Skip to content

Commit 23cdd97

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #26813 from zhiguo-lu/zh-trans-task-certificates
[zh] translate task certificates
2 parents 96b4a51 + 5e6da7d commit 23cdd97

File tree

1 file changed

+366
-0
lines changed

1 file changed

+366
-0
lines changed

‎content/zh/docs/tasks/administer-cluster/certificates.md

Lines changed: 366 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,366 @@
1+
---
2+
title: 证书
3+
content_type: task
4+
weight: 20
5+
---
6+
<!--
7+
---
8+
title: Certificates
9+
content_type: task
10+
weight: 20
11+
---
12+
-->
13+
14+
<!-- overview -->
15+
16+
<!--
17+
When using client certificate authentication, you can generate certificates
18+
manually through `easyrsa`, `openssl` or `cfssl`.
19+
-->
20+
在使用客户端证书认证的场景下，你可以通过 `easyrsa`、`openssl` 或 `cfssl` 等工具以手工方式生成证书。
21+
22+
<!-- body -->
23+
24+
### easyrsa
25+
26+
<!--
27+
**easyrsa** can manually generate certificates for your cluster.
28+
-->
29+
**easyrsa** 支持以手工方式为你的集群生成证书。
30+
31+
<!--
32+
1. Download, unpack, and initialize the patched version of easyrsa3.
33+
-->
34+
1. 下载、解压、初始化打过补丁的 easyrsa3。
35+
36+
curl -LO https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
37+
tar xzf easy-rsa.tar.gz
38+
cd easy-rsa-master/easyrsa3
39+
./easyrsa init-pki
40+
41+
<!--
42+
1. Generate a new certificate authority (CA). `--batch` sets automatic mode;
43+
`--req-cn` specifies the Common Name (CN) for the CA's new root certificate.
44+
-->
45+
1. 生成新的证书颁发机构（CA）。参数 `--batch` 用于设置自动模式；
46+
参数 `--req-cn` 用于设置新的根证书的通用名称（CN）。
47+
48+
./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass
49+
50+
<!--
51+
1. Generate server certificate and key.
52+
The argument `--subject-alt-name` sets the possible IPs and DNS names the API server will
53+
be accessed with. The `MASTER_CLUSTER_IP` is usually the first IP from the service CIDR
54+
that is specified as the `--service-cluster-ip-range` argument for both the API server and
55+
the controller manager component. The argument `--days` is used to set the number of days
56+
after which the certificate expires.
57+
The sample below also assumes that you are using `cluster.local` as the default
58+
DNS domain name.
59+
-->
60+
1. 生成服务器证书和秘钥。
61+
参数 `--subject-alt-name` 设置 API 服务器的 IP 和 DNS 名称。
62+
`MASTER_CLUSTER_IP` 用于 API 服务器和控制管理器，通常取 CIDR 的第一个 IP，由 `--service-cluster-ip-range` 的参数提供。
63+
参数 `--days` 用于设置证书的过期时间。
64+
下面的示例假定你的默认 DNS 域名为 `cluster.local`。
65+
66+
./easyrsa --subject-alt-name="IP:${MASTER_IP},"\
67+
"IP:${MASTER_CLUSTER_IP},"\
68+
"DNS:kubernetes,"\
69+
"DNS:kubernetes.default,"\
70+
"DNS:kubernetes.default.svc,"\
71+
"DNS:kubernetes.default.svc.cluster,"\
72+
"DNS:kubernetes.default.svc.cluster.local" \
73+
--days=10000 \
74+
build-server-full server nopass
75+
76+
<!--
77+
1. Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory.
78+
1. Fill in and add the following parameters into the API server start parameters:
79+
-->
80+
1. 拷贝文件 `pki/ca.crt`、`pki/issued/server.crt` 和 `pki/private/server.key` 到你的目录中。
81+
1. 在 API 服务器的启动参数中添加以下参数：
82+
83+
--client-ca-file=/yourdirectory/ca.crt
84+
--tls-cert-file=/yourdirectory/server.crt
85+
--tls-private-key-file=/yourdirectory/server.key
86+
87+
### openssl
88+
89+
<!--
90+
**openssl** can manually generate certificates for your cluster.
91+
-->
92+
**openssl** 支持以手工方式为你的集群生成证书。
93+
94+
<!--
95+
1. Generate a ca.key with 2048bit:
96+
-->
97+
1. 生成一个 2048 位的 ca.key 文件
98+
99+
openssl genrsa -out ca.key 2048
100+
101+
<!--
102+
1. According to the ca.key generate a ca.crt (use -days to set the certificate effective time):
103+
-->
104+
1. 在 ca.key 文件的基础上，生成 ca.crt 文件（用参数 -days 设置证书有效期）
105+
106+
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
107+
108+
<!--
109+
1. Generate a server.key with 2048bit:
110+
-->
111+
1. 生成一个 2048 位的 server.key 文件：
112+
113+
openssl genrsa -out server.key 2048
114+
115+
<!--
116+
1. Create a config file for generating a Certificate Signing Request (CSR).
117+
Be sure to substitute the values marked with angle brackets (e.g. `<MASTER_IP>`)
118+
with real values before saving this to a file (e.g. `csr.conf`).
119+
Note that the value for `MASTER_CLUSTER_IP` is the service cluster IP for the
120+
API server as described in previous subsection.
121+
The sample below also assumes that you are using `cluster.local` as the default
122+
DNS domain name.
123+
-->
124+
1. 创建一个用于生成证书签名请求（CSR）的配置文件。
125+
保存文件（例如：`csr.conf`）前，记得用真实值替换掉尖括号中的值（例如：`<MASTER_IP>`）。
126+
注意：`MASTER_CLUSTER_IP` 就像前一小节所述，它的值是 API 服务器的服务集群 IP。
127+
下面的例子假定你的默认 DNS 域名为 `cluster.local`。
128+
129+
[ req ]
130+
default_bits = 2048
131+
prompt = no
132+
default_md = sha256
133+
req_extensions = req_ext
134+
distinguished_name = dn
135+
136+
[ dn ]
137+
C = <country>
138+
ST = <state>
139+
L = <city>
140+
O = <organization>
141+
OU = <organization unit>
142+
CN = <MASTER_IP>
143+
144+
[ req_ext ]
145+
subjectAltName = @alt_names
146+
147+
[ alt_names ]
148+
DNS.1 = kubernetes
149+
DNS.2 = kubernetes.default
150+
DNS.3 = kubernetes.default.svc
151+
DNS.4 = kubernetes.default.svc.cluster
152+
DNS.5 = kubernetes.default.svc.cluster.local
153+
IP.1 = <MASTER_IP>
154+
IP.2 = <MASTER_CLUSTER_IP>
155+
156+
[ v3_ext ]
157+
authorityKeyIdentifier=keyid,issuer:always
158+
basicConstraints=CA:FALSE
159+
keyUsage=keyEncipherment,dataEncipherment
160+
extendedKeyUsage=serverAuth,clientAuth
161+
subjectAltName=@alt_names
162+
163+
<!--
164+
1. Generate the certificate signing request based on the config file:
165+
-->
166+
1. 基于上面的配置文件生成证书签名请求：
167+
168+
openssl req -new -key server.key -out server.csr -config csr.conf
169+
170+
<!--
171+
1. Generate the server certificate using the ca.key, ca.crt and server.csr:
172+
-->
173+
1. 基于 ca.key、ca.key 和 server.csr 等三个文件生成服务端证书：
174+
175+
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
176+
-CAcreateserial -out server.crt -days 10000 \
177+
-extensions v3_ext -extfile csr.conf
178+
179+
<!--
180+
1. View the certificate:
181+
-->
182+
1. 查看证书：
183+
184+
openssl x509 -noout -text -in ./server.crt
185+
186+
<!--
187+
Finally, add the same parameters into the API server start parameters.
188+
-->
189+
最后，为 API 服务器添加相同的启动参数。
190+
191+
### cfssl
192+
193+
<!--
194+
**cfssl** is another tool for certificate generation.
195+
-->
196+
**cfssl** 是另一个用于生成证书的工具。
197+
198+
<!--
199+
1. Download, unpack and prepare the command line tools as shown below.
200+
Note that you may need to adapt the sample commands based on the hardware
201+
architecture and cfssl version you are using.
202+
-->
203+
1. 下载、解压并准备如下所示的命令行工具。
204+
注意：你可能需要根据所用的硬件体系架构和 cfssl 版本调整示例命令。
205+
206+
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl_1.5.0_linux_amd64 -o cfssl
207+
chmod +x cfssl
208+
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssljson_1.5.0_linux_amd64 -o cfssljson
209+
chmod +x cfssljson
210+
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl-certinfo_1.5.0_linux_amd64 -o cfssl-certinfo
211+
chmod +x cfssl-certinfo
212+
213+
<!--
214+
1. Create a directory to hold the artifacts and initialize cfssl:
215+
-->
216+
1. 创建一个目录，用它保存所生成的构件和初始化 cfssl：
217+
218+
mkdir cert
219+
cd cert
220+
../cfssl print-defaults config > config.json
221+
../cfssl print-defaults csr > csr.json
222+
223+
<!--
224+
1. Create a JSON config file for generating the CA file, for example, `ca-config.json`:
225+
-->
226+
1. 创建一个 JSON 配置文件来生成 CA 文件，例如：`ca-config.json`：
227+
228+
{
229+
"signing": {
230+
"default": {
231+
"expiry": "8760h"
232+
},
233+
"profiles": {
234+
"kubernetes": {
235+
"usages": [
236+
"signing",
237+
"key encipherment",
238+
"server auth",
239+
"client auth"
240+
],
241+
"expiry": "8760h"
242+
}
243+
}
244+
}
245+
}
246+
247+
<!--
248+
1. Create a JSON config file for CA certificate signing request (CSR), for example,
249+
`ca-csr.json`. Be sure to replace the values marked with angle brackets with
250+
real values you want to use.
251+
-->
252+
1. 创建一个 JSON 配置文件，用于 CA 证书签名请求（CSR），例如：`ca-csr.json`。
253+
确认用你需要的值替换掉尖括号中的值。
254+
255+
{
256+
"CN": "kubernetes",
257+
"key": {
258+
"algo": "rsa",
259+
"size": 2048
260+
},
261+
"names":[{
262+
"C": "<country>",
263+
"ST": "<state>",
264+
"L": "<city>",
265+
"O": "<organization>",
266+
"OU": "<organization unit>"
267+
}]
268+
}
269+
270+
<!--
271+
1. Generate CA key (`ca-key.pem`) and certificate (`ca.pem`):
272+
-->
273+
1. 生成 CA 秘钥文件（`ca-key.pem`）和证书文件（`ca.pem`）：
274+
275+
../cfssl gencert -initca ca-csr.json | ../cfssljson -bare ca
276+
277+
<!--
278+
1. Create a JSON config file for generating keys and certificates for the API
279+
server, for example, `server-csr.json`. Be sure to replace the values in angle brackets with
280+
real values you want to use. The `MASTER_CLUSTER_IP` is the service cluster
281+
IP for the API server as described in previous subsection.
282+
The sample below also assumes that you are using `cluster.local` as the default
283+
DNS domain name.
284+
-->
285+
1. 创建一个 JSON 配置文件，用来为 API 服务器生成秘钥和证书，例如：`server-csr.json`。
286+
确认用你需要的值替换掉尖括号中的值。`MASTER_CLUSTER_IP` 是为 API 服务器 指定的服务集群 IP，就像前面小节描述的那样。
287+
以下示例假定你的默认 DSN 域名为`cluster.local`。
288+
289+
{
290+
"CN": "kubernetes",
291+
"hosts": [
292+
"127.0.0.1",
293+
"<MASTER_IP>",
294+
"<MASTER_CLUSTER_IP>",
295+
"kubernetes",
296+
"kubernetes.default",
297+
"kubernetes.default.svc",
298+
"kubernetes.default.svc.cluster",
299+
"kubernetes.default.svc.cluster.local"
300+
],
301+
"key": {
302+
"algo": "rsa",
303+
"size": 2048
304+
},
305+
"names": [{
306+
"C": "<country>",
307+
"ST": "<state>",
308+
"L": "<city>",
309+
"O": "<organization>",
310+
"OU": "<organization unit>"
311+
}]
312+
}
313+
314+
<!--
315+
1. Generate the key and certificate for the API server, which are by default
316+
saved into file `server-key.pem` and `server.pem` respectively:
317+
-->
318+
1. 为 API 服务器生成秘钥和证书，默认会分别存储为`server-key.pem` 和 `server.pem` 两个文件。
319+
320+
../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
321+
--config=ca-config.json -profile=kubernetes \
322+
server-csr.json | ../cfssljson -bare server
323+
324+
<!--
325+
## Distributing Self-Signed CA Certificate
326+
-->
327+
## 分发自签名的 CA 证书
328+
329+
<!--
330+
A client node may refuse to recognize a self-signed CA certificate as valid.
331+
For a non-production deployment, or for a deployment that runs behind a company
332+
firewall, you can distribute a self-signed CA certificate to all clients and
333+
refresh the local list for valid certificates.
334+
335+
On each client, perform the following operations:
336+
-->
337+
客户端节点可能不认可自签名 CA 证书的有效性。
338+
对于非生产环境，或者运行在公司防火墙后的环境，你可以分发自签名的 CA 证书到所有客户节点，并刷新本地列表以使证书生效。
339+
340+
在每一个客户节点，执行以下操作：
341+
342+
```bash
343+
sudo cp ca.crt /usr/local/share/ca-certificates/kubernetes.crt
344+
sudo update-ca-certificates
345+
```
346+
347+
```
348+
Updating certificates in /etc/ssl/certs...
349+
1 added, 0 removed; done.
350+
Running hooks in /etc/ca-certificates/update.d....
351+
done.
352+
```
353+
354+
<!--
355+
## Certificates API
356+
-->
357+
## 证书 API {#certificates-api}
358+
359+
<!--
360+
You can use the `certificates.k8s.io` API to provision
361+
x509 certificates to use for authentication as documented
362+
[here](/docs/tasks/tls/managing-tls-in-a-cluster).
363+
-->
364+
你可以通过 `certificates.k8s.io` API 提供 x509 证书，用来做身份验证，
365+
如[本](/zh/docs/tasks/tls/managing-tls-in-a-cluster)文档所述。
366+

0 commit comments

Comments
 (0)