Karen Bradshaw
391 lines
16 KiB
Markdown
391 lines
16 KiB
Markdown
---
|
||
reviewers:
|
||
- sig-cluster-lifecycle
|
||
title: 使用 kubeadm 进行证书管理
|
||
content_type: task
|
||
---
|
||
<!--
|
||
---
|
||
reviewers:
|
||
- sig-cluster-lifecycle
|
||
title: Certificate Management with kubeadm
|
||
content_type: task
|
||
---
|
||
-->
|
||
|
||
<!-- overview -->
|
||
|
||
{{< feature-state for_k8s_version="v1.15" state="stable" >}}
|
||
|
||
<!--
|
||
Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) expire after 1 year. This page explains how to manage certificate renewals with kubeadm.
|
||
-->
|
||
|
||
由 [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) 生成的客户端证书在 1 年后到期。 本页说明如何使用 kubeadm 管理证书续订。
|
||
|
||
|
||
|
||
## {{% heading "prerequisites" %}}
|
||
|
||
|
||
<!--
|
||
Be familiar with [PKI certificates and requirements in Kubernetes](/docs/setup/certificates/).
|
||
-->
|
||
|
||
熟悉 [Kubernetes 中的 PKI证书和要求](/docs/setup/certificates/)。
|
||
|
||
<!--
|
||
You should be familiar with [PKI certificates and requirements in Kubernetes](/docs/setup/best-practices/certificates/).
|
||
-->
|
||
您应该熟悉[Kubernetes 中的 PKI 证书和要求](/docs/setup/best-practices/certificates/)。
|
||
|
||
|
||
|
||
<!-- steps -->
|
||
|
||
<!--
|
||
## Check certificate expiration
|
||
-->
|
||
|
||
## 检查证书是否过期
|
||
|
||
<!--
|
||
`check-expiration` can be used to check certificate expiration.
|
||
-->
|
||
|
||
`check-expiration` 能被用来检查证书是否过期
|
||
|
||
```
|
||
kubeadm alpha certs check-expiration
|
||
```
|
||
|
||
<!--
|
||
The output is similar to this:
|
||
-->
|
||
|
||
输出类似于以下内容：
|
||
|
||
```
|
||
CERTIFICATE EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
|
||
admin.conf May 15, 2020 13:03 UTC 364d false
|
||
apiserver May 15, 2020 13:00 UTC 364d false
|
||
apiserver-etcd-client May 15, 2020 13:00 UTC 364d false
|
||
apiserver-kubelet-client May 15, 2020 13:00 UTC 364d false
|
||
controller-manager.conf May 15, 2020 13:03 UTC 364d false
|
||
etcd-healthcheck-client May 15, 2020 13:00 UTC 364d false
|
||
etcd-peer May 15, 2020 13:00 UTC 364d false
|
||
etcd-server May 15, 2020 13:00 UTC 364d false
|
||
front-proxy-client May 15, 2020 13:00 UTC 364d false
|
||
scheduler.conf May 15, 2020 13:03 UTC 364d false
|
||
```
|
||
|
||
<!--
|
||
The command shows expiration/residual time for the client certificates in the `/etc/kubernetes/pki` folder and for the client certificate embedded in the KUBECONFIG files used by kubeadm (`admin.conf`, `controller-manager.conf` and `scheduler.conf`).
|
||
-->
|
||
|
||
该命令显示 `/etc/kubernetes/pki` 文件夹中的客户端证书以及 kubeadm 使用的 KUBECONFIG 文件中嵌入的客户端证书的到期时间/剩余时间。
|
||
|
||
<!--
|
||
Additionally, kubeadm informs the user if the certificate is externally managed; in this case, the user should take care of managing certificate renewal manually/using other tools.
|
||
-->
|
||
|
||
另外， kubeadm 会通知用户证书是否由外部管理； 在这种情况下，用户应该小心的手动/使用其他工具来管理证书更新。
|
||
|
||
{{< warning >}}
|
||
<!--
|
||
`kubeadm` cannot manage certificates signed by an external CA.
|
||
-->`kubeadm` 不能管理由外部 CA 签名的证书
|
||
{{< /warning >}}
|
||
|
||
{{< note >}}
|
||
<!--
|
||
`kubelet.conf` is not included in the list above because kubeadm configures kubelet for automatic certificate renewal.
|
||
-->上面的列表中没有包含 `kubelet.conf` 因为 kubeadm 将 kubelet 配置为自动更新证书。
|
||
|
||
{{< /note >}}
|
||
|
||
<!--
|
||
## Automatic certificate renewal
|
||
-->
|
||
## 自动更新证书
|
||
|
||
<!--
|
||
`kubeadm` renews all the certificates during control plane [upgrade](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-15/).
|
||
-->
|
||
`kubeadm` 会在控制面板[升级](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-15/)的时候更新所有证书
|
||
|
||
<!--
|
||
This feature is designed for addressing the simplest use cases;
|
||
if you don't have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.
|
||
-->
|
||
这个功能旨在解决最简单的用例；如果您对此类证书的更新没有特殊要求，并且定期执行 Kubernetes 版本升级（每次升级之间的间隔时间少于 1 年），则 kubeadm 将确保您的集群保持最新状态并保持合理的安全性。
|
||
|
||
{{< note >}}
|
||
<!--
|
||
It is a best practice to upgrade your cluster frequently in order to stay secure.
|
||
-->最佳的做法是经常升级集群以确保安全。
|
||
{{< /note >}}
|
||
|
||
<!--
|
||
If you have more complex requirements for certificate renewal, you can opt out from the default behavior by passing `--certificate-renewal=false` to `kubeadm upgrade apply` or to `kubeadm upgrade node`.
|
||
-->
|
||
|
||
如果您对证书更新有更复杂的需求，则可通过将 `--certificate-renewal=false` 传递给 `kubeadm upgrade apply` 或者 `kubeadm upgrade node` ，从而选择不采用默认行为。
|
||
|
||
<!--
|
||
## Manual certificate renewal
|
||
-->
|
||
## 手动更新证书
|
||
|
||
<!--
|
||
You can renew your certificates manually at any time with the `kubeadm alpha certs renew` command.
|
||
-->
|
||
您能随时通过 `kubeadm alpha certs renew` 命令手动更新您的证书。
|
||
|
||
<!--
|
||
This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`.
|
||
-->
|
||
|
||
这个命令用 CA （或者 front-proxy-CA ）证书和存储在 `/etc/kubernetes/pki` 中的密钥执行更新。
|
||
|
||
{{< warning >}}
|
||
<!--
|
||
If you are running an HA cluster, this command needs to be executed on all the control-plane nodes.
|
||
-->如果您运行了一个 HA 集群，这个命令需要在所有控制面板节点上执行。
|
||
{{< /warning >}}
|
||
|
||
{{< note >}}
|
||
<!-- `alpha certs renew` uses the existing certificates as the authoritative source for attributes (Common Name, Organization, SAN, etc.) instead of the kubeadm-config ConfigMap. It is strongly recommended to keep them both in sync. -->
|
||
`alpha certs renew` 使用现有的证书作为属性 (Common Name、Organization、SAN 等) 的权威来源，而不是 kubeadm-config ConfigMap 。强烈建议使它们保持同步。
|
||
{{< /note >}}
|
||
|
||
<!--
|
||
`kubeadm alpha certs renew` provides the following options:
|
||
-->
|
||
`kubeadm alpha certs renew` 提供下列选项
|
||
|
||
<!--
|
||
The Kubernetes certificates normally reach their expiration date after one year.
|
||
-->
|
||
Kubernetes 证书通常在一年后到期。
|
||
|
||
<!--
|
||
- `--csr-only` can be used to renew certificats with an external CA by generating certificate signing requests (without actually renewing certificates in place); see next paragraph for more information.
|
||
-->
|
||
|
||
- `--csr-only` 可用于经过一个外部 CA 生成的证书签名请求来更新证书（无需实际替换更新证书）；更多信息请参见下一段。
|
||
|
||
<!--
|
||
- It's also possible to renew a single certificate instead of all.
|
||
-->
|
||
- 也可以更新单个证书而不是全部证书。
|
||
|
||
<!--
|
||
## Renew certificates with the Kubernetes certificates API
|
||
-->
|
||
## 用 Kubernetes 证书 API 更新证书
|
||
|
||
<!--
|
||
This section provide more details about how to execute manual certificate renewal using the Kubernetes certificates API.
|
||
-->
|
||
|
||
本节提供有关如何使用 Kubernetes 证书 API 执行手动证书更新的更多详细信息。
|
||
|
||
{{< caution >}}
|
||
<!--
|
||
These are advanced topics for users who need to integrate their organization's certificate infrastructure into a kubeadm-built cluster. If the default kubeadm configuration satisfies your needs, you should let kubeadm manage certificates instead.
|
||
-->
|
||
这些是针对需要将其组织的证书基础结构集成到 kubeadm 构建的集群中的用户的高级主题。如果默认的 kubeadm 配置满足了您的需求，则应让 kubeadm 管理证书。
|
||
{{< /caution >}}
|
||
|
||
<!--
|
||
### Set up a signer
|
||
-->
|
||
### 设置一个签名者
|
||
|
||
<!--
|
||
The Kubernetes Certificate Authority does not work out of the box.
|
||
You can configure an external signer such as [cert-manager][cert-manager-issuer], or you can use the build-in signer.
|
||
The built-in signer is part of [`kube-controller-manager`][kcm].
|
||
To activate the build-in signer, you pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` arguments.
|
||
-->
|
||
Kubernetes 证书颁发机构不是开箱即用。
|
||
您可以配置外部签名者，例如 [cert-manager][cert-manager-issuer] ，也可以使用内置签名者。
|
||
内置签名者是 [`kube-controller-manager`][kcm] 的一部分。
|
||
要激活内置签名者，请传递`--cluster-signing-cert-file` 和 `--cluster-signing-key-file`参数。
|
||
|
||
<!--
|
||
The built-in signer is part of [`kube-controller-manager`][kcm].
|
||
-->
|
||
这个内置签名者是 [`kube-controller-manager`][kcm] 的一部分。
|
||
|
||
<!-- To activate the build-in signer, you must pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` flags. -->
|
||
要激活内置签名者，必须传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。
|
||
|
||
<!--
|
||
If you're creating a new cluster, you can use a kubeadm [configuration file][config]:
|
||
-->
|
||
如果您正在正在创建一个新的集群，您可以使用 kubeadm 的 [配置文件](config)
|
||
|
||
```yaml
|
||
apiVersion: kubeadm.k8s.io/v1beta2
|
||
kind: ClusterConfiguration
|
||
controllerManager:
|
||
extraArgs:
|
||
cluster-signing-cert-file: /etc/kubernetes/pki/ca.crt
|
||
cluster-signing-key-file: /etc/kubernetes/pki/ca.key
|
||
```
|
||
|
||
[cert-manager-issuer]: https://cert-manager.readthedocs.io/en/latest/tutorials/ca/creating-ca-issuer.html
|
||
[kcm]: /docs/reference/command-line-tools-reference/kube-controller-manager/
|
||
[config]: https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2
|
||
|
||
<!--
|
||
### Create certificate signing requests (CSR)
|
||
-->
|
||
### 创建证书签名请求 (CSR)
|
||
|
||
<!--
|
||
You can create the certificate signing requests for the Kubernetes certificates API with `kubeadm alpha certs renew --use-api`.
|
||
-->
|
||
您能用 `kubeadm alpha certs renew --use-api` 为 Kubernetes 证书 API 创建一个证书签名请求。
|
||
|
||
<!--
|
||
If you set up an external signer such as [cert-manager][cert-manager], certificate signing requests (CSRs) are automatically approved.
|
||
Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command.
|
||
The following kubeadm command outputs the name of the certificate to approve, then blocks and waits for approval to occur:
|
||
-->
|
||
如果您设置例如 [cert-manager][cert-manager] 等外部签名者，则会自动批准证书签名请求（CSRs）。
|
||
否者，您必须使用 [`kubectl certificate`][certs] 命令手动批准证书。
|
||
以下 kubeadm 命令输出要批准的证书名称，然后缓慢等待批准发生：
|
||
|
||
```shell
|
||
sudo kubeadm alpha certs renew apiserver --use-api &
|
||
```
|
||
<!--
|
||
The output is similar to this:
|
||
-->
|
||
输出类似于以下内容：
|
||
```
|
||
[1] 2890
|
||
[certs] certificate request "kubeadm-cert-kube-apiserver-ld526" created
|
||
```
|
||
|
||
<!--
|
||
### Approve certificate signing requests (CSR)
|
||
-->
|
||
### 批准证书签名请求 (CSR)
|
||
|
||
<!--
|
||
If you set up an external signer, certificate signing requests (CSRs) are automatically approved.
|
||
-->
|
||
如果您设置了一个外部签名者， 证书签名请求 (CSRs) 会自动被批准。
|
||
|
||
<!-- Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command. e.g. -->
|
||
否则，您必须用 [`kubectl certificate`][certs] 命令手动批准证书，例如
|
||
|
||
```shell
|
||
kubectl certificate approve kubeadm-cert-kube-apiserver-ld526
|
||
```
|
||
<!--
|
||
The output is similar to this:
|
||
-->
|
||
输出类似于以下内容：
|
||
```shell
|
||
certificatesigningrequest.certificates.k8s.io/kubeadm-cert-kube-apiserver-ld526 approved
|
||
```
|
||
|
||
<!--
|
||
You can view a list of pending certificates with `kubectl get csr`.
|
||
-->
|
||
您可以使用 `kubectl get csr` 查看待处理证书列表。
|
||
|
||
<!--
|
||
## Renew certificates with external CA
|
||
-->
|
||
## 通过外部 CA 更新证书
|
||
|
||
<!--
|
||
This section provide more details about how to execute manual certificate renewal using an external CA.
|
||
-->
|
||
本节提供有关如何使用外部 CA 执行手动更新证书的更多详细信息。
|
||
|
||
<!--
|
||
To better integrate with external CAs, kubeadm can also produce certificate signing requests (CSRs).
|
||
A CSR represents a request to a CA for a signed certificate for a client.
|
||
In kubeadm terms, any certificate that would normally be signed by an on-disk CA can be produced as a CSR instead. A CA, however, cannot be produced as a CSR.
|
||
-->
|
||
为了更好的与外部 CA 集成，kubeadm 还可以生成证书签名请求（CSR）。
|
||
CSR 表示向 CA 请求客户的签名证书。
|
||
在 kubeadm 术语中，通常由磁盘 CA 签名的任何证书都可以作为 CSR 生成。但是，CA 不能作为 CSR 生成。
|
||
|
||
<!--
|
||
### Create certificate signing requests (CSR)
|
||
-->
|
||
### 创建证书签名请求 (CSR)
|
||
|
||
<!--
|
||
You can pass in a directory with `--csr-dir` to output the CSRs to the specified location.
|
||
If `--csr-dir` is not specified, the default certificate directory (`/etc/kubernetes/pki`) is used.
|
||
Both the CSR and the accompanying private key are given in the output. After a certificate is signed, the certificate and the private key must be copied to the PKI directory (by default `/etc/kubernetes/pki`).
|
||
-->
|
||
您可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。
|
||
如果未指定 `--csr-dir` ，则使用默认证书目录( `/etc/kubernetes/pki` )。
|
||
CSR 和随附的私钥都在输出中给出。签署证书后，必须将证书和私钥复制到 PKI 目录（默认情况下为 `/etc/kubernetes/pki`）。
|
||
|
||
<!--
|
||
A CSR represents a request to a CA for a signed certificate for a client.
|
||
-->
|
||
CSR 代表对 CA 的请求，要求获得客户端的签名证书。
|
||
|
||
<!--
|
||
You can create certificate signing requests with `kubeadm alpha certs renew --csr-only`.
|
||
-->
|
||
您能用 `kubeadm alpha certs renew --csr-only` 创建一个证书签名请求。
|
||
|
||
<!--
|
||
Both the CSR and the accompanying private key are given in the output; you can pass in a directory with `--csr-dir` to output the CSRs to the specified location.
|
||
-->
|
||
输出中给出了 CSR 和随附的私钥；您可以输入目录名和 `--csr-dir` ，以将 CSR 输出到指定位置。
|
||
|
||
<!--
|
||
Certificates can be renewed with `kubeadm alpha certs renew --csr-only`.
|
||
As with `kubeadm init`, an output directory can be specified with the `--csr-dir` flag.
|
||
To use the new certificates, copy the signed certificate and private key into the PKI directory (by default `/etc/kubernetes/pki`)
|
||
-->
|
||
证书能用 `kubeadm alpha certs renew --csr-only` 更新。
|
||
|
||
在 `kubeadm init` ,通过 `--csr-dir` 能指定输出文件夹。
|
||
|
||
要使用新证书，请将签名的证书和私钥复制到 PKI 目录（默认情况下为 `/etc/kubernetes/pki` ）
|
||
|
||
<!--
|
||
A CSR contains a certificate's name, domain(s), and IPs, but it does not specify usages.
|
||
-->
|
||
一个 CSR 包含一个证书的名字，域和 IP， 但是未指定用法
|
||
|
||
<!--
|
||
It is the responsibility of the CA to specify [the correct cert usages][cert-table] when issuing a certificate.
|
||
-->
|
||
颁发证书时， CA 有责任指定[正确的证书用法][cert-table] 。
|
||
|
||
<!--
|
||
* In `openssl` this is done with the [`openssl ca` command][openssl-ca].
|
||
* In `cfssl` you specify [usages in the config file][cfssl-usages]
|
||
-->
|
||
* 在 `openssl` 中，这是通过 [`openssl ca` 命令][openssl-ca] 完成的。
|
||
* 在 `cfssl` 中，这是通过 [在配置文件中指定用法][cfssl-usages] 来完成的。
|
||
|
||
<!--
|
||
After a certificate is signed using your preferred method, the certificate and the private key must be copied to the PKI directory (by default `/etc/kubernetes/pki`).
|
||
-->
|
||
使用首选方法对证书签名后，必须将证书和私钥复制到 PKI 目录（默认为 `/etc/kubernetes/pki` ）。
|
||
|
||
|
||
[openssl-ca]: https://superuser.com/questions/738612/openssl-ca-keyusage-extension
|
||
[cfssl-usages]: https://github.com/cloudflare/cfssl/blob/master/doc/cmd/cfssl.txt#L170
|
||
[certs]: /docs/setup/best-practices/certificates/
|
||
[cert-cas]: /docs/setup/best-practices/certificates/#single-root-ca
|
||
[cert-table]: /docs/setup/best-practices/certificates/#all-certificates
|
||
|