319 lines
12 KiB
Markdown
319 lines
12 KiB
Markdown
---
|
||
title: 使用 CertificateSigningRequest 为 Kubernetes API 客户端颁发证书
|
||
api_metadata:
|
||
- apiVersion: "certificates.k8s.io/v1"
|
||
kind: "CertificateSigningRequest"
|
||
override_link_text: "CSR v1"
|
||
weight: 80
|
||
|
||
# 文档维护说明
|
||
#
|
||
# 如果将来新增页面 /docs/tasks/tls/certificate-issue-client-manually/
|
||
# 那么需要在此页面添加新的交叉引用链接，而新增的页面也应链接回此页面
|
||
---
|
||
<!--
|
||
title: Issue a Certificate for a Kubernetes API Client Using A CertificateSigningRequest
|
||
api_metadata:
|
||
- apiVersion: "certificates.k8s.io/v1"
|
||
kind: "CertificateSigningRequest"
|
||
override_link_text: "CSR v1"
|
||
weight: 80
|
||
|
||
# Docs maintenance note
|
||
#
|
||
# If there is a future page /docs/tasks/tls/certificate-issue-client-manually/ then this page
|
||
# should link there, and the new page should link back to this one.
|
||
-->
|
||
|
||
<!-- overview -->
|
||
|
||
<!--
|
||
Kubernetes lets you use a public key infrastructure (PKI) to authenticate to your cluster
|
||
as a client.
|
||
|
||
A few steps are required in order to get a normal user to be able to
|
||
authenticate and invoke an API. First, this user must have an [X.509](https://www.itu.int/rec/T-REC-X.509) certificate
|
||
issued by an authority that your Kubernetes cluster trusts. The client must then present that certificate to the Kubernetes API.
|
||
-->
|
||
Kubernetes 允许你使用公钥基础设施 (PKI) 对你的集群进行身份认证，这类似于对客户端进行身份认证。
|
||
|
||
为了能够对普通用户进行身份认证并调用 API，需要执行几个步骤。首先，此用户必须拥有由你的
|
||
Kubernetes 集群所信任的权威机构颁发的 [X.509](https://www.itu.int/rec/T-REC-X.509)
|
||
证书。之后客户端必须向 Kubernetes API 提交该证书。
|
||
|
||
<!--
|
||
You use a [CertificateSigningRequest](/concepts/security/certificate-signing-requests/)
|
||
as part of this process, and either you or some other principal must approve the request.
|
||
|
||
You will create a private key, and then get a certificate issued, and finally configure
|
||
that private key for a client.
|
||
-->
|
||
在这个过程中，你需要使用
|
||
[CertificateSigningRequest](/zh-cn/concepts/security/certificate-signing-requests/)，并且你或其他主体必须批准此请求。
|
||
|
||
你将创建私钥，然后获取颁发的证书，最后为客户端配置该私钥。
|
||
|
||
## {{% heading "prerequisites" %}}
|
||
|
||
* {{< include "task-tutorial-prereqs.md" >}}
|
||
|
||
<!--
|
||
* You need the `kubectl`, `openssl` and `base64` utilities.
|
||
|
||
This page assumes you are using Kubernetes {{< glossary_tooltip term_id="rbac" text="role based access control" >}} (RBAC).
|
||
If you have alternative or additional security mechanisms around authorization, you need to account for those as well.
|
||
-->
|
||
* 你需要 `kubectl`、`openssl` 和 `base64` 等工具。
|
||
|
||
此页面假设你使用的是 Kubernetes {{< glossary_tooltip term_id="rbac" text="基于角色的访问控制" >}} (RBAC)。
|
||
如果你在鉴权方面有替代的或额外的安全机制，也需要将其考虑在内。
|
||
|
||
<!-- steps -->
|
||
|
||
<!--
|
||
## Create private key
|
||
|
||
In this step, you create a private key. You need to keep this document secret; anyone who has it can impersonate the user.
|
||
|
||
```shell
|
||
# Create a private key
|
||
openssl genrsa -out myuser.key 3072
|
||
```
|
||
-->
|
||
## 创建私钥 {#create-private-key}
|
||
|
||
在这一步中，你将创建一个私钥。你将此文件作为秘密保管起来，因为任何拥有该私钥的人都可以伪装成对应的用户。
|
||
|
||
```shell
|
||
# 创建一个私钥
|
||
openssl genrsa -out myuser.key 3072
|
||
```
|
||
|
||
<!--
|
||
## Create an X.509 certificate signing request {#create-x.509-certificatessigningrequest}
|
||
-->
|
||
## 创建 X.509 证书签名请求 {#create-x.509-certificatessigningrequest}
|
||
|
||
{{< note >}}
|
||
<!--
|
||
This is not the same as the similarly-named CertificateSigningRequest API; the file you generate here goes into the
|
||
CertificateSigningRequest.
|
||
-->
|
||
这与类似名称的 CertificateSigningRequest API 不同；
|
||
你在此处生成的文件将被放入 CertificateSigningRequest 对象中。
|
||
{{< /note >}}
|
||
|
||
<!--
|
||
It is important to set CN and O attribute of the CSR. CN is the name of the user and O is the group that this user will belong to.
|
||
You can refer to [RBAC](/docs/reference/access-authn-authz/rbac/) for standard groups.
|
||
|
||
```shell
|
||
# Change the common name "myuser" to the actual username that you want to use
|
||
openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser"
|
||
```
|
||
-->
|
||
设置 CSR 的 CN 和 O 属性非常重要。CN 是用户的名称，O 是此用户所属的群组。
|
||
你可以参阅 [RBAC](/zh-cn/docs/reference/access-authn-authz/rbac/) 了解标准的群组。
|
||
|
||
```shell
|
||
# 将通用名称 "myuser" 更改为你要使用的实际用户名
|
||
openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser"
|
||
```
|
||
|
||
<!--
|
||
## Create a Kubernetes CertificateSigningRequest {#create-k8s-certificatessigningrequest}
|
||
|
||
Encode the CSR document using this command:
|
||
-->
|
||
## 创建 Kubernetes CertificateSigningRequest {#create-k8s-certificatessigningrequest}
|
||
|
||
使用以下命令对 CSR 文档进行编码：
|
||
|
||
```shell
|
||
cat myuser.csr | base64 | tr -d "\n"
|
||
```
|
||
|
||
<!--
|
||
Create a [CertificateSigningRequest](/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1/)
|
||
and submit it to a Kubernetes Cluster via kubectl. Below is a snippet of shell that you can use to generate the
|
||
CertificateSigningRequest.
|
||
-->
|
||
创建 [CertificateSigningRequest](/zh-cn/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1/)
|
||
并通过 kubectl 将其提交到 Kubernetes 集群。以下是你可以用于生成 CertificateSigningRequest 的 Shell 片段。
|
||
|
||
<!--
|
||
# example
|
||
# This is an encoded CSR. Change this to the base64-encoded contents of myuser.csr
|
||
# one day
|
||
-->
|
||
```shell
|
||
cat <<EOF | kubectl apply -f -
|
||
apiVersion: certificates.k8s.io/v1
|
||
kind: CertificateSigningRequest
|
||
metadata:
|
||
name: myuser # 示例
|
||
spec:
|
||
# 这是已编码的 CSR。将此更改为 myuser.csr 的经 base64 编码的内容
|
||
request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0dZVzVuWld4aE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQTByczhJTHRHdTYxakx2dHhWTTJSVlRWMDNHWlJTWWw0dWluVWo4RElaWjBOCnR2MUZtRVFSd3VoaUZsOFEzcWl0Qm0wMUFSMkNJVXBGd2ZzSjZ4MXF3ckJzVkhZbGlBNVhwRVpZM3ExcGswSDQKM3Z3aGJlK1o2MVNrVHF5SVBYUUwrTWM5T1Nsbm0xb0R2N0NtSkZNMUlMRVI3QTVGZnZKOEdFRjJ6dHBoaUlFMwpub1dtdHNZb3JuT2wzc2lHQ2ZGZzR4Zmd4eW8ybmlneFNVekl1bXNnVm9PM2ttT0x1RVF6cXpkakJ3TFJXbWlECklmMXBMWnoyalVnald4UkhCM1gyWnVVV1d1T09PZnpXM01LaE8ybHEvZi9DdS8wYk83c0x0MCt3U2ZMSU91TFcKcW90blZtRmxMMytqTy82WDNDKzBERHk5aUtwbXJjVDBnWGZLemE1dHJRSURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBR05WdmVIOGR4ZzNvK21VeVRkbmFjVmQ1N24zSkExdnZEU1JWREkyQTZ1eXN3ZFp1L1BVCkkwZXpZWFV0RVNnSk1IRmQycVVNMjNuNVJsSXJ3R0xuUXFISUh5VStWWHhsdnZsRnpNOVpEWllSTmU3QlJvYXgKQVlEdUI5STZXT3FYbkFvczFqRmxNUG5NbFpqdU5kSGxpT1BjTU1oNndLaTZzZFhpVStHYTJ2RUVLY01jSVUyRgpvU2djUWdMYTk0aEpacGk3ZnNMdm1OQUxoT045UHdNMGM1dVJVejV4T0dGMUtCbWRSeEgvbUNOS2JKYjFRQm1HCkkwYitEUEdaTktXTU0xMzhIQXdoV0tkNjVoVHdYOWl4V3ZHMkh4TG1WQzg0L1BHT0tWQW9FNkpsYWFHdTlQVmkKdjlOSjVaZlZrcXdCd0hKbzZXdk9xVlA3SVFjZmg3d0drWm89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
|
||
signerName: kubernetes.io/kube-apiserver-client
|
||
expirationSeconds: 86400 # 一天
|
||
usages:
|
||
- client auth
|
||
EOF
|
||
```
|
||
|
||
<!--
|
||
Some points to note:
|
||
|
||
- `usages` has to be `client auth`
|
||
- `expirationSeconds` could be made longer (i.e. `864000` for ten days) or shorter (i.e. `3600` for one hour).
|
||
You cannot request a duration shorter than 10 minutes.
|
||
- `request` is the base64 encoded value of the CSR file content.
|
||
-->
|
||
一些注意点：
|
||
|
||
- `usages` 必须是 `client auth`
|
||
- `expirationSeconds` 可以设置得更长（例如 `864000` 表示十天）或更短（例如 `3600` 表示一小时）。
|
||
你所请求的时长不能短于 10 分钟。
|
||
- `request` 值是 CSR 文件内容的 base64 编码值。
|
||
|
||
<!--
|
||
## Approve the CertificateSigningRequest {#approve-certificate-signing-request}
|
||
|
||
Use kubectl to find the CSR you made, and manually approve it.
|
||
|
||
Get the list of CSRs:
|
||
-->
|
||
## 批准 CertificateSigningRequest {#approve-certificate-signing-request}
|
||
|
||
使用 kubectl 找到你创建的 CSR，并手动批准它。
|
||
|
||
获取 CSR 列表：
|
||
|
||
```shell
|
||
kubectl get csr
|
||
```
|
||
|
||
<!--
|
||
Approve the CSR:
|
||
-->
|
||
批准 CSR：
|
||
|
||
```shell
|
||
kubectl certificate approve myuser
|
||
```
|
||
|
||
<!--
|
||
## Get the certificate
|
||
|
||
Retrieve the certificate from the CSR, to check it looks OK.
|
||
-->
|
||
## 获取证书 {#get-the-certificate}
|
||
|
||
从 CSR 中检索证书，以检查其是否正常。
|
||
|
||
```shell
|
||
kubectl get csr/myuser -o yaml
|
||
```
|
||
|
||
<!--
|
||
The certificate value is in Base64-encoded format under `.status.certificate`.
|
||
|
||
Export the issued certificate from the CertificateSigningRequest.
|
||
-->
|
||
证书值以 Base64 编码格式显示在 `.status.certificate` 下。
|
||
|
||
从 CertificateSigningRequest 导出已颁发的证书。
|
||
|
||
```shell
|
||
kubectl get csr myuser -o jsonpath='{.status.certificate}'| base64 -d > myuser.crt
|
||
```
|
||
|
||
<!--
|
||
## Configure the certificate into kubeconfig
|
||
|
||
The next step is to add this user into the kubeconfig file.
|
||
|
||
First, you need to add new credentials:
|
||
-->
|
||
## 将证书配置到 kubeconfig 中 {#configure-the-certificate-into-kubeconfig}
|
||
|
||
下一步是将此用户添加到 kubeconfig 文件中。
|
||
|
||
首先，你需要添加新的凭证：
|
||
|
||
```shell
|
||
kubectl config set-credentials myuser --client-key=myuser.key --client-certificate=myuser.crt --embed-certs=true
|
||
```
|
||
|
||
<!--
|
||
Then, you need to add the context:
|
||
-->
|
||
然后，你需要添加上下文：
|
||
|
||
```shell
|
||
kubectl config set-context myuser --cluster=kubernetes --user=myuser
|
||
```
|
||
|
||
<!--
|
||
To test it:
|
||
-->
|
||
对其执行测试：
|
||
|
||
```shell
|
||
kubectl --context myuser auth whoami
|
||
```
|
||
|
||
<!--
|
||
You should see output confirming that you are “myuser“.
|
||
|
||
## Create Role and RoleBinding
|
||
-->
|
||
你应该看到确认你是 “myuser” 的输出。
|
||
|
||
## 创建 Role 和 RoleBinding {#create-role-and-rolebinding}
|
||
|
||
{{< note >}}
|
||
<!--
|
||
If you don't use Kubernetes RBAC, skip this step and make the appropriate changes for the authorization mechanism
|
||
your cluster actually uses.
|
||
-->
|
||
如果你不使用 Kubernetes RBAC，请跳过这一步，并对集群实际使用的鉴权机制进行适当更改。
|
||
{{< /note >}}
|
||
|
||
<!--
|
||
With the certificate created it is time to define the Role and RoleBinding for
|
||
this user to access Kubernetes cluster resources.
|
||
|
||
This is a sample command to create a Role for this new user:
|
||
-->
|
||
创建证书之后，就可以为此用户定义 Role 和 RoleBinding，以访问 Kubernetes 集群资源。
|
||
|
||
这是为新用户创建 Role 的示例命令：
|
||
|
||
```shell
|
||
kubectl create role developer --verb=create --verb=get --verb=list --verb=update --verb=delete --resource=pods
|
||
```
|
||
|
||
<!--
|
||
This is a sample command to create a RoleBinding for this new user:
|
||
-->
|
||
这是为新用户创建 RoleBinding 的示例命令：
|
||
|
||
```shell
|
||
kubectl create rolebinding developer-binding-myuser --role=developer --user=myuser
|
||
```
|
||
|
||
## {{% heading "whatsnext" %}}
|
||
|
||
<!--
|
||
* Read [Manage TLS Certificates in a Cluster](/docs/tasks/tls/managing-tls-in-a-cluster/)
|
||
* For details of X.509 itself, refer to [RFC 5280](https://tools.ietf.org/html/rfc5280#section-3.1) section 3.1
|
||
* For information on the syntax of PKCS#10 certificate signing requests, refer to [RFC 2986](https://tools.ietf.org/html/rfc2986)
|
||
* Read about [ClusterTrustBundles](/docs/reference/access-authn-authz/certificate-signing-requests/#cluster-trust-bundles)
|
||
-->
|
||
* 阅读[管理集群中的 TLS 证书](/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)
|
||
* 有关 X.509 本身的细节，参阅 [RFC 5280](https://tools.ietf.org/html/rfc5280#section-3.1) 第 3.1 节
|
||
* 有关 PKCS#10 证书签名请求的语法信息，请参阅 [RFC 2986](https://tools.ietf.org/html/rfc2986)
|
||
* 参阅 [ClusterTrustBundles](/zh-cn/docs/reference/access-authn-authz/certificate-signing-requests/#cluster-trust-bundles)
|