2.etcd集群的安装（cfssl版）

curl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64  -o cfssl_linux-amd64
curl https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64  -o cfssljson_linux-amd64
mv  cfssl_linux_amd64 /bin/cfssl
mv cfssljson_linux_amd64 /bin/cfssljson
-------------------------------------------------------------------------
生成根证书文件
[root@master01 ~]# cat ca-config.json ca-csr.json 
{
    "signing": {
        "default": {
            "expiry": "175200h"
        },
        "profiles": {
            "kubernetes": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
            "client auth"
                ]
            },
            "etcd": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}
{
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "cnpc",
            "OU": "RF"
        }
    ]
}
-----------------------------------------------------------------------
[root@master01 ~]# ./cfssl_linux-amd64 gencert --initca ca-csr.json | cfssljson --bare ca
2019/05/14 04:46:17 [INFO] generating a new CA key and certificate from CSR
2019/05/14 04:46:17 [INFO] generate received request
2019/05/14 04:46:17 [INFO] received CSR
2019/05/14 04:46:17 [INFO] generating key: rsa-2048
2019/05/14 04:46:17 [INFO] encoded CSR
2019/05/14 04:46:17 [INFO] signed certificate with serial number 542129512178184951176207072980197727070484397354
[root@master01 ~]# ls ca* -l
-rw-r--r-- 1 root root  640 May 14 03:52 ca-config.json
-rw-r--r-- 1 root root  968 May 14 04:46 ca.csr
-rw-r--r-- 1 root root  237 May 14 04:45 ca-csr.json
-rw------- 1 root root 1679 May 14 04:46 ca-key.pem
-rw-r--r-- 1 root root 1294 May 14 04:46 ca.pem
------------------------------------------------------------------------
生产集群验证证书
[root@master01 ~]# cat etcd-csr.json 
{
  "CN": "etcd-server",
  "hosts": [
    "localhost",
    "0.0.0.0",
    "127.0.0.1",
    "192.168.141.135",
    "192.168.141.136",
    "192.168.141.137"
  ],
  "key": {
    "algo": "rsa",
    "size": 4096
  },
  "names": [
    {
        "C": "CN",
        "L": "Beijing",
        "ST": "Beijing",
        "O": "cnpc",
        "OU": "RF"}
  ]
}

[root@master01 ~]# ./cfssl_linux-amd64 gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=etcd etcd-csr.json | cfssljson -bare etcd
2019/05/14 04:55:19 [INFO] generate received request
2019/05/14 04:55:19 [INFO] received CSR
2019/05/14 04:55:19 [INFO] generating key: rsa-4096
2019/05/14 04:55:23 [INFO] encoded CSR
2019/05/14 04:55:23 [INFO] signed certificate with serial number 246077356353194423743124239784275664122753186375
2019/05/14 04:55:23 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

-------------------------------------------------------------------------
etcd客户端访问证书 可有可不用。

[root@master01 ~]# cat etcd-client-csr.json 
{
  "CN": "etcd-client",
  "hosts": [
    ""
  ],
  "key": {
    "algo": "rsa",
    "size": 4096
  },
  "names": [
    {
        "C": "CN",
        "L": "Beijing",
        "ST": "Beijing",
        "O": "cnpc",
        "OU": "RF"}
  ]
}

[root@master01 ~]# ./cfssl_linux-amd64 gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=etcd etcd-client-csr.json | cfssljson -bare etcd-client
2019/05/14 04:58:46 [INFO] generate received request
2019/05/14 04:58:46 [INFO] received CSR
2019/05/14 04:58:46 [INFO] generating key: rsa-4096
2019/05/14 04:58:48 [INFO] encoded CSR
2019/05/14 04:58:48 [INFO] signed certificate with serial number 627937418614823301041449342112313001983243456545
2019/05/14 04:58:48 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
[root@master01 ~]# ls etcd-client* -l
-rw-r--r-- 1 root root 1732 May 14 04:58 etcd-client.csr
-rw-r--r-- 1 root root  230 May 14 03:56 etcd-client-csr.json
-rw------- 1 root root 3247 May 14 04:58 etcd-client-key.pem
-rw-r--r-- 1 root root 1724 May 14 04:58 etcd-client.pem
------------------------------------