数字签名>> kube-csr>> 返回
项目作者： JulienBalestra

项目描述 ：
Generate, submit, approve, fetch, renew and purge certificates in Kubernetes
高级语言： Go
项目地址: git://github.com/JulienBalestra/kube-csr.git
创建时间： 2018-05-26T13:58:01Z
项目社区：https://github.com/JulienBalestra/kube-csr
开源协议：Other
下载


Kubernetes Certificate Signing Request

CircleCI Build Status Go Report Card Docker Repository on Quay

Table of Contents

Issue

All in one:

  • query Kubernetes service to get potential subject alternative name (SAN)
    • ClusterIP
    • ExternalIPs
    • LoadBalancerIP
    • ExternalName
  • generate
    • Private Key - stay on disk
    • Certificate Signing Request (CSR)
  • submit the generated CSR
  • approve the submitted CSR
  • fetch the generated certificate
  • delete the kubernetes csr resource

But you can also choose to select the steps you want to execute.

For example, you can do the following actions:

  • generate the PK, CSR
  • submit the generated CSR
  • approve the submitted CSR
  • fetch the generated externally approved certificate
  • delete the kubernetes csr resource

diagram

Renew

You can choose to add a sidecar to proceed to a periodic renew with, at least the following operations:

  • submit the generated CSR
  • fetch the generated externally approved certificate

A common scenario could be to automatically approve the submitted CSR like:

  • use the previously generated files (private_key, csr)
  • submit the generated CSR
  • approve the submitted CSR
  • fetch the generated certificate

Garbage collector - gc

Delete any Kubernetes csr resources who meets the chosen requirements:

  • After the grace period
    • Annotated as fetched
    • Denied

The garbage collector can be daemonized with the adapted flags.

When daemonised, it exposes a prometheus endpoint with the associated metrics and a pprof endpoint.

Demo

asciicast

Container image

Available at quay.io/julienbalestra/kube-csr:latest

The tag latest is up to date with master.

Please, have a look to the release page to get a more stable image tag.

Command line

Command line example:

  1. $ ./kube-csr issue etcd --generate --submit --approve --fetch --subject-alternative-names 192.168.1.1,example.com --kubeconfig-path ~/.kube/config
  3. I0610 21:07:49.737337    5259 generate.go:59] Added IP address 192.168.1.1
  4. I0610 21:07:49.737541    5259 generate.go:64] Added DNS name example.com
  5. I0610 21:07:49.737547    5259 generate.go:73] CSR with 1 DNS names and 1 IP addresses
  6. I0610 21:07:49.737553    5259 generate.go:94] Generating CSR with CN=etcd
  7. I0610 21:07:49.740107    5259 write.go:57] Wrote RSA PRIVATE KEY to /home/jb/go/src/github.com/JulienBalestra/kube-csr/kube-csr.private_key
  8. I0610 21:07:49.740142    5259 write.go:57] Wrote CERTIFICATE REQUEST to /home/jb/go/src/github.com/JulienBalestra/kube-csr/kube-csr.csr
  9. I0610 21:07:49.750902    5259 submit.go:93] Successfully created csr/etcd-haf uid: 9163ed79-6ce1-11e8-a2ef-5404a66983a9
  10. I0610 21:07:49.750932    5259 approve.go:38] Approving csr/etcd-haf ...
  11. I0610 21:07:49.753173    5259 approve.go:49] csr/etcd-haf is approved
  12. I0610 21:07:49.753192    5259 fetch.go:97] Start polling for certificate of csr/etcd-haf, every 1s, timeout after 10s
  13. I0610 21:07:50.759603    5259 fetch.go:128] Certificate successfully fetched, writing 1200 chars to /home/jb/go/src/github.com/JulienBalestra/kube-csr/kube-csr.certificate

The --override flag allows to delete and re-submit an already submitted CSR.

To get the following files:

  1. kube-csr.certificate kube-csr.csr kube-csr.private_key
  1. $ openssl x509 -in kube-csr.certificate -text -noout
  3. Certificate:
  4.         Issuer: CN = p8s
  5.         Subject: CN = etcd
  6.             X509v3 Subject Alternative Name: 
  7.                 DNS:etcd-0.default.svc.cluster.local, IP Address:192.168.1.1

Observe in the controller-manager logs:

  1. $ kubectl logs po/kube-controller-manager -n kube-system
  3. [INFO] signed certificate with serial number [...]

Have a look the the command line documentation here

In cluster

The current Kubernetes setup is deployed with pupernetes
In this example, the all in one etcd example is used.

Current cluster:

  1. $ kubectl get svc,deploy,ds,po --all-namespaces
  3. NAMESPACE     NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
  4. default       kubernetes   ClusterIP   192.168.254.1   <none>        443/TCP         1m
  5. kube-system   coredns      ClusterIP   192.168.254.2   <none>        53/UDP,53/TCP   1m
  7. NAMESPACE     NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
  8. kube-system   coredns   1         1         1            1           1m
  10. NAMESPACE     NAME             DESIRED   CURRENT   READY     UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
  11. kube-system   kube-proxy       1         1         1         1            1           <none>          1m
  12. kube-system   kube-scheduler   1         1         1         1            1           <none>          1m
  14. NAMESPACE     NAME                       READY     STATUS    RESTARTS   AGE
  15. kube-system   coredns-747dbcf5df-zllhm   1/1       Running   0          1m
  16. kube-system   kube-controller-manager    1/1       Running   0          1m
  17. kube-system   kube-proxy-2z9vw           1/1       Running   0          1m
  18. kube-system   kube-scheduler-v8lwc       1/1       Running   0          1m

Apply the manifests:

  1. $ kubectl apply -f examples/etcd.yaml 
  3. serviceaccount "etcd" created
  4. clusterrole.rbac.authorization.k8s.io "system:etcd" created
  5. clusterrolebinding.rbac.authorization.k8s.io "system:etcd" created
  6. statefulset.apps "etcd" created
  7. job.batch "etcdctl" created
  8. service "etcd" created

Produce:

  1. $ kubectl get csr,po --show-all
  3. NAME                                              AGE       REQUESTOR                            CONDITION
  4. csr/etcd-0-140d1b66-6ce3-11e8-a2ef-5404a66983a9   1m        system:serviceaccount:default:etcd   Approved,Issued
  5. csr/etcd-1-173e7ddd-6ce3-11e8-a2ef-5404a66983a9   1m        system:serviceaccount:default:etcd   Approved,Issued
  6. csr/etcd-2-1a6a22a1-6ce3-11e8-a2ef-5404a66983a9   59s       system:serviceaccount:default:etcd   Approved,Issued
  8. NAME        READY     STATUS    RESTARTS   AGE
  9. po/etcd-0   1/1       Running   0          1m
  10. po/etcd-1   1/1       Running   0          1m
  11. po/etcd-2   1/1       Running   0          1m

Observe the logs of the init container kube-csr:

  1. $ kubectl logs etcd-0 kube-csr
  3. I0610 19:18:39.760447       1 generate.go:59] Added IP address 172.17.0.2
  4. I0610 19:18:39.760763       1 generate.go:64] Added DNS name etcd-0.etcd.default.svc.cluster.local
  5. I0610 19:18:39.760768       1 generate.go:64] Added DNS name etcd.default.svc.cluster.local
  6. I0610 19:18:39.760772       1 generate.go:73] CSR with 2 DNS names and 1 IP addresses
  7. I0610 19:18:39.760776       1 generate.go:94] Generating CSR with CN=etcd-0
  8. I0610 19:18:39.765065       1 write.go:57] Wrote RSA PRIVATE KEY to /etc/certs/etcd.private_key
  9. I0610 19:18:39.765174       1 write.go:57] Wrote CERTIFICATE REQUEST to /etc/certs/etcd.csr
  10. I0610 19:18:39.774289       1 submit.go:93] Successfully created csr/etcd-0-140d1b66-6ce3-11e8-a2ef-5404a66983a9 uid: 14d5bba8-6ce3-11e8-a2ef-5404a66983a9
  11. I0610 19:18:39.774306       1 approve.go:38] Approving csr/etcd-0-140d1b66-6ce3-11e8-a2ef-5404a66983a9 ...
  12. I0610 19:18:39.838744       1 approve.go:49] csr/etcd-0-140d1b66-6ce3-11e8-a2ef-5404a66983a9 is approved
  13. I0610 19:18:39.838774       1 fetch.go:97] Start polling for certificate of csr/etcd-0-140d1b66-6ce3-11e8-a2ef-5404a66983a9, every 1s, timeout after 10s
  14. I0610 19:18:40.841823       1 fetch.go:127] Certificate successfully fetched, writing 1281 chars to /etc/certs/etcd.certificate

See the output of the completed Job:

  1. $ kubectl logs etcdctl-${ID}
  3. [...]
  4. member 6c254b8f2d60eb6a is healthy: got healthy result from https://etcd-2.etcd.default.svc.cluster.local:2379
  5. member 6ca04f5d282b7cd5 is healthy: got healthy result from https://etcd-0.etcd.default.svc.cluster.local:2379
  6. member 891a4cb0531d4224 is healthy: got healthy result from https://etcd-1.etcd.default.svc.cluster.local:2379
  7. cluster is healthy

Library

Please see an example to use kube-csr as library here

  1. go get github.com/JulienBalestra/kube-csr/pkg/operation/...

Features - Enhancement

Please, create an issue !