public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1532 from dnoland1/rke-custom-certs

Browse Source 
Removed required column since all keys are required. Added instructions for kube-service-account-token-key.pem.
This commit is contained in:
Denise
2019-06-23 19:07:45 -07:00
committed by GitHub
parent bb42be1259 4224e027c1
commit 9a752bd2d5
1 changed files with 20 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rke/latest/en/installation/certs/_index.md
+20 -13
View File
@@ -28,18 +28,18 @@ $ rke up --custom-certs --cert-dir ~/my/own/certs
The following certificates must exist in the certificate directory.
| Name | Certificate | Key | Required |
|---|---|---|---|
| Master CA | kube-ca.pem | - | * |
| Kube API | kube-apiserver.pem | kube-apiserver-key.pem | * |
| Kube Controller Manager | kube-controller-manager.pem | kube-controller-manager-key.pem | * |
| Kube Scheduler | kube-scheduler.pem | kube-scheduler-key.pem | * |
| Kube Proxy | kube-proxy.pem | kube-proxy-key.pem | * |
| Kube Admin | kube-admin.pem | kube-admin-key.pem | * |
| Apiserver Proxy Client | kube-apiserver-proxy-client.pem | kube-apiserver-proxy-client-key.pem | * |
| Etcd Nodes | kube-etcd-x-x-x-x.pem | kube-etcd-x-x-x-x-key.pem | * |
| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem | |
| Service Account Token | - | kube-service-account-token-key.pem | |
| Name | Certificate | Key |
|---|---|---|
| Master CA | kube-ca.pem | - |
| Kube API | kube-apiserver.pem | kube-apiserver-key.pem |
| Kube Controller Manager | kube-controller-manager.pem | kube-controller-manager-key.pem |
| Kube Scheduler | kube-scheduler.pem | kube-scheduler-key.pem |
| Kube Proxy | kube-proxy.pem | kube-proxy-key.pem |
| Kube Admin | kube-admin.pem | kube-admin-key.pem |
| Apiserver Proxy Client | kube-apiserver-proxy-client.pem | kube-apiserver-proxy-client-key.pem |
| Etcd Nodes | kube-etcd-x-x-x-x.pem | kube-etcd-x-x-x-x-key.pem |
| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem |
| Service Account Token | - | kube-service-account-token-key.pem |
## Generating Certificate Signing Requests (CSRs) and Keys
@@ -63,6 +63,11 @@ If you want to create and sign the certificates by a real Certificate Authority
INFO[0001] Successfully Deployed certificates at [./cluster_certs]
```
3. In addition to the CSRs, you also need to generate the kube-service-account-token-key.pem key. To do this, run the following:
```
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./cluster_certs/kube-service-account-token-key.pem -out ./cluster_certs/kube-service-account-token.pem
```
**Result:** The CSRs and keys will be deployed in `./cluster_certs` directory, assuming you didn't specify a `--cert-dir`. The CSR files will contain the right Alternative DNS and IP Names for the certificates. You can use them to sign the certificates by a real CA. After the certificates are signed, those certificates can be used by RKE as custom certificates.
```
@@ -84,8 +89,10 @@ cluster_certs
├── kube-proxy-csr.pem
├── kube-proxy-key.pem
├── kube-scheduler-csr.pem
├── kube-service-account-token-key.pem
├── kube-service-account-token.pem
└── kube-scheduler-key.pem
0 directories, 16 files
0 directories, 18 files
```