chg: Hostnames In Documentation Continued

Updated more places where the hostnames were not updated to reflect the new
hostnames for the jumpbox, controller, and worker nodes.
pull/882/head
Khalifah Shabazz 2025-06-01 22:59:11 -04:00
parent 7945e68d92
commit 2789e8ce42
5 changed files with 25 additions and 16 deletions

12
ca.conf
View File

@ -165,12 +165,12 @@ L = Redford
# from the address range (`10.32.0.0/24`) reserved for internal cluster
# services.
[kube-api-server]
distinguished_name = kube-api-server_distinguished_name
[kube-apiserver]
distinguished_name = kube-apiserver_distinguished_name
prompt = no
req_extensions = kube-api-server_req_extensions
req_extensions = kube-apiserver_req_extensions
[kube-api-server_req_extensions]
[kube-apiserver_req_extensions]
basicConstraints = CA:FALSE
extendedKeyUsage = clientAuth, serverAuth
keyUsage = critical, digitalSignature, keyEncipherment
@ -179,7 +179,7 @@ nsComment = "Kube API Server Certificate"
subjectAltName = @kube-api-server_alt_names
subjectKeyIdentifier = hash
[kube-api-server_alt_names]
[kube-apiserver_alt_names]
IP.0 = 127.0.0.1
IP.1 = 10.32.0.1
DNS.0 = kubernetes
@ -190,7 +190,7 @@ DNS.4 = kubernetes.svc.cluster.local
DNS.5 = controlplane.kubernetes.local
DNS.6 = api-server.kubernetes.local
[kube-api-server_distinguished_name]
[kube-apiserver_distinguished_name]
CN = kubernetes
C = US
ST = Michigan

View File

@ -1,10 +1,19 @@
# Provisioning a CA and Generating TLS Certificates
In this lab you will provision a [PKI Infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure) using openssl to bootstrap a Certificate Authority, and generate TLS certificates for the following components: kube-apiserver, kube-controller-manager, kube-scheduler, kubelet, and kube-proxy. The commands in this section should be run from the `jumpbox`.
In this lab you will provision a [PKI Infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure) using openssl to
bootstrap a Certificate Authority, and generate TLS certificates for the
following components: kube-apiserver, kube-controller-manager, kube-scheduler,
kubelet, and kube-proxy. The commands in this section should be run from the
`jumpbox`.
## Certificate Authority
In this section you will provision a Certificate Authority that can be used to generate additional TLS certificates for the other Kubernetes components. Setting up CA and generating certificates using `openssl` can be time-consuming, especially when doing it for the first time. To streamline this lab, I've included an openssl configuration file `ca.conf`, which defines all the details needed to generate certificates for each Kubernetes component.
In this section you will provision a Certificate Authority that can be used to
generate additional TLS certificates for the other Kubernetes components.
Setting up CA and generating certificates using `openssl` can be time-consuming,
especially when doing it for the first time. To streamline this lab, I've
included an openssl configuration file `ca.conf`, which defines all the details
needed to generate certificates for each Kubernetes component.
Take a moment to review the `ca.conf` configuration file:

View File

@ -19,7 +19,7 @@ for host in node01 node02; do
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.crt \
--embed-certs=true \
--server=https://server.kubernetes.local:6443 \
--server=https://controlplane.kubernetes.local:6443 \
--kubeconfig=${host}.kubeconfig
kubectl config set-credentials system:node:${host} \
@ -54,7 +54,7 @@ Generate a kubeconfig file for the `kube-proxy` service:
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.crt \
--embed-certs=true \
--server=https://server.kubernetes.local:6443 \
--server=https://controlplane.kubernetes.local:6443 \
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-credentials system:kube-proxy \
@ -88,7 +88,7 @@ Generate a kubeconfig file for the `kube-controller-manager` service:
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.crt \
--embed-certs=true \
--server=https://server.kubernetes.local:6443 \
--server=https://controlplane.kubernetes.local:6443 \
--kubeconfig=kube-controller-manager.kubeconfig
kubectl config set-credentials system:kube-controller-manager \
@ -123,7 +123,7 @@ Generate a kubeconfig file for the `kube-scheduler` service:
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.crt \
--embed-certs=true \
--server=https://server.kubernetes.local:6443 \
--server=https://controlplane.kubernetes.local:6443 \
--kubeconfig=kube-scheduler.kubeconfig
kubectl config set-credentials system:kube-scheduler \

View File

@ -176,7 +176,7 @@ Make a HTTP request for the Kubernetes version info:
```bash
curl --cacert ca.crt \
https://server.kubernetes.local:6443/version
https://controlplane.kubernetes.local:6443/version
```
```text

View File

@ -8,11 +8,11 @@ In this lab you will generate a kubeconfig file for the `kubectl` command line u
Each kubeconfig requires a Kubernetes API Server to connect to.
You should be able to ping `server.kubernetes.local` based on the `/etc/hosts` DNS entry from a previous lab.
You should be able to ping `controlplane.kubernetes.local` based on the `/etc/hosts` DNS entry from a previous lab.
```bash
curl --cacert ca.crt \
https://server.kubernetes.local:6443/version
https://controlplane.kubernetes.local:6443/version
```
```text
@ -36,7 +36,7 @@ Generate a kubeconfig file suitable for authenticating as the `admin` user:
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.crt \
--embed-certs=true \
--server=https://server.kubernetes.local:6443
--server=https://controlplane.kubernetes.local:6443
kubectl config set-credentials admin \
--client-certificate=admin.crt \