whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update authentication.md

Browse Source 
Fix leading spaces in commands.
This commit is contained in:
Stewart-YU
2017-08-15 19:58:24 +08:00
committed by Andrew Chen
parent b568610c08
commit 621959eeb2
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/authentication.md
+15 -15
View File
@@ -722,23 +722,23 @@ Finally, add the following parameters into API server start parameters:
1. Download, unpack, and initialize the patched version of easyrsa3. 1. Download, unpack, and initialize the patched version of easyrsa3.
curl -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz curl -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
tar xzf easy-rsa.tar.gz tar xzf easy-rsa.tar.gz
cd easy-rsa-master/easyrsa3 cd easy-rsa-master/easyrsa3
./easyrsa init-pki ./easyrsa init-pki
1. Generate a CA. (`--batch` set automatic mode. `--req-cn` default CN to use.) 1. Generate a CA. (`--batch` set automatic mode. `--req-cn` default CN to use.)
./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass
1. Generate server certificate and key. 1. Generate server certificate and key.
(build-server-full [filename]: Generate a keypair and sign locally for a client or server) (build-server-full [filename]: Generate a keypair and sign locally for a client or server)
./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full server nopass ./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full server nopass
1. Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory. 1. Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory.
1. Fill in and add the following parameters into the API server start parameters: 1. Fill in and add the following parameters into the API server start parameters:
--client-ca-file=/yourdirectory/ca.crt --client-ca-file=/yourdirectory/ca.crt
--tls-cert-file=/yourdirectory/server.crt --tls-cert-file=/yourdirectory/server.crt
--tls-private-key-file=/yourdirectory/server.key --tls-private-key-file=/yourdirectory/server.key
#### openssl #### openssl
@@ -746,22 +746,22 @@ Finally, add the following parameters into API server start parameters:
1. Generate a ca.key with 2048bit: 1. Generate a ca.key with 2048bit:
openssl genrsa -out ca.key 2048 openssl genrsa -out ca.key 2048
1. According to the ca.key generate a ca.crt (use -days to set the certificate effective time): 1. According to the ca.key generate a ca.crt (use -days to set the certificate effective time):
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
1. Generate a server.key with 2048bit 1. Generate a server.key with 2048bit
openssl genrsa -out server.key 2048 openssl genrsa -out server.key 2048
1. According to the server.key generate a server.csr: 1. According to the server.key generate a server.csr:
openssl req -new -key server.key -subj "/CN=${MASTER_IP}" -out server.csr openssl req -new -key server.key -subj "/CN=${MASTER_IP}" -out server.csr
1. According to the ca.key, ca.crt and server.csr generate the server.crt: 1. According to the ca.key, ca.crt and server.csr generate the server.crt:
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000
1. View the certificate. 1. View the certificate.
openssl x509 -noout -text -in ./server.crt openssl x509 -noout -text -in ./server.crt
Finally, do not forget to fill out and add the same parameters into the API server start parameters. Finally, do not forget to fill out and add the same parameters into the API server start parameters.