From 4224e027c1e3913ed88cf130b504be1718d34202 Mon Sep 17 00:00:00 2001 From: David Noland Date: Fri, 21 Jun 2019 14:50:24 -0700 Subject: [PATCH] Removed required column since all keys are required. Added instructions for kube-service-account-token-key.pem. --- .../latest/en/installation/certs/_index.md | 33 +++++++++++-------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/content/rke/latest/en/installation/certs/_index.md b/content/rke/latest/en/installation/certs/_index.md index 6b702c468d2..19e5a04a0e9 100644 --- a/content/rke/latest/en/installation/certs/_index.md +++ b/content/rke/latest/en/installation/certs/_index.md @@ -28,18 +28,18 @@ $ rke up --custom-certs --cert-dir ~/my/own/certs The following certificates must exist in the certificate directory. -| Name | Certificate | Key | Required | -|---|---|---|---| -| Master CA | kube-ca.pem | - | * | -| Kube API | kube-apiserver.pem | kube-apiserver-key.pem | * | -| Kube Controller Manager | kube-controller-manager.pem | kube-controller-manager-key.pem | * | -| Kube Scheduler | kube-scheduler.pem | kube-scheduler-key.pem | * | -| Kube Proxy | kube-proxy.pem | kube-proxy-key.pem | * | -| Kube Admin | kube-admin.pem | kube-admin-key.pem | * | -| Apiserver Proxy Client | kube-apiserver-proxy-client.pem | kube-apiserver-proxy-client-key.pem | * | -| Etcd Nodes | kube-etcd-x-x-x-x.pem | kube-etcd-x-x-x-x-key.pem | * | -| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem | | -| Service Account Token | - | kube-service-account-token-key.pem | | +| Name | Certificate | Key | +|---|---|---| +| Master CA | kube-ca.pem | - | +| Kube API | kube-apiserver.pem | kube-apiserver-key.pem | +| Kube Controller Manager | kube-controller-manager.pem | kube-controller-manager-key.pem | +| Kube Scheduler | kube-scheduler.pem | kube-scheduler-key.pem | +| Kube Proxy | kube-proxy.pem | kube-proxy-key.pem | +| Kube Admin | kube-admin.pem | kube-admin-key.pem | +| Apiserver Proxy Client | kube-apiserver-proxy-client.pem | kube-apiserver-proxy-client-key.pem | +| Etcd Nodes | kube-etcd-x-x-x-x.pem | kube-etcd-x-x-x-x-key.pem | +| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem | +| Service Account Token | - | kube-service-account-token-key.pem | ## Generating Certificate Signing Requests (CSRs) and Keys @@ -63,6 +63,11 @@ If you want to create and sign the certificates by a real Certificate Authority INFO[0001] Successfully Deployed certificates at [./cluster_certs] ``` +3. In addition to the CSRs, you also need to generate the kube-service-account-token-key.pem key. To do this, run the following: + ``` + $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./cluster_certs/kube-service-account-token-key.pem -out ./cluster_certs/kube-service-account-token.pem + ``` + **Result:** The CSRs and keys will be deployed in `./cluster_certs` directory, assuming you didn't specify a `--cert-dir`. The CSR files will contain the right Alternative DNS and IP Names for the certificates. You can use them to sign the certificates by a real CA. After the certificates are signed, those certificates can be used by RKE as custom certificates. ``` @@ -84,8 +89,10 @@ cluster_certs ├── kube-proxy-csr.pem ├── kube-proxy-key.pem ├── kube-scheduler-csr.pem +├── kube-service-account-token-key.pem +├── kube-service-account-token.pem └── kube-scheduler-key.pem -0 directories, 16 files +0 directories, 18 files ```