cfssl gencert -initca ca-csr.json | cfssljson -bare ca           #初始化ca
cfssl gencert -initca -ca-key key.pem ca-csr.json | cfssljson -bare ca       #使用現有私鑰, 重新生成
cfssl certinfo -cert ca.pem
cfssl certinfo -csr ca.csr

識別證書類型：

[root@master-1 ssl]# openssl x509 -in server.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:25:cf:8d:42:1e:c8:2d:b8:78:95:d1:f4:0a:25:8e:bb:48:53:9d
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=San Francisco, L=Chongqing, CN=test
        Validity
            Not Before: Feb 13 11:35:00 2019 GMT
            Not After : Feb 13 11:35:00 2020 GMT
        Subject: C=US, ST=San Francisco, L=CA, CN=etcd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b6:79:4d:af:27:a0:c9:0e:8a:d0:8c:25:d4:12:
                    f7:22:21:45:ce:80:25:e5:c6:0b:47:fe:ba:79:c7:
                    aa:14:d6:51:be:45:2d:92:49:a5:07:37:36:66:9b:
                    38:a9:9c:9c:0b:cf:91:45:55:7a:20:43:ad:64:09:
                    31:bb:25:30:ba:50:20:fe:3b:4e:cf:8c:21:bc:43:
                    d8:cf:f4:1b:d6:ed:3b:3e:9d:53:74:89:db:17:4b:
                    a7:a2:01:bb:00:36:74:95:a7:cf:0a:24:a1:0d:62:
                    6d:47:d3:f4:3a:93:e4:15:df:20:af:59:fb:5f:77:
                    9b:76:45:ad:68:24:69:d3:1a:cf:75:ef:3f:6d:19:
                    d6:3c:54:76:ec:1b:a3:98:bf:e3:d6:d7:a5:f8:ec:
                    12:47:ee:06:ab:ae:31:8b:83:be:43:6e:b9:41:2d:
                    82:ff:c6:20:e6:2c:69:d5:81:d4:9a:07:b2:e4:9a:
                    40:af:e9:ed:98:4e:c0:27:ef:7c:14:86:cf:6e:6e:
                    18:98:1c:d1:d9:dd:4e:a3:10:d3:63:f9:00:d6:3b:
                    04:e9:47:54:af:87:db:83:d5:8a:8a:05:f4:e8:38:
                    4d:64:e7:ae:b4:5f:3f:6a:18:c8:87:32:7d:24:46:
                    72:a8:4a:7f:dd:5c:5b:cf:6a:2f:af:88:bb:b2:d8:
                    02:af
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B7:EF:2C:02:18:05:D0:7E:30:63:BB:F9:8F:52:B4:1E:1F:57:4A:C8
            X509v3 Authority Key Identifier: 
                keyid:3C:58:00:7D:E0:2B:C1:AE:81:88:58:F1:FB:95:45:88:33:28:F7:00

            X509v3 Subject Alternative Name: 
                IP Address:172.19.0.203, IP Address:172.19.0.204, IP Address:172.19.0.205
    Signature Algorithm: sha256WithRSAEncryption
         35:8f:af:a7:03:c3:8f:5e:42:ec:10:af:33:c8:4e:b1:0e:d5:
         f7:3e:b2:5f:5d:cf:b4:49:15:94:b1:6b:78:3a:b5:fb:95:68:
         ab:ff:ff:45:74:f9:5f:17:a7:be:16:c8:92:66:28:d0:7c:6d:
         60:0d:82:26:65:01:71:f1:93:0d:0b:44:f3:08:59:9e:d5:89:
         d5:8c:83:d1:dc:b2:a5:8f:b6:be:e8:9e:79:3c:62:02:6b:0e:
         b0:1e:82:b6:2c:4c:b0:f8:eb:93:20:84:8c:c6:32:69:b3:88:
         27:bb:e8:7f:1c:37:01:26:35:0b:9a:61:bf:cc:00:c7:17:80:
         61:11:cb:b7:4d:66:85:e6:13:3e:8c:8e:be:ec:47:d1:00:85:
         cb:b1:aa:69:6a:49:35:44:43:d9:cf:67:fd:ec:63:50:96:4a:
         26:5b:36:c8:72:15:d7:5f:49:e5:30:98:0e:13:58:70:d2:72:
         03:02:45:c1:9c:81:dc:e0:e1:1c:f0:a4:e3:13:e1:b8:d4:01:
         f7:83:d6:cf:72:ba:46:aa:84:55:57:64:e6:93:bb:bc:68:55:
         32:cd:a4:d1:d6:db:e7:e6:9f:4f:1e:8a:24:44:76:42:ec:9d:
         4e:d2:5a:7f:74:7b:9a:66:ed:c3:1d:e4:5d:1a:07:ed:c6:fe:
         bf:8e:d2:80

表示服務器端證書

X509v3 Extended Key Usage: 
TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:FALSE

表示客戶端證書

X509v3 Extended Key Usage: 
TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE

表示雙向證書

X509v3 Extended Key Usage: 
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE

表示CA證書

X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:2

頒發機構信息：

Issuer: C=CN, ST=Chongqing, L=Chongqing, CN=yedong-test

使用者信息：

Subject: C=CN, ST=Chongqing, L=Chongqing, CN=Server

Kubernetes證書相關(CFSSL)

使用CFSSL創建證書

容器相關證書類型

創建CA證書

字段說明

修改ca-csr.json

生成CA證書和私鑰

簽發Server Certificate

簽發Client Certificate

簽發peer certificate

校驗生成的證書是否和配置相符

cfssl常用命令：

識別證書類型：

AI 畫圖真刺激，手把手教你如何用 ComfyUI 來畫出刺激的圖

公司剛入職了一名 Java 中級開發，短短 4 行代碼居然湊齊了 3 個 bug！我哭了~~

數據展示動態（跑分）顯示

公衆號5月C#/.NET熱文一覽

git 下載大陸鏡像地址

Kubernetes之配置dashboard

Kubernetes之RBAC（基於角色的訪問控制）

Kubernetes證書相關(CFSSL)

kubernetes flannel之Vxlan原理

python中的正則表達式（re模塊）三

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結