mirrors/kubernetes-the-hard-way
1
0
Fork 0
mirror of https://github.com/kelseyhightower/kubernetes-the-hard-way.git synced 2025-12-16 01:38:58 +03:00
Code Issues Projects Releases Wiki Activity

clean up smoke test chapter

Browse Source
This commit is contained in:
Xander Grzywinski
2019-05-30 11:28:54 -07:00
parent 37b6d498d9
commit c2aed5eeba
4 changed files with 35 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
docs/04-certificate-authority.md
View File

@@ -9,8 +9,6 @@ In this section you will provision a Certificate Authority that can be used to g
Generate the CA configuration file, certificate, and private key:
```
{
cat > ca-config.json <<EOF
{
"signing": {
@@ -47,8 +45,6 @@ cat > ca-csr.json <<EOF
EOF
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
}
```
Results:
@@ -67,8 +63,6 @@ In this section you will generate client and server certificates for each Kubern
Generate the `admin` client certificate and private key:
```
{
cat > admin-csr.json <<EOF
{
"CN": "admin",
@@ -87,15 +81,14 @@ cat > admin-csr.json <<EOF
]
}
EOF
```
```
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=kubernetes \
admin-csr.json | cfssljson -bare admin
}
```
Results:
@@ -133,7 +126,6 @@ cat > ${instance}-csr.json <<EOF
EOF
EXTERNAL_IP=$(az vm show --show-details -g kubernetes-the-hard-way -n ${instance} --output tsv | cut -f19)
INTERNAL_IP=$(az vm show --show-details -g kubernetes-the-hard-way -n ${instance} --output tsv | cut -f16)
cfssl gencert \
@@ -162,8 +154,6 @@ worker-2.pem
Generate the `kube-controller-manager` client certificate and private key:
```
{
cat > kube-controller-manager-csr.json <<EOF
{
"CN": "system:kube-controller-manager",
@@ -181,16 +171,14 @@ cat > kube-controller-manager-csr.json <<EOF
}
]
}
EOF
```
```
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=kubernetes \
kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager
}
```
Results:
@@ -206,8 +194,6 @@ kube-controller-manager.pem
Generate the `kube-proxy` client certificate and private key:
```
{
cat > kube-proxy-csr.json <<EOF
{
"CN": "system:kube-proxy",
@@ -226,15 +212,14 @@ cat > kube-proxy-csr.json <<EOF
]
}
EOF
```
```
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=kubernetes \
kube-proxy-csr.json | cfssljson -bare kube-proxy
}
```
Results:
@@ -249,8 +234,6 @@ kube-proxy.pem
Generate the `kube-scheduler` client certificate and private key:
```
{
cat > kube-scheduler-csr.json <<EOF
{
"CN": "system:kube-scheduler",
@@ -269,15 +252,14 @@ cat > kube-scheduler-csr.json <<EOF
]
}
EOF
```
```
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=kubernetes \
kube-scheduler-csr.json | cfssljson -bare kube-scheduler
}
```
Results:
@@ -295,8 +277,6 @@ The `kubernetes-the-hard-way` static IP address will be included in the list of
Generate the Kubernetes API Server certificate and private key:
```
{
KUBERNETES_PUBLIC_ADDRESS=$(az network public-ip show -g kubernetes-the-hard-way -n kubernetes-the-hard-way-ip --output tsv | cut -f6)
cat > kubernetes-csr.json <<EOF
@@ -317,7 +297,8 @@ cat > kubernetes-csr.json <<EOF
]
}
EOF
```
```
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
@@ -325,8 +306,6 @@ cfssl gencert \
-hostname=10.32.0.1,10.240.0.10,10.240.0.11,10.240.0.12,${KUBERNETES_PUBLIC_ADDRESS},127.0.0.1,kubernetes.default \
-profile=kubernetes \
kubernetes-csr.json | cfssljson -bare kubernetes
}
```
Results:
@@ -343,8 +322,6 @@ The Kubernetes Controller Manager leverages a key pair to generate and sign serv
Generate the `service-account` certificate and private key:
```
{
cat > service-account-csr.json <<EOF
{
"CN": "service-accounts",
@@ -363,15 +340,14 @@ cat > service-account-csr.json <<EOF
]
}
EOF
```
```
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=kubernetes \
service-account-csr.json | cfssljson -bare service-account
}
```
Results: