[TOC] # SelfSigned ⚠️ SelfSigned 颁发者本身并不代表证书颁发机构，而是表示证书将使用给定的私钥“对自己进行签名”。 换句话说，证书的私钥将用于对证书本身进行签名。 >[info] 每个签的证书，对应的ca都不是同一个。 ```shell cat <<'EOF' | kubectl apply -f - apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: selfsigned-cluster-issuer spec: selfSigned: {} EOF ``` # CA ⚠️ CA 颁发者代表证书颁发机构，其证书和私钥作为 Kubernetes 存储在集群内Secret 0. 生成ca证书 ```shell mkdir /tmp/pki && cd /tmp/pki openssl genrsa -out ca.key 2048 cat <<-EOF | sudo tee ca-csr.conf > /dev/null [ req ] default_bits = 2048 prompt = no default_md = sha256 req_extensions = req_ext distinguished_name = dn [ dn ] CN = ecloud-ca [ req_ext ] subjectAltName = @alt_names [ alt_names ] DNS.1 = ecloud-ca [ v3_ext ] keyUsage=Digital Signature, Key Encipherment, Certificate Sign basicConstraints=CA:TRUE subjectKeyIdentifier=hash subjectAltName=@alt_names EOF openssl req -x509 -new -nodes -key ca.key -days 36500 -out ca.crt -config ca-csr.conf -extensions v3_ext ``` 1. 将ca证书保存secret里面 >[danger] secret需要保存在安装cert-manager程序的命名空间下，这里保存的是 `kube-system` 命名空间，请改成实际安装的命名空间 ```shell kubectl -n kube-system create secret tls ca-key-pair --cert=/tmp/pki/ca.crt --key=/tmp/pki/ca.key # 确认secret创建情况 kubectl -n kube-system get secret --field-selector type=kubernetes.io/tls ``` 2. 创建clusterissuer ```shell cat <<'EOF' | kubectl apply -f - apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: ca-cluster-issuer spec: ca: secretName: ca-key-pair EOF ```