标签:bec 自签证书 ken account binding new oca apply fat
kubernetes v1.17
dashboard v2.0.0-rc5
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml
修改service的为NodePort:30443,以便外网可以访问,以https访问网站时出现证书无效的错误。
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=CA"
openssl genrsa -out dashboard.key 2048
openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=192.168.0.200"
// ---配置dashboard.cnf ---
// vim dashboard.cnf
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:192.168.0.200,IP:127.0.0.1,DNS:192.168.0.200,DNS:localhost
// --- 签发证书 ---
openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf
kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
kubectl create secret generic kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kubernetes-dashboard
删除 dashboard pod 更新部署
拷贝ca.crt文件到要访问的机器上,导入证书。
mac os 打开 钥匙串访问,把ca文件拖进去,信任 选择 始终信任,访问网站,出现192.168.0.200的登录证书,信任 选择 始终信任即可。
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
拷贝token,登录选择token即可。
标签:bec 自签证书 ken account binding new oca apply fat
原文地址:https://www.cnblogs.com/wh-blog/p/12287788.html