二進制安裝k8s - 02. 二進制文件下載及生成證書

二進制安裝k8s - 02. 二進制文件下載及生成證書

---

---

二進制文件下載

----download k8s binary at:
https://dl.k8s.io/v1.15.6/kubernetes-server-linux-amd64.tar.gz

----download etcd binary at:
https://storage.googleapis.com/etcd/v3.3.10/etcd-v3.3.10-linux-amd64.tar.gz

----download docker binary at:
https://download.docker.com/linux/static/stable/x86_64/docker-18.09.8.tgz

----download ca tools at:
https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

----download cni plugins at:
https://github.com/containernetworking/plugins/releases/download/v0.8.5/cni-plugins-linux-amd64-v0.8.5.tgz

創建工作目錄並解壓須要的二進制文件

[root@master data]# mkdir -p /data/k8s/{bin,cert}
# master 節點須要文件
證書：cfssl 、 cfssl-certinfo 、 cfssljson
K8S: kube-apiserver 、 kube-controller-manager 、 kube-scheduler 、 kubectl 

# etcd 節點須要文件
ETCD文件：etcd 、 etcdctl

# node 節點須要文件
網絡：bridge 、 
docker: containerd 、 containerd-shim 、 ctr 、 docker 、 dockerd 、docker-init 、 docker-proxy 、 runc
證書：cfssl 、 cfssl-certinfo 、 cfssljson
K8S: kubelet 、 kube-proxy

添加環境變量

[root@master /]# echo export PATH=/data/k8s/bin:$PATH >> /etc/profile
[root@master /]# source /etc/profile

---

---

生成CA證書

創建配置文件

[root@master cert]# pwd
/data/k8s/cert
[root@master cert]# vim ca-config.json

{
  "signing": {
    "default": {
      "expiry": "876000h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "876000h"
      }
    }
  }
}

注：
① signing ：表示該證書可用於簽名其它證書，生成的 ca.pem 證書中CA=TRUE ；
② server auth ：表示 client 可以用該該證書對 server 提供的證書進行驗證；
③ client auth ：表示 server 可以用該該證書對 client 提供的證書進行驗證；

創建證書籤名請求文件

[root@master cert]# pwd
/data/k8s/cert
[root@master cert]# vim ca-csr.json

{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "SiChuan",
      "L": "ChengDu",
      "O": "k8s",
      "OU": "Lswzw"
    }
  ],
  "ca": {
    "expiry": "876000h"
  }
}

生成證書

[root@master cert]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
2020/05/13 13:52:43 [INFO] generating a new CA key and certificate from CSR
2020/05/13 13:52:43 [INFO] generate received request
2020/05/13 13:52:43 [INFO] received CSR
2020/05/13 13:52:43 [INFO] generating key: rsa-2048
2020/05/13 13:52:43 [INFO] encoded CSR
2020/05/13 13:52:43 [INFO] signed certificate with serial number 674406950913508030822972235238493814155570887590
[root@master cert]# ls
ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem

---

---

創建kubeconfig文件存放目錄

mkdir /data/k8s/conf

---

---