- 누구든 CA key pair로 접근 권한을 얻으면 k8s 환경의 모든 인증서에 접근이 가능하므로, 안전한 곳에 보관해야.
- K8S의 CA server는 master node
- 매번 CSR 요청하여 사용자 인증서 수동으로 만드는 것을 대신하기 위해 Certificates API가 있음.
사용 방법
- openssl genrsa -out jane.key 2048
- openssl req -new -key jane.key -subj "/CN=jane" -out jane.csr
- jane-csr.yaml 에 kind: CertificateSigningRequest 로 생성.
- yaml 파일의 spec.request에 cat jane.csr | base64 문자열을 추가
- kubectl get csr 명령어로 요청 목록 확인
- 운영자는 kubectl certificate approve jane 명령어로 승인 가능
- kubectl get csr jane -o yaml 후 status.certificate에서 인증서 확인 가능. 다만 이는 base64로 인코딩되어 있음
- echo "base64 certificate" | base64 --decode 명령어로 평문 추출
- 인증서 관련한 모든 작업은 controller-manager이 처리함
apiVersion: certificates.k8s.io/v1 kind: CertificateSigningRequest metadata: name: akshay spec: request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0dZV3R6YUdGNU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQXdUOUI1NzY1dFdEWnJZWFJkR2tVbjVDS1VHSlMwTFg0KzNyS3MwZkVrZW95ClZodjZYQit2cE12SHhSK1VmU29od1lkOEdrZis0VzA3MDdGTDNPc0FZMFZjK3RraWY4SEwrOEZob0VjUDE1dXIKdDdpbUpibWUzTWdZYWY5dHA0SVR1U3d4U24zamU0MVZWZUdnbW5teHBNSUI3OVJvODE3YlI1V1FDOHdVVGdFNwpka2gwOC8vT2JzWkFyRU5GUUtOT0Rqa2tOVFpiUWM0RmFEK1dzSzhMd0VQODJNcXRDdWV0SHM1cGZ2Y3dhRTZDCmhaSTBxNnJnQndMOXBaUExnbWFzbVVJYlpaMUptak14ckw2T3plYlF6NjFZcnZRaFl2Q1FTVzk0a3N4TERtU0sKeG1kM1NNVHYxZmxtTytGTjVjQWZXTnNzUmxrVEZQTDVrZnpqMzIzZHNRSURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBSmpsK29tckZJamlCQndSTFY5WUdsNUp3TEdzenZFV2tBMEltekVRQytPUXhaYzFyNmpMCm5XTk1taGZCSzdmUDRHSlhQcU1OTU1rVWlNeUllVGxTQzV4aThLZXc1VkRvb3lmWmZZaXc2REVXbTdnSHVwSHIKaUJrOHowbklZSk5ENkdKejl1dWR4ZlNPVXlnc21ZU2k3cWwwT3RLenQ0KzFURUhQVGkvWG55VngyY2FwWDVrdgpwNjVjYlhvUjdRRHhBOTNQQXYxaXYxYVRBVG82eGtXRkFwcXRYZUZqTVU0cnE0SVhqY0EyaExyOXRDZVd1SlRNCjllbDhydHluV1czWFU5ZHRzbG9WNGlhOUFsQzZSR0tnMG1kbTZsOUk2MG5jaUU3Rkw5MTNSQUJ2WmMvbkdTWXIKYTZaYnE0ejNXemVjNU42QTlXdWRVbjlleXBoblpvYUdtRDg9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo= signerName: kubernetes.io/kube-apiserver-client usages: - client auth |
- request에 들어가야 될 값:
akshay.csr | base64 | tr -d "\n"
'CKA' 카테고리의 다른 글
API Group (0) | 2021.09.29 |
---|---|
KubeConfig (0) | 2021.09.27 |
TLS Certificates in Kubernetes (0) | 2021.09.25 |
TLS 이론 (0) | 2021.09.23 |
Authentication (0) | 2021.09.17 |