Vault PKI Intermediate SETUP CAs for ALL SERVICES Kubernetes the hard way v2: различия между версиями
Sirmax (обсуждение | вклад) |
Sirmax (обсуждение | вклад) |
||
(не показано 7 промежуточных версий этого же участника) | |||
Строка 34: | Строка 34: | ||
=tls= |
=tls= |
||
− | + | Для всех TLS-PKI <code>k8s_pki_intermediate_ca_for_service_kube_apiserver_tls/</code> |
|
− | + | <code>k8s_pki_intermediate_ca_for_service_kube_controller_manager_tls/</code> |
|
− | + | <code>k8s_pki_intermediate_ca_for_service_kube_scheduler_tls/</code> |
|
− | + | <code>k8s_pki_intermediate_ca_for_service_kubelet_tls/</code> в целом настройка практически одинаковая, и состоит из одних и тех же шагов. |
|
+ | ==Общие переменные== |
||
− | =<code>k8s_pki_intermediate_ca_for_service_kube_apiserver_client_auth/</code>= |
||
+ | <PRE> |
||
− | =<code>k8s_pki_intermediate_ca_for_service_kubelet_client_auth/</code>= |
||
+ | #!/bin/bash |
||
+ | |||
+ | |||
+ | export SERVICE_NAME='kube-apiserver' |
||
+ | #export SERVICE_NAME="kube-controller-manager" |
||
+ | #export SERVICE_NAME="kube-scheduler" |
||
+ | #export SERVICE_NAME="kubelet" |
||
+ | |||
+ | export PKI_PATH_PREFIX="k8s_pki_intermediate_ca_for_service" |
||
+ | export USAGE="TLS" |
||
+ | |||
+ | |||
+ | export SERVICE_NAME_UNDERSCORE=$(echo ${SERVICE_NAME} | sed 's/-/_/g') |
||
+ | export USAGE_LOWERCASE=$(echo "${USAGE,,}") |
||
+ | |||
+ | |||
+ | export PKI_PATH="${PKI_PATH_PREFIX}_${SERVICE_NAME_UNDERSCORE}_${USAGE_LOWERCASE}" |
||
+ | |||
+ | |||
+ | export VAULT_ADDR=http://vault.home:8200 |
||
+ | export VAULT_TOKEN="s.Yb1J2VamFyYoav3VVE2YQQ88" |
||
+ | |||
+ | export INTERMEDIATE_CA_DESCRIPTION="PKI Intermediate CA for K8S: ${SERVICE_NAME} ${USAGE}" |
||
+ | |||
+ | |||
+ | COMMON_NAME="Intermediate CA for service ${SERVICE_NAME} ${USAGE}" |
||
+ | COUNTRY="Ukraine" |
||
+ | LOCALITY="Kharkov" |
||
+ | STREET_ADDRESS="Lui Pastera st. 322 app. 131" |
||
+ | POSTAL_CODE="61172" |
||
+ | ORGNIZATION="K8s The Hardest Way Labs" |
||
+ | OU="IT" |
||
+ | TTL="175200h" |
||
+ | |||
+ | MAX_LEASE_TIME="175200h" |
||
+ | |||
+ | |||
+ | COMMON_SETTINGS=() |
||
+ | COMMON_SETTINGS+=( "common_name=${COMMON_NAME}") |
||
+ | COMMON_SETTINGS+=( "country=${COUNTRY}" ) |
||
+ | COMMON_SETTINGS+=( "locality=${LOCALITY}" ) |
||
+ | COMMON_SETTINGS+=( "street_address=${STREET_ADDRESS}" ) |
||
+ | COMMON_SETTINGS+=( "postal_address=${POSTAL_CODE}" ) |
||
+ | COMMON_SETTINGS+=( "organization=${ORGNIZATION}" ) |
||
+ | COMMON_SETTINGS+=( "ou=${OU}" ) |
||
+ | COMMON_SETTINGS+=( "ttl=${TTL}" ) |
||
+ | </PRE> |
||
+ | ==01_create_intermnediate_endpoints.sh== |
||
+ | <PRE> |
||
+ | #!/bin/bash |
||
+ | |||
+ | set -eu${DEBUG:+x} |
||
+ | |||
+ | source 00_env.sh |
||
+ | |||
+ | |||
+ | # Delete if exists or ignore error |
||
+ | |||
+ | vault \ |
||
+ | secrets \ |
||
+ | disable \ |
||
+ | ${PKI_PATH} || true |
||
+ | |||
+ | vault \ |
||
+ | secrets \ |
||
+ | enable \ |
||
+ | -path=${PKI_PATH} \ |
||
+ | -description="${INTERMEDIATE_CA_DESCRIPTION}" \ |
||
+ | -max-lease-ttl="${MAX_LEASE_TIME}" \ |
||
+ | pki |
||
+ | </PRE> |
||
+ | ==02_create_cert_request.sh== |
||
+ | <PRE> |
||
+ | #!/bin/bash |
||
+ | |||
+ | set -eu${DEBUG:+x} |
||
+ | |||
+ | source 00_env.sh |
||
+ | |||
+ | vault \ |
||
+ | write \ |
||
+ | -format=json \ |
||
+ | ${PKI_PATH}/intermediate/generate/exported \ |
||
+ | "${COMMON_SETTINGS[@]}" > ${PKI_PATH}.json |
||
+ | |||
+ | |||
+ | cat ${PKI_PATH}.json | jq -r '.data.csr' > ${PKI_PATH}_intermediate_ca.csr |
||
+ | cat ${PKI_PATH}.json | jq -r '.data.private_key' > ${PKI_PATH}_intermediate_ca.key |
||
+ | </PRE> |
||
+ | ==03_create_cert_based_on_csr.sh== |
||
+ | <PRE> |
||
+ | #!/bin/bash |
||
+ | |||
+ | set -eu${DEBUG:+x} |
||
+ | |||
+ | source 00_env.sh |
||
+ | |||
+ | vault \ |
||
+ | write \ |
||
+ | -format=json \ |
||
+ | k8s_pki_root_ca/root/sign-intermediate \ |
||
+ | csr=@${PKI_PATH}_intermediate_ca.csr \ |
||
+ | "${COMMON_SETTINGS[@]}" > ${PKI_PATH}_intermediate_ca_pem_bundle.json |
||
+ | |||
+ | |||
+ | cat ${PKI_PATH}_intermediate_ca_pem_bundle.json | jq -r '.data.certificate' > ${PKI_PATH}_intermediate_ca_pem.crt |
||
+ | cat ${PKI_PATH}_intermediate_ca_pem_bundle.json | jq -r '.data.issuing_ca' > k8s_root_certificate.pem |
||
+ | </PRE> |
||
+ | |||
+ | ==04_validate_intermediate_ca.sh== |
||
+ | <PRE> |
||
+ | #!/bin/bash |
||
+ | |||
+ | set -eu${DEBUG:+x} |
||
+ | |||
+ | source 00_env.sh |
||
+ | |||
+ | openssl \ |
||
+ | verify \ |
||
+ | -verbose \ |
||
+ | -CAfile k8s_root_certificate.pem \ |
||
+ | ${PKI_PATH}_intermediate_ca_pem.crt |
||
+ | </PRE> |
||
+ | |||
+ | ==05_load_intermediate_ca_to_vault.sh== |
||
+ | <PRE> |
||
+ | #!/bin/bash |
||
+ | |||
+ | set -eu${DEBUG:+x} |
||
+ | |||
+ | source 00_env.sh |
||
+ | |||
+ | vault \ |
||
+ | write \ |
||
+ | ${PKI_PATH}/intermediate/set-signed \ |
||
+ | certificate=@${PKI_PATH}_intermediate_ca_pem.crt \ |
||
+ | key=@${PKI_PATH}_intermediate_ca.key |
||
+ | </PRE> |
||
+ | ==06_configure_intermediate_ca_urls.sh== |
||
+ | <PRE> |
||
+ | #!/bin/bash |
||
+ | |||
+ | set -eu${DEBUG:+x} |
||
+ | source ./00_env.sh |
||
+ | |||
+ | |||
+ | vault \ |
||
+ | write \ |
||
+ | ${PKI_PATH}/config/urls \ |
||
+ | issuing_certificates="${VAULT_ADDR}/v1/${PKI_PATH}/ca" \ |
||
+ | crl_distribution_points="${VAULT_ADDR}/v1/${PKI_PATH}/crl" |
||
+ | </PRE> |
||
+ | |||
+ | |||
+ | ==07_kube_apiserver_server_cert_role.sh== |
||
+ | |||
+ | ==08_kube_apiserver_server_cert_policy.sh== |
||
+ | ==09_show_all.sh== |
||
+ | |||
+ | =client_auth= |
||
+ | |||
+ | ==<code>k8s_pki_intermediate_ca_for_service_kube_apiserver_client_auth/</code>== |
||
+ | |||
+ | ==<code>k8s_pki_intermediate_ca_for_service_kubelet_client_auth/</code>== |
Текущая версия на 16:02, 7 января 2023
Прежде чем начать
Для понимания ЗАЧЕМ это делается - можно просмотреть Описание СА и сертификатов (которые будут созданы в этой секции)
Однако это не требуется - можно сначала сделать все необходимые настройки, и только после разобрать зачем они нужны
Terraform
По-хорошему эту часть надо делать не скриптами на баше и вызовами vault
, а с помощью terraform
, но пока-что руки не дошли переделать.
Какие есть CA
В этой инсталляции используются следующие CA
k8s_pki_root_ca/
k8s Root CA, Корневой СА, которым подписаны промежуточные СА и только они. Все остальные сертификаты подписаны промежуточными СА.k8s_pki_intermediate_ca_for_service_etcd/
Intermediate CA for ETCd service, СА которым подписываются сертификаты дляetcd
k8s_pki_intermediate_ca_for_service_kube_apiserver_client_auth/
Intermediate CA for K8S: kube-apiserver CLIENT_AUTHk8s_pki_intermediate_ca_for_service_kube_apiserver_tls/
Intermediate CA for K8S: kube-apiserver TLSk8s_pki_intermediate_ca_for_service_kube_controller_manager_tls/
Intermediate CA for K8S: kube-controller-manager TLSk8s_pki_intermediate_ca_for_service_kube_scheduler_tls/
Intermediate CA for K8S: kube-scheduler TLSk8s_pki_intermediate_ca_for_service_kubelet_client_auth/
Intermediate CA for K8S: kubelet CLIENT_AUTHk8s_pki_intermediate_ca_for_service_kubelet_tls/
Intermediate CA for K8S: kubelet TLS
k8s_pki_intermediate_ca_for_service_etcd/
k8s_pki_intermediate_ca_for_service_etcd/
- используется для клиентских и серверных сертификатов etcd
.
Строго говоря, не является частью k8s и настраивается отдельно (Настройка PKI для etcd
)
- для шифрования endpoints
- для авторизации клиентов
tls
Для всех TLS-PKI k8s_pki_intermediate_ca_for_service_kube_apiserver_tls/
k8s_pki_intermediate_ca_for_service_kube_controller_manager_tls/
k8s_pki_intermediate_ca_for_service_kube_scheduler_tls/
k8s_pki_intermediate_ca_for_service_kubelet_tls/
в целом настройка практически одинаковая, и состоит из одних и тех же шагов.
Общие переменные
#!/bin/bash export SERVICE_NAME='kube-apiserver' #export SERVICE_NAME="kube-controller-manager" #export SERVICE_NAME="kube-scheduler" #export SERVICE_NAME="kubelet" export PKI_PATH_PREFIX="k8s_pki_intermediate_ca_for_service" export USAGE="TLS" export SERVICE_NAME_UNDERSCORE=$(echo ${SERVICE_NAME} | sed 's/-/_/g') export USAGE_LOWERCASE=$(echo "${USAGE,,}") export PKI_PATH="${PKI_PATH_PREFIX}_${SERVICE_NAME_UNDERSCORE}_${USAGE_LOWERCASE}" export VAULT_ADDR=http://vault.home:8200 export VAULT_TOKEN="s.Yb1J2VamFyYoav3VVE2YQQ88" export INTERMEDIATE_CA_DESCRIPTION="PKI Intermediate CA for K8S: ${SERVICE_NAME} ${USAGE}" COMMON_NAME="Intermediate CA for service ${SERVICE_NAME} ${USAGE}" COUNTRY="Ukraine" LOCALITY="Kharkov" STREET_ADDRESS="Lui Pastera st. 322 app. 131" POSTAL_CODE="61172" ORGNIZATION="K8s The Hardest Way Labs" OU="IT" TTL="175200h" MAX_LEASE_TIME="175200h" COMMON_SETTINGS=() COMMON_SETTINGS+=( "common_name=${COMMON_NAME}") COMMON_SETTINGS+=( "country=${COUNTRY}" ) COMMON_SETTINGS+=( "locality=${LOCALITY}" ) COMMON_SETTINGS+=( "street_address=${STREET_ADDRESS}" ) COMMON_SETTINGS+=( "postal_address=${POSTAL_CODE}" ) COMMON_SETTINGS+=( "organization=${ORGNIZATION}" ) COMMON_SETTINGS+=( "ou=${OU}" ) COMMON_SETTINGS+=( "ttl=${TTL}" )
01_create_intermnediate_endpoints.sh
#!/bin/bash set -eu${DEBUG:+x} source 00_env.sh # Delete if exists or ignore error vault \ secrets \ disable \ ${PKI_PATH} || true vault \ secrets \ enable \ -path=${PKI_PATH} \ -description="${INTERMEDIATE_CA_DESCRIPTION}" \ -max-lease-ttl="${MAX_LEASE_TIME}" \ pki
02_create_cert_request.sh
#!/bin/bash set -eu${DEBUG:+x} source 00_env.sh vault \ write \ -format=json \ ${PKI_PATH}/intermediate/generate/exported \ "${COMMON_SETTINGS[@]}" > ${PKI_PATH}.json cat ${PKI_PATH}.json | jq -r '.data.csr' > ${PKI_PATH}_intermediate_ca.csr cat ${PKI_PATH}.json | jq -r '.data.private_key' > ${PKI_PATH}_intermediate_ca.key
03_create_cert_based_on_csr.sh
#!/bin/bash set -eu${DEBUG:+x} source 00_env.sh vault \ write \ -format=json \ k8s_pki_root_ca/root/sign-intermediate \ csr=@${PKI_PATH}_intermediate_ca.csr \ "${COMMON_SETTINGS[@]}" > ${PKI_PATH}_intermediate_ca_pem_bundle.json cat ${PKI_PATH}_intermediate_ca_pem_bundle.json | jq -r '.data.certificate' > ${PKI_PATH}_intermediate_ca_pem.crt cat ${PKI_PATH}_intermediate_ca_pem_bundle.json | jq -r '.data.issuing_ca' > k8s_root_certificate.pem
04_validate_intermediate_ca.sh
#!/bin/bash set -eu${DEBUG:+x} source 00_env.sh openssl \ verify \ -verbose \ -CAfile k8s_root_certificate.pem \ ${PKI_PATH}_intermediate_ca_pem.crt
05_load_intermediate_ca_to_vault.sh
#!/bin/bash set -eu${DEBUG:+x} source 00_env.sh vault \ write \ ${PKI_PATH}/intermediate/set-signed \ certificate=@${PKI_PATH}_intermediate_ca_pem.crt \ key=@${PKI_PATH}_intermediate_ca.key
06_configure_intermediate_ca_urls.sh
#!/bin/bash set -eu${DEBUG:+x} source ./00_env.sh vault \ write \ ${PKI_PATH}/config/urls \ issuing_certificates="${VAULT_ADDR}/v1/${PKI_PATH}/ca" \ crl_distribution_points="${VAULT_ADDR}/v1/${PKI_PATH}/crl"