关于K8S证书生成方面的脚本草稿

周日在家里计划的。

俺不加班，但在家学习的时间一样没少！

还没弄完，只粗粗弄了etcd证书。

#! /usr/bin/env bash

set -e
set -u
set -x

THIS_HOST=$

 ]; then
  echo "wrong args."
  echo "usage `basename $0` [ip_address]"
  exit
fi

cs="/usr/bin/cfssl"
csj="/usr/bin/cfssljson"
pki_dir="/etc/kubernetes/pki"
LOCAL_IP=$(hostname -I)
CUR_DIR=$(cd $(); pwd)

if ! [[ ${LOCAL_IP} =~ ${THIS_HOST} ]]; then
  echo "ip not in the local ip."
  exit
fi

function caCsr() {
    cat<<EOF>ca-csr.json
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",

  },
  "ca": {
    "expiry": "438000h"
  },
  "names": [
  {
    "C": "CN",
    "ST": "ShangHai",
    "L": "ShangHai",
    "O": "kubernetes",
    "OU": "system"
  }
  ]
}
EOF
}

function caConfig() {
    cat<<EOF>ca-config.json
{
    "signing": {
        "default": {
            "expiry": "438000h"
        },
        "profiles": {
            "server": {
                "expiry": "438000h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "438000h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
                "expiry": "438000h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}
EOF
}

function etcdServer() {
    cat<<EOF>etcd-server.json
{
    "CN": "etcdServer",
    "hosts": [
        "127.0.0.1",
        "localhost",
        "${THIS_HOST}"
    ],
    "key": {
        "algo": "rsa",

    },
    "names": [
        {
            "O": "etcd",
            "OU": "etcd Security",
            "C": "CN",
            "L": "ShangHai",
            "ST": "ShangHai"
        }
    ]
}
EOF
}

function etcdPeer() {
    cat<<EOF>etcd-peer.json
{
    "CN": "etcdPeer",
    "hosts": [
    "127.0.0.1",
    "localhost",
    "${THIS_HOST}"
    ],
    "key": {
        "algo": "rsa",

    },
    "names": [
        {
        "O": "etcd",
        "OU": "etcd Security",
            "C": "CN",
            "L": "ShangHai",
            "ST": "ShangHai"
        }
    ]
}
EOF
}

function etcdClient() {
    cat<<EOF>etcd-client.json
{
    "CN": "etcdClient",
    "key": {
        "algo": "rsa",

    },
    "names": [
        {
        "O": "etcd",
        "OU": "etcd Security",
            "C": "CN",
            "L": "ShangHai",
            "ST": "ShangHai"
        }
    ]
}
EOF
}

function initCert() {
    caCsr
    caConfig
    etcdServer
    etcdPeer
    etcdClient
    $cs gencert -initca  ca-csr.json |$csj -bare ca
    mv ca.pem ca.crt&&mv ca-key.pem ca.key
    $cs gencert -ca=ca.crt -ca-key=ca.key -config=ca-config.json -profile=server etcd-server.json|$csj -bare server
    $cs gencert -ca=ca.crt -ca-key=ca.key -config=ca-config.json -profile=client etcd-client.json|$csj -bare client
    $cs gencert -ca=ca.crt -ca-key=ca.key -config=ca-config.json -profile=peer etcd-peer.json|$csj -bare peer

    cp server.pem $pki_dir/etcd/server.crt&cp server-key.pem $pki_dir/etcd/server.key
    cp client.pem $pki_dir/etcd/healthcheck-client.crt&&cp client-key.pem $pki_dir/etcd/healthcheck-client.key
    cp client.pem $pki_dir/apiserver-etcd-client.crt&&cp client-key.pem $pki_dir/apiserver-etcd-client.key
    cp peer.pem $pki_dir/etcd/peer.crt&&cp peer-key.pem $pki_dir/etcd/peer.key
    cp ca.crt $pki_dir/etcd/ca.crt&&cp ca.key $pki_dir/etcd/ca.key

    rm *.csr&&rm *.json&&rm *.crt&&rm *.key

}

initCert