IMOKURI/tls-certs.md

# CA 秘密鍵
openssl genrsa -out ca-key.pem 2048

# CA 証明書署名要求(CSR)
openssl req -new -key ca-key.pem \
  -subj "/C=JP/ST=Tokyo/O=HPE/CN=Sodor Root CA" \
  -out sodor-ca.csr

# CA 証明書(自己署名)
openssl x509 -req -in sodor-ca.csr \
  -signkey ca-key.pem -out sodor-ca.crt -days 3650


# 秘密鍵
openssl genrsa -out server-key.pem 2048

# 証明書署名要求(CSR)
openssl req -new -key server-key.pem \
  -subj "/C=JP/ST=Tokyo/O=HPE/CN=*.example.com" \
  -out server.csr

# 署名
openssl x509 -req -days 3650 \
  -extfile <(printf "subjectAltName=DNS:example.com,DNS:www.example.com") \
  -in server.csr \
  -CA sodor-ca.crt -CAkey ca-key.pem -CAcreateserial \
  -out server.crt

IMOKURI · 2024-07-10T05:12:54Z

kubernetes ユーザー作成

openssl genrsa -out user001.key 2048
openssl req -new -key user001.key -out user001.csr -subj "/CN=user001"
vi user001-csr.yaml

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: user001
spec:
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1Z6Q0NBVDhDQVFBd0VqRVFNQTRHQTFVRUF3d0hkWE5sY2pBd01UQ0NBU0l3RFFZSktvWklodmNOQVFFQgpCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFLNHpzZmVxcUlTWStmR2J0ZzhjQVo5MHlaY3ZJWTAzcEx5NTFrVFNmVTF5CnFIMlFPbGF5SExuTFJ6UjRENmlmOFBlY0ZyanlNTjZFekdTdGxuRzZtcHJ4YWxFUExvMjM1RWpHTjBOOGdGeXoKenFkcHBEZ1VSMUQrWmlVR1paSFMwTlhjWnVNQW0rVjlKbHR3bUszUUdycVdoTGxqTHJMZHgwc2FhSVdLeUdFMQo1bVBWZzRiMjZYR3B2YVo2SnpwYU9NdDhYc2I0cXd0Q2lpbitvbkxlMUJXM1Y2UVB1Q210U252aEowemlBRGg2CjZvQTg3bmdYeFNEYzg3TnM0aFhKYWxEdEdOejhiYW1QbjFNbjRRY2RVMG9jaHpoWDNqSUlOa0drbVAxNk1veWcKeEl1UGd5RXVrcGR3Q0tWZG1DMWF0SkZYNGYzM1RIU2ZQbkMxWU94WDNRVUNBd0VBQWFBQU1BMEdDU3FHU0liMwpEUUVCQ3dVQUE0SUJBUUNjZTRpNzZONUFheWw5K2xUMml3aGR1ZHU5LzFaVUtmaHA1dEhRaGI5TEZETGNvZW5HCjIzNlNCVWMzRG1GekVkT2tXcE5nNml5WHVKeDFJTDNWNno5cXh3amhaUElXNnVWQUdkc3htejREeXNtQnJEWUgKaFE5VERBeFl6MzhqUXROYnA0aldXT2Z1VXQwSG0zT3ZVRmp3YjZlKzFvdkxOcVY4c0Ewa1RrWUp3bFMxM1NIVAowRnh1NE9sOFpEQ3pneDV1YUxEZUNUN0Nad1BKKzM2RlgxNnNMSldMYU9iODBmMm1TN1M5c2k0SFk3SEhPNHpOClczSGJkcHBacSt4WlowSGg0eU8ydzZOZ0RlTUZ3c0VEM25NdmhUVjRRbmUzaFArL21TUS8vaFdIU094UVV0bXQKMytWRWZPaWFRVEtuTlhldnlQZnRrSExIRXNkcFUwZFpMbjVuCi0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
  signerName: kubernetes.io/kube-apiserver-client
  usages:
    - client auth

request="$(cat user001.csr | base64 | tr -d "\n")" yq -i '.spec.request = strenv(request)' user001-csr.yaml
kubectl apply -f user001-csr.yaml
kubectl get csr
kubectl certificate approve user001
kubectl get csr

k get csr user001 -o jsonpath='{ .status.certificate }' | base64 -d
k get csr user001 -o jsonpath='{ .status.certificate }' | base64 -d > /tmp/user001.crt

k config set-credentials user001 --client-key=user001.key --client-certificate=user001.crt --embed-certs=true
k config set-context user001 --cluster=microk8s-cluster --namespace=user001 --user=user001
k config view

microk8s config > user001-config.yaml
vi user001-config.yaml
# 必要なものだけ残す

cp user001-config.yaml ~/.kube/config
sudo chown user001:user001 ~/.kube/config
sudo chmod 600 ~/.kube/config

IMOKURI/tls-certs.md

Select an option

No results found

Select an option

No results found

IMOKURI commented Jul 10, 2024

Uh oh!