github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Include system:masters group in the bootstrap admin client certificate

pull/6/head
Jordan Liggitt 2017-01-16 14:01:24 -05:00
parent 9118a1252f
commit 7e98e06e48
No known key found for this signature in database
GPG Key ID: 24E7ADF9A3B42012
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
cluster/common.sh
View File

@ -995,7 +995,12 @@ function generate-certs {
mv "kubelet.pem" "pki/issued/kubelet.crt" mv "kubelet.pem" "pki/issued/kubelet.crt"
rm -f "kubelet.csr" rm -f "kubelet.csr"
./easyrsa build-client-full kubecfg nopass # Make a superuser client cert with subject "O=system:masters, CN=kubecfg"
./easyrsa --dn-mode=org \
--req-cn=kubecfg --req-org=system:masters \
--req-c= --req-st= --req-city= --req-email= --req-ou= \
build-client-full kubecfg nopass
cd ../kubelet cd ../kubelet
./easyrsa init-pki ./easyrsa init-pki
./easyrsa --batch "--req-cn=kubelet@$(date +%s)" build-ca nopass ./easyrsa --batch "--req-cn=kubelet@$(date +%s)" build-ca nopass

6
cluster/saltbase/salt/generate-cert/make-ca-cert.sh
View File

@ -99,7 +99,11 @@ else
cp -p pki/issued/kubernetes-master.crt "${cert_dir}/server.cert" > /dev/null 2>&1 cp -p pki/issued/kubernetes-master.crt "${cert_dir}/server.cert" > /dev/null 2>&1
cp -p pki/private/kubernetes-master.key "${cert_dir}/server.key" > /dev/null 2>&1 cp -p pki/private/kubernetes-master.key "${cert_dir}/server.key" > /dev/null 2>&1
fi fi
./easyrsa build-client-full kubecfg nopass > /dev/null 2>&1 # Make a superuser client cert with subject "O=system:masters, CN=kubecfg"
./easyrsa --dn-mode=org \
--req-cn=kubecfg --req-org=system:masters \
--req-c= --req-st= --req-city= --req-email= --req-ou= \
build-client-full kubecfg nopass > /dev/null 2>&1
cp -p pki/ca.crt "${cert_dir}/ca.crt" cp -p pki/ca.crt "${cert_dir}/ca.crt"
cp -p pki/issued/kubecfg.crt "${cert_dir}/kubecfg.crt" cp -p pki/issued/kubecfg.crt "${cert_dir}/kubecfg.crt"
cp -p pki/private/kubecfg.key "${cert_dir}/kubecfg.key" cp -p pki/private/kubecfg.key "${cert_dir}/kubecfg.key"