Revise certificates documentation (#5965)

2017-10-21 02:57:36 +08:00
parent 7559e9a53d
commit 87b358e6c4
4 changed files with 262 additions and 75 deletions
@@ -82,7 +82,7 @@ openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj "/CN=jbeda/O=app1/O=app

 This would create a CSR for the username "jbeda", belonging to two groups, "app1" and "app2".

-See [APPENDIX](#appendix) for how to generate a client cert.
+See [Managing Certificates](/docs/concepts/cluster-administration/certificates/) for how to generate a client cert.

 ### Static Token File

@@ -696,78 +696,4 @@ rules:

 ## APPENDIX

-### Creating Certificates

-When using client certificate authentication, you can generate certificates
-using an existing deployment script or manually through `easyrsa` or `openssl.`
-
-#### Using an Existing Deployment Script
-
-**Using an existing deployment script** is implemented at
-`cluster/saltbase/salt/generate-cert/make-ca-cert.sh`.
-
-Execute this script with two parameters. The first is the IP address
-of API server. The second is a list of subject alternate names in the form `IP:<ip-address> or DNS:<dns-name>`.
-
-The script will generate three files: `ca.crt`, `server.crt`, and `server.key`.
-
-Finally, add the following parameters into API server start parameters:
-
- `--client-ca-file=/srv/kubernetes/ca.crt`
- `--tls-cert-file=/srv/kubernetes/server.crt`
- `--tls-private-key-file=/srv/kubernetes/server.key`
-
-#### easyrsa
-
-**easyrsa** can be used to manually generate certificates for your cluster.
-
-1.  Download, unpack, and initialize the patched version of easyrsa3.
-
-        curl -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
-        tar xzf easy-rsa.tar.gz
-        cd easy-rsa-master/easyrsa3
-        ./easyrsa init-pki
-1.  Generate a CA. (`--batch` set automatic mode. `--req-cn` default CN to use.)
-
-        ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass
-1.  Generate server certificate and key.
-    (build-server-full [filename]: Generate a keypair and sign locally for a client or server.)
-
-        ./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full server nopass
-1.  Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory.
-1.  Fill in and add the following parameters into the API server start parameters:
-
-        --client-ca-file=/yourdirectory/ca.crt
-        --tls-cert-file=/yourdirectory/server.crt
-        --tls-private-key-file=/yourdirectory/server.key
-
-#### openssl
-
-**openssl** can also be used to manually generate certificates for your cluster.
-
-1.  Generate a ca.key with 2048bit:
-
-        openssl genrsa -out ca.key 2048
-1.  According to the ca.key generate a ca.crt (use -days to set the certificate effective time):
-
-        openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
-1.  Generate a server.key with 2048bit:
-
-        openssl genrsa -out server.key 2048
-1.  According to the server.key generate a server.csr:
-
-        openssl req -new -key server.key -subj "/CN=${MASTER_IP}" -out server.csr
-1.  According to the ca.key, ca.crt and server.csr generate the server.crt:
-
-        openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000
-1.  View the certificate.
-
-        openssl x509  -noout -text -in ./server.crt
-
-Finally, do not forget to fill out and add the same parameters into the API server start parameters.
-
-#### Certificates API
-
-You can use the `certificates.k8s.io` API to provision
-x509 certificates to use for authentication as documented
-[here](/docs/tasks/tls/managing-tls-in-a-cluster).