本文档说明自建CA的步骤,用于配置Https类型的Ingress Resource。如果您已经有证书和私钥,可在定义Ingress Resource时直接使用。
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 mv cfssl_linux-amd64 /usr/bin/cfssl wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 mv cfssljson_linux-amd64 /usr/bin/cfssljson wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo
CA 配置文件用于配置根证书的使用场景 (profile) 和具体参数 (usage: 过期时间、服务端认证、客户端认证、加密等),后续在签名其它证书时需要指定特定场景。
mkdir /root/cert cd /root/cert cat > ca-config.json <<EOF { "signing": { "default": { "expiry": "87600h" }, "profiles": { "ingress": { "usages": [ "signing", "key encipherment", "server auth", "client auth" ], "expiry": "87600h" } } } } EOF
cd /root/cert cat > ca-csr.json <<EOF { "CN": "ingress", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "4Paradigm" } ], "ca": { "expiry": "876000h" } } EOF
cd /root/cert cfssl gencert -initca ca-csr.json | cfssljson -bare ca ls ca*.pem
cd /root/cert cat > web-server-csr.json <<EOF { "CN": "ingress", "hosts": [ "web-server-test.jdcloud.com" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "4Paradigm" } ] } EOF
cd /root/cert cfssl gencert -ca=/root/cert/ca.pem \ -ca-key=/root/cert/ca-key.pem \ -config=/root/cert/ca-config.json \ -profile=ingress web-server-csr.json | cfssljson -bare web-server ls web-server*.pem