Skip to content

K
k3s
Commit 29625a9f authored by qiaolei's avatar qiaolei
Browse files
Options

Fix Jenkins GCE e2e failure and other errors in APPENDIX easyrsa section

Modifications are as following(`APPENDIX` -> `**easyrsa**`): 1, fix Jenkins GCE e2e failure, mainly for markdown errors; 2, change `"${MASTER_IP}"` to `"IP:${MASTER_IP}"` to keep align with `make-ca-cert.sh` 3, change `/pki/` to `pki/` for the generated certs/key 4, other tiny improvements Please check, thanks.
parent c17977b6
Hide whitespace changes
Inline Side-by-side
Showing with 12 additions and 9 deletions
docs/admin/authentication.md
View file @ 29625a9f
...@@ -120,17 +120,20 @@ into apiserver start parameters. ...@@ -120,17 +120,20 @@ into apiserver start parameters.
**easyrsa** can be used to manually generate certificates for your cluster. **easyrsa** can be used to manually generate certificates for your cluster.
1. Download, unpack, and initialize the patched version of easyrsa3. 1. Download, unpack, and initialize the patched version of easyrsa3.
`curl -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz`
`tar xzf easy-rsa.tar.gz` curl -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
`cd easy-rsa-master/easyrsa3` tar xzf easy-rsa.tar.gz
`./easyrsa init-pki` cd easy-rsa-master/easyrsa3
1. Generate a CA. (--batch set automatic mode. --req-cn default CN to use.) ./easyrsa init-pki
``./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass`` 1. Generate a CA. (`--batch` set automatic mode. `--req-cn` default CN to use.)
./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass
1. Generate server certificate and key. 1. Generate server certificate and key.
(build-server-full [filename]: Generate a keypair and sign locally for a client or server) (build-server-full [filename]: Generate a keypair and sign locally for a client or server)
`./easyrsa --subject-alt-name="${MASTER_IP}" build-server-full kubernetes-master nopass`
1. Copy /pki/ca.crt /pki/issued/kubernetes-master.crt ./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full kubernetes-master nopass
/pki/private/kubernetes-master.key to your directory. 1. Copy `pki/ca.crt` `pki/issued/kubernetes-master.crt`
`pki/private/kubernetes-master.key` to your directory.
1. Remember fill the parameters 1. Remember fill the parameters
`--client-ca-file=/yourdirectory/ca.crt` `--client-ca-file=/yourdirectory/ca.crt`
`--tls-cert-file=/yourdirectory/server.cert` `--tls-cert-file=/yourdirectory/server.cert`
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment