mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-24 20:18:18 +00:00
cert updates
This commit is contained in:
Denise Schannon
@@ -0,0 +1,120 @@
|
||||
---
|
||||
title: Certificate Management
|
||||
weight: 150
|
||||
---
|
||||
|
||||
_Available as of v0.2.0_
|
||||
|
||||
Certificates are an important part of Kubernetes clusters and are used for all Kubernetes cluster components. RKE has added a `rke cert` command to help manage these certificates.
|
||||
|
||||
* [Ability to generate certificate sign requests for the Kubernetes components](#generating-certificate-signing-requests-csrs-and-keys)
|
||||
* [Rotate Auto-Generated Cluster Certificates](#certifiate-rotation)
|
||||
|
||||
## Generating Certificate Signing Requests (CSRs) and Keys
|
||||
|
||||
If you want to create and sign the certificates by a real Certificate Authority (CA), you can use RKE to [generate a set of Certificate Signing Requests (CSRs) and keys]({{< baseurl >}}/rke/v0.1.x/en/installation/certs/#generating-certificate-signing-requests-csrs-and-keys). Using the `rke cert generate-csr` command, you will be able to generate the CRSs and keys.
|
||||
|
||||
You can use the CSRs and keys to sign the certificates by a real CA. After the certificates are signed, they can be used by RKE to use [custom certificates]({{< baseurl >}}/rke/v0.1.x/en/installation/certs/).
|
||||
|
||||
## Certificate Rotation
|
||||
|
||||
By default, Kubernetes clusters require certificates and RKE will automatically generate certificates for the clusters. When generating certificates, the cluster certificates will automatically expire after 1 year and the CA certificate will expire after 10 years. Before your certificates expire, Rancher recommends rotating the cluster certificates.
|
||||
|
||||
After the certificates are rotated, the Kubernetes components are automatically restarted. Certificates can be rotated for the following Kubernetes cluster components:
|
||||
|
||||
- etcd
|
||||
- kubelet
|
||||
- kube-apiserver
|
||||
- kube-proxy
|
||||
- kube-scheduler
|
||||
- kube-controller-manager
|
||||
|
||||
RKE has the ability to rotate these auto-generated certificates with some simple commands:
|
||||
|
||||
* Rotating Cluster Certificates for All Kubernetes Cluster Components
|
||||
* Rotating Cluster Certificates for a Single Kubernetes Component
|
||||
* Rotating the CA Certificate and Cluster Certificates
|
||||
|
||||
Whenever you're trying to rotate certificates, the `cluster.yml` that was used to deploy the Kubernetes cluster is required. You can reference a different location for this file by using the `--config` option when running `rke cert rotate`.
|
||||
|
||||
|
||||
|
||||
```
|
||||
$ rke cert rotate --help
|
||||
NAME:
|
||||
rke cert rotate - Rotate RKE cluster certificates
|
||||
|
||||
USAGE:
|
||||
rke cert rotate [command options] [arguments...]
|
||||
|
||||
OPTIONS:
|
||||
--config value Specify an alternate cluster YAML file (default: "cluster.yml") [$RKE_CONFIG]
|
||||
--service value Specify a k8s service to rotate certs, (allowed values: kube-apiserver, kube-controller-manager, kube-scheduler, kubelet, kube-proxy, etcd)
|
||||
--rotate-ca Rotate all certificates including CA certs
|
||||
```
|
||||
|
||||
### Rotating Cluster Certificates for All Components
|
||||
|
||||
To rotate the cluster certificates for all the Kubernetes cluster components, run the following command, i.e. `rke cert rotate`. After all the cluster certificates are rotated, the Kubernetes components will automatically be restarted.
|
||||
|
||||
```
|
||||
$ rke cert rotate
|
||||
INFO[0000] Initiating Kubernetes cluster
|
||||
INFO[0000] Rotating Kubernetes cluster certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server certificates
|
||||
INFO[0000] [certificates] Generating Kube Controller certificates
|
||||
INFO[0000] [certificates] Generating Kube Scheduler certificates
|
||||
INFO[0001] [certificates] Generating Kube Proxy certificates
|
||||
INFO[0001] [certificates] Generating Node certificate
|
||||
INFO[0001] [certificates] Generating admin certificates and kubeconfig
|
||||
INFO[0001] [certificates] Generating Kubernetes API server proxy client certificates
|
||||
INFO[0001] [certificates] Generating etcd-xxxxx certificate and key
|
||||
INFO[0001] [certificates] Generating etcd-yyyyy certificate and key
|
||||
INFO[0002] [certificates] Generating etcd-zzzzz certificate and key
|
||||
INFO[0002] Successfully Deployed state file at [./cluster.rkestate]
|
||||
INFO[0002] Rebuilding Kubernetes cluster with rotated certificates
|
||||
.....
|
||||
INFO[0050] [worker] Successfully restarted Worker Plane..
|
||||
```
|
||||
|
||||
### Rotating Cluster Certificates for a Specific Component
|
||||
|
||||
To rotate certificates for individual Kubernetes components, use the `--service` option when rotating certificates to specify which component. As always, the specified Kubernetes component is automatically restarted after the certificate is rotated.
|
||||
|
||||
Example of rotating the certificate for only the `kubelet` component.
|
||||
|
||||
```
|
||||
$ rke cert rotate --service kubelet
|
||||
INFO[0000] Initiating Kubernetes cluster
|
||||
INFO[0000] Rotating Kubernetes cluster certificates
|
||||
INFO[0000] [certificates] Generating Node certificate
|
||||
INFO[0000] Successfully Deployed state file at [./cluster.rkestate]
|
||||
INFO[0000] Rebuilding Kubernetes cluster with rotated certificates
|
||||
.....
|
||||
INFO[0033] [worker] Successfully restarted Worker Plane..
|
||||
```
|
||||
|
||||
### Rotating CA Certificate and all Cluster Certificates
|
||||
|
||||
If the CA certificate needs to be rotated, you are required to rotate all the cluster certificates for all components as they need to be signed with the newly rotated CA certificate. To include rotating the CA certificate with the cluster certificates, add the `--rotate-ca` option. As always, all Kubernetes components are automatically restarted after the certificates are rotated.
|
||||
|
||||
|
||||
```
|
||||
$ rke cert rotate --rotate-ca
|
||||
INFO[0000] Initiating Kubernetes cluster
|
||||
INFO[0000] Rotating Kubernetes cluster certificates
|
||||
INFO[0000] [certificates] Generating CA kubernetes certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server aggregation layer requestheader client CA certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server certificates
|
||||
INFO[0000] [certificates] Generating Kube Controller certificates
|
||||
INFO[0000] [certificates] Generating Kube Scheduler certificates
|
||||
INFO[0000] [certificates] Generating Kube Proxy certificates
|
||||
INFO[0000] [certificates] Generating Node certificate
|
||||
INFO[0001] [certificates] Generating admin certificates and kubeconfig
|
||||
INFO[0001] [certificates] Generating Kubernetes API server proxy client certificates
|
||||
INFO[0001] [certificates] Generating etcd-xxxxx certificate and key
|
||||
INFO[0001] [certificates] Generating etcd-yyyyy certificate and key
|
||||
INFO[0001] [certificates] Generating etcd-zzzzz certificate and key
|
||||
INFO[0001] Successfully Deployed state file at [./cluster.rkestate]
|
||||
INFO[0001] Rebuilding Kubernetes cluster with rotated certificates
|
||||
```
|
||||
@@ -1,180 +0,0 @@
|
||||
---
|
||||
title: Certificate Management
|
||||
weight: 150
|
||||
aliases:
|
||||
- /rke/v0.1.x/en/installation/certificate-management/
|
||||
---
|
||||
|
||||
## Certificate Rotation
|
||||
|
||||
As of v0.2.0, RKE can be used to rotate the cluster certificates. The certificate rotation is one of the subcommands of `./rke cert` command, and can be called with a several options:
|
||||
|
||||
```
|
||||
$ rke cert rotate --help
|
||||
NAME:
|
||||
rke cert rotate - Rotate RKE cluster certificates
|
||||
|
||||
USAGE:
|
||||
rke cert rotate [command options] [arguments...]
|
||||
|
||||
OPTIONS:
|
||||
--config value Specify an alternate cluster YAML file (default: "cluster.yml") [$RKE_CONFIG]
|
||||
--service value Specify a k8s service to rotate certs, (allowed values: kube-apiserver, kube-controller-manager, kube-scheduler, kubelet, kube-proxy, etcd)
|
||||
--rotate-ca Rotate all certificates including CA certs
|
||||
```
|
||||
|
||||
### Certificate rotation for all components
|
||||
|
||||
Certificates can be rotated for the following kubernetes cluster components:
|
||||
|
||||
- etcd
|
||||
- kubelet
|
||||
- kube-apiserver
|
||||
- kube-proxy
|
||||
- kube-scheduler
|
||||
- kube-controller-manager
|
||||
|
||||
To rotate the certificates for all the components listed above, run the following command:
|
||||
|
||||
```
|
||||
$ rke cert rotate
|
||||
INFO[0000] Initiating Kubernetes cluster
|
||||
INFO[0000] Rotating Kubernetes cluster certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server certificates
|
||||
INFO[0000] [certificates] Generating Kube Controller certificates
|
||||
INFO[0000] [certificates] Generating Kube Scheduler certificates
|
||||
INFO[0001] [certificates] Generating Kube Proxy certificates
|
||||
INFO[0001] [certificates] Generating Node certificate
|
||||
INFO[0001] [certificates] Generating admin certificates and kubeconfig
|
||||
INFO[0001] [certificates] Generating Kubernetes API server proxy client certificates
|
||||
INFO[0001] [certificates] Generating etcd-xxxxx certificate and key
|
||||
INFO[0001] [certificates] Generating etcd-yyyyy certificate and key
|
||||
INFO[0002] [certificates] Generating etcd-zzzzz certificate and key
|
||||
INFO[0002] Successfully Deployed state file at [./cluster.rkestate]
|
||||
INFO[0002] Rebuilding Kubernetes cluster with rotated certificates
|
||||
.....
|
||||
INFO[0050] [worker] Successfully restarted Worker Plane..
|
||||
```
|
||||
|
||||
The command will rotate all the certificates followed by the kubernetes components restart. This way they can start working with the new rotated certificates.
|
||||
|
||||
|
||||
### Certificate rotation for specific component
|
||||
|
||||
To rotate certificates for an individual component, use `--service` option. The example below triggers cert rotation for a kubelet component:
|
||||
|
||||
```
|
||||
$ rke cert rotate --service kubelet
|
||||
INFO[0000] Initiating Kubernetes cluster
|
||||
INFO[0000] Rotating Kubernetes cluster certificates
|
||||
INFO[0000] [certificates] Generating Node certificate
|
||||
INFO[0000] Successfully Deployed state file at [./cluster.rkestate]
|
||||
INFO[0000] Rebuilding Kubernetes cluster with rotated certificates
|
||||
.....
|
||||
INFO[0033] [worker] Successfully restarted Worker Plane..
|
||||
```
|
||||
|
||||
### Certificate rotation for CA
|
||||
|
||||
To rotate Kubernetes CA certificate, use `--rotate-ca` option.Note that rotating this certificate will trigger rotating all components' certificates as they need to be signed with the new rotated CA:
|
||||
```
|
||||
$ rke cert rotate --rotate-ca
|
||||
INFO[0000] Initiating Kubernetes cluster
|
||||
INFO[0000] Rotating Kubernetes cluster certificates
|
||||
INFO[0000] [certificates] Generating CA kubernetes certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server aggregation layer requestheader client CA certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server certificates
|
||||
INFO[0000] [certificates] Generating Kube Controller certificates
|
||||
INFO[0000] [certificates] Generating Kube Scheduler certificates
|
||||
INFO[0000] [certificates] Generating Kube Proxy certificates
|
||||
INFO[0000] [certificates] Generating Node certificate
|
||||
INFO[0001] [certificates] Generating admin certificates and kubeconfig
|
||||
INFO[0001] [certificates] Generating Kubernetes API server proxy client certificates
|
||||
INFO[0001] [certificates] Generating etcd-xxxxx certificate and key
|
||||
INFO[0001] [certificates] Generating etcd-yyyyy certificate and key
|
||||
INFO[0001] [certificates] Generating etcd-zzzzz certificate and key
|
||||
INFO[0001] Successfully Deployed state file at [./cluster.rkestate]
|
||||
INFO[0001] Rebuilding Kubernetes cluster with rotated certificates
|
||||
```
|
||||
|
||||
## Custom Certificates
|
||||
|
||||
By default RKE auto generates the certificates for all the cluster components. As of v0.2.0, RKE can be configured to use custom certificates. To use custom certificates, use the following option with any rke operation:
|
||||
|
||||
```
|
||||
$ rke up --custom-certs
|
||||
```
|
||||
This option will make RKE use the certificates from a certificate directory `./cluster_certs`. To change the default certificate directly, pass `--cert-dir` flag to the command.
|
||||
|
||||
The following certificates must exist in the certificate directory:
|
||||
|
||||
| Name | Cert | Key | Optional |
|
||||
|:--------------------------:|:-----------------------------------:|:---------------------------------------:|:--------:|
|
||||
| Master CA | kube-ca.pem | - | false |
|
||||
| Kube API | kube-apiserver.pem | kube-apiserver-key.pem | false |
|
||||
| Kube Controller Manager | kube-controller-manager.pem | kube-controller-manager-key.pem | false |
|
||||
| Kube Scheduler | kube-scheduler.pem | kube-scheduler-key.pem | false |
|
||||
| Kube Proxy | kube-proxy.pem | kube-proxy-key.pem | false |
|
||||
| Kube Admin | kube-admin.pem | kube-admin-key.pem | false |
|
||||
| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem | true |
|
||||
| Apiserver Proxy Client | kube-apiserver-proxy-client.pem | kube-apiserver-proxy-client-key.pem | false |
|
||||
| Etcd Nodes | kube-etcd-x-x-x-x.pem | kube-etcd-x-x-x-x-key.pem | false |
|
||||
| Service Account Token | - | kube-service-account-token-key.pem | true |
|
||||
|
||||
The next section of the doc goes over the process of custom certificates generation.
|
||||
|
||||
|
||||
### CSR Generation
|
||||
|
||||
If you want to create and sign the certificates by a real Certificate Authority (CA), you can use rke to generate a set of Certificate Signing Requests (CSRs) and Keys. Here is an example on how to generate CSRs for one node cluster:
|
||||
|
||||
```
|
||||
nodes:
|
||||
- address: x.x.x.x
|
||||
hostname_override: node-1
|
||||
user: ubuntu
|
||||
role: [controlplane,etcd,worker]
|
||||
```
|
||||
|
||||
Run the following command:
|
||||
```
|
||||
$ rke cert generate-csr
|
||||
INFO[0000] Generating Kubernetes cluster CSR certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server csr
|
||||
INFO[0000] [certificates] Generating Kube Controller csr
|
||||
INFO[0000] [certificates] Generating Kube Scheduler csr
|
||||
INFO[0000] [certificates] Generating Kube Proxy csr
|
||||
INFO[0001] [certificates] Generating Node csr and key
|
||||
INFO[0001] [certificates] Generating admin csr and kubeconfig
|
||||
INFO[0001] [certificates] Generating Kubernetes API server proxy client csr
|
||||
INFO[0001] [certificates] Generating etcd-x.x.x.x csr and key
|
||||
INFO[0001] Successfully Deployed certificates at [./cluster_certs]
|
||||
```
|
||||
The CSRs and keys will be deployed in `./cluster_certs` directory by default. To use a different directory, pass `--cert-dir` option.
|
||||
|
||||
```
|
||||
$ tree cluster_certs
|
||||
|
||||
cluster_certs
|
||||
├── kube-admin-csr.pem
|
||||
├── kube-admin-key.pem
|
||||
├── kube-apiserver-csr.pem
|
||||
├── kube-apiserver-key.pem
|
||||
├── kube-apiserver-proxy-client-csr.pem
|
||||
├── kube-apiserver-proxy-client-key.pem
|
||||
├── kube-controller-manager-csr.pem
|
||||
├── kube-controller-manager-key.pem
|
||||
├── kube-etcd-x-x-x-x-csr.pem
|
||||
├── kube-etcd-x-x-x-x-key.pem
|
||||
├── kube-node-csr.pem
|
||||
├── kube-node-key.pem
|
||||
├── kube-proxy-csr.pem
|
||||
├── kube-proxy-key.pem
|
||||
├── kube-scheduler-csr.pem
|
||||
└── kube-scheduler-key.pem
|
||||
|
||||
0 directories, 16 files
|
||||
|
||||
```
|
||||
|
||||
These CSR files will contain the right Alternative DNS and IP Names for the certificates. You can use them then to sign the certificates by a real CA, and then upload to the cluster_certs directory for rke use.
|
||||
@@ -109,6 +109,12 @@ The last line should read `Finished building Kubernetes cluster successfully` to
|
||||
|
||||
> **Note:** If you have used a different file name from `cluster.yml`, then the kube config file will be named `kube_config_<FILE_NAME>.yml`.
|
||||
|
||||
### Certificates
|
||||
|
||||
_Available as of v0.2.0_
|
||||
|
||||
By default, RKE auto-generates the certificates for all cluster components. You can also use [custom certificates]({{< baseurl >}}/rke/v0.1.x/en/installation/certs/). After the Kubernetes cluster is deployed, you can [manage the auto-generated certificates]({{< baseurl >}}/rke/v0.1.x/en/cert-mgmt/).
|
||||
|
||||
### Kubernetes Cluster State
|
||||
|
||||
The Kubernetes cluster state, which consists of the cluster configuration file `cluster.yml` and components certificates in Kubernetes cluster, is saved by RKE, but depending on your RKE version, the cluster state is saved differently.
|
||||
@@ -125,24 +131,11 @@ $ tree -L 1
|
||||
|
||||
Prior to v0.2.0, RKE saved the Kubernetes cluster state as a secret. When updating the state, RKE pulls the secret, updates/changes the state and saves a new secret.
|
||||
|
||||
### Interacting with your Kubernetes cluster
|
||||
## Interacting with your Kubernetes cluster
|
||||
|
||||
In order to start interacting with your Kubernetes cluster, you will use a different binary called `kubectl`. You will need to [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your local machine. You can connect to the RKE created cluster by using the `kube_config_cluster.yml` that was generated when you deployed Kubernetes.
|
||||
After your cluster is up and running, you can start using the [generated kubeconfig file]({{< baseurl >}}/rke/v0.1.x/en/kubeconfig) to start interacting with your Kubernetes cluster using `kubectl`.
|
||||
|
||||
Confirm that kubectl is working by checking the version of your Kubernetes cluster
|
||||
|
||||
```
|
||||
kubectl --kubeconfig kube_config_cluster.yml version
|
||||
|
||||
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.0", GitCommit:"fc32d2f3698e36b93322a3465f63a14e9f0eaead", GitTreeState:"clean", BuildDate:"2018-03-27T00:13:02Z", GoVersion:"go1.9.4", Compiler:"gc", Platform:"darwin/amd64"}
|
||||
Server Version: version.Info{Major:"1", Minor:"8+", GitVersion:"v1.8.9-rancher1", GitCommit:"68595e18f25e24125244e9966b1e5468a98c1cd4", GitTreeState:"clean", BuildDate:"2018-03-13T04:37:53Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
|
||||
```
|
||||
|
||||
The client and server version are reported, indicating that you have a local `kubectl` client and are able to request the server version from the newly built cluster. Now, you can issue [any kubectl command](https://kubernetes.io/docs/reference/kubectl/kubectl/) to your cluster, like requesting the nodes that are in the cluster.
|
||||
|
||||
```
|
||||
kubectl --kubeconfig kube_config_cluster.yml get nodes
|
||||
NAME STATUS ROLES AGE VERSION
|
||||
10.0.0.1 Ready controlplane,etcd,worker 35m v1.10.3-rancher1
|
||||
```
|
||||
After installation, there are several maintenance items that might arise:
|
||||
|
||||
* [Certificate Management]({{< baseurl >}}/rke/v0.1.x/en/cert-mgmt/)
|
||||
* [Adding and Removing Nodes in the cluster]({{< baseurl >}}/rke/v0.1.x/en/managing-clusters)
|
||||
|
||||
@@ -0,0 +1,91 @@
|
||||
---
|
||||
title: Custom Certificates
|
||||
weight: 150
|
||||
---
|
||||
|
||||
_Available as of v0.2.0_
|
||||
|
||||
By default, RKE auto-generates the certificates for all the cluster components when installing Kubernetes. RKE can also use custom certificates for these Kubernetes cluster components.
|
||||
|
||||
When [deploying Kubernetes with RKE]({{< baseurl >}}/rke/v0.1.x/en/installation/#deploying-kubernetes-with-rke), there are two additional options that can be used with `rke up` so that RKE uses custom certificates.
|
||||
|
||||
| Option | Description |
|
||||
| --- | --- |
|
||||
| `--custom-certs` | Use custom certificates from a cert dir. The default directory is `/cluster_certs`. |
|
||||
| `--cert-dir` value | Specify a certificate dir path |
|
||||
|
||||
## Using Custom Certificates
|
||||
|
||||
```
|
||||
# Use certificates located in the default directory `/cluster_certs`
|
||||
$ rke up --custom-certs
|
||||
|
||||
# Use certificates located in your own directory
|
||||
$ rke up --custom-certs --cert-dir ~/my/own/certs
|
||||
```
|
||||
|
||||
## Certificates
|
||||
|
||||
The following certificates must exist in the certificate directory.
|
||||
|
||||
| Name | Certificate | Key | Required |
|
||||
|---|---|---|---|
|
||||
| Master CA | kube-ca.pem | - | * |
|
||||
| Kube API | kube-apiserver.pem | kube-apiserver-key.pem | * |
|
||||
| Kube Controller Manager | kube-controller-manager.pem | kube-controller-manager-key.pem | * |
|
||||
| Kube Scheduler | kube-scheduler.pem | kube-scheduler-key.pem | * |
|
||||
| Kube Proxy | kube-proxy.pem | kube-proxy-key.pem | * |
|
||||
| Kube Admin | kube-admin.pem | kube-admin-key.pem | * |
|
||||
| Apiserver Proxy Client | kube-apiserver-proxy-client.pem | kube-apiserver-proxy-client-key.pem | * |
|
||||
| Etcd Nodes | kube-etcd-x-x-x-x.pem | kube-etcd-x-x-x-x-key.pem | * |
|
||||
| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem | |
|
||||
| Service Account Token | - | kube-service-account-token-key.pem | |
|
||||
|
||||
## Generating Certificate Signing Requests (CSRs) and Keys
|
||||
|
||||
If you want to create and sign the certificates by a real Certificate Authority (CA), you can use RKE to generate a set of Certificate Signing Requests (CSRs) and keys. Using the `rke cert generate-csr` command, you will be able to generate the CRSs and keys.
|
||||
|
||||
1. Set up your `cluster.yml` with the [node information]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/).
|
||||
|
||||
2. Run `rke cert generate-csr` to generate certificates for the node(s) in the `cluster.yml`. By default, the CSRs and keys will be saved in `./cluster_certs`. To have them saved in a different directory, use `--cert-dir`.
|
||||
|
||||
```
|
||||
$ rke cert generate-csr
|
||||
INFO[0000] Generating Kubernetes cluster CSR certificates
|
||||
INFO[0000] [certificates] Generating Kubernetes API server csr
|
||||
INFO[0000] [certificates] Generating Kube Controller csr
|
||||
INFO[0000] [certificates] Generating Kube Scheduler csr
|
||||
INFO[0000] [certificates] Generating Kube Proxy csr
|
||||
INFO[0001] [certificates] Generating Node csr and key
|
||||
INFO[0001] [certificates] Generating admin csr and kubeconfig
|
||||
INFO[0001] [certificates] Generating Kubernetes API server proxy client csr
|
||||
INFO[0001] [certificates] Generating etcd-x.x.x.x csr and key
|
||||
INFO[0001] Successfully Deployed certificates at [./cluster_certs]
|
||||
```
|
||||
|
||||
**Result:** The CSRs and keys will be deployed in `./cluster_certs` directory. The CSR files will contain the right Alternative DNS and IP Names for the certificates. You can use them to sign the certificates by a real CA. After the certificates are signed, they can be used by RKE for custom certificates.
|
||||
|
||||
```
|
||||
$ tree cluster_certs
|
||||
|
||||
cluster_certs
|
||||
├── kube-admin-csr.pem
|
||||
├── kube-admin-key.pem
|
||||
├── kube-apiserver-csr.pem
|
||||
├── kube-apiserver-key.pem
|
||||
├── kube-apiserver-proxy-client-csr.pem
|
||||
├── kube-apiserver-proxy-client-key.pem
|
||||
├── kube-controller-manager-csr.pem
|
||||
├── kube-controller-manager-key.pem
|
||||
├── kube-etcd-x-x-x-x-csr.pem
|
||||
├── kube-etcd-x-x-x-x-key.pem
|
||||
├── kube-node-csr.pem
|
||||
├── kube-node-key.pem
|
||||
├── kube-proxy-csr.pem
|
||||
├── kube-proxy-key.pem
|
||||
├── kube-scheduler-csr.pem
|
||||
└── kube-scheduler-key.pem
|
||||
|
||||
0 directories, 16 files
|
||||
|
||||
```
|
||||
@@ -0,0 +1,35 @@
|
||||
---
|
||||
title: Kubeconfig File
|
||||
weight: 145
|
||||
---
|
||||
|
||||
In order to start interacting with your Kubernetes cluster, you will use a different binary called `kubectl`. You will need to [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your local machine.
|
||||
|
||||
A _kubeconfig file_ is a file used to configure access to Kubernetes when used in conjunction with the kubectl commandline tool (or other clients).
|
||||
|
||||
For more details on how kubeconfig and kubectl work together, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/).
|
||||
|
||||
When you deployed Kubernetes, a kubeconfig is automatically generated for your RKE cluster. This file is created and saved as `kube_config_cluster.yml`.
|
||||
|
||||
>**Note:** By default, kubectl checks `~/.kube/config` for a kubeconfig file, but you can use any directory you want using the `--kubeconfig` flag. For example:
|
||||
>
|
||||
>```
|
||||
kubectl --kubeconfig /custom/path/kube.config get pods
|
||||
```
|
||||
|
||||
Confirm that kubectl is working by checking the version of your Kubernetes cluster
|
||||
|
||||
```
|
||||
kubectl --kubeconfig kube_config_cluster.yml version
|
||||
|
||||
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.0", GitCommit:"fc32d2f3698e36b93322a3465f63a14e9f0eaead", GitTreeState:"clean", BuildDate:"2018-03-27T00:13:02Z", GoVersion:"go1.9.4", Compiler:"gc", Platform:"darwin/amd64"}
|
||||
Server Version: version.Info{Major:"1", Minor:"8+", GitVersion:"v1.8.9-rancher1", GitCommit:"68595e18f25e24125244e9966b1e5468a98c1cd4", GitTreeState:"clean", BuildDate:"2018-03-13T04:37:53Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
|
||||
```
|
||||
|
||||
The client and server version are reported, indicating that you have a local `kubectl` client and are able to request the server version from the newly built cluster. Now, you can issue [any kubectl command](https://kubernetes.io/docs/reference/kubectl/kubectl/) to your cluster, like requesting the nodes that are in the cluster.
|
||||
|
||||
```
|
||||
kubectl --kubeconfig kube_config_cluster.yml get nodes
|
||||
NAME STATUS ROLES AGE VERSION
|
||||
10.0.0.1 Ready controlplane,etcd,worker 35m v1.10.3-rancher1
|
||||
```
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Adding and Removing Nodes in RKE Clusters
|
||||
title: Adding and Removing Nodes
|
||||
weight: 175
|
||||
aliases:
|
||||
- /rke/v0.1.x/en/installation/managing-clusters/
|
||||
|
||||
Reference in New Issue
Block a user