Kubernetes Kubelet安全認證連接Apiserver

Kubelet使用安全認證連接Apiserver，可以用Token或證書連接。配置步驟如下。

1，生成Token命令

head -c 16 /dev/urandom | od -An -t x | tr -d ' '

2，生成TLS證書

需要三個文件 ca.crt kubeadmin.crt kubeadmin.key

生成證書命令請參考http://www.cnblogs.com/birdstudio/p/7660068.html

3，配置Kubelet

KUBELET_ARGS="--bootstrap-kubeconfig=./kubeconfig"

kubeconfig文件

apiVersion: v1
kind: Config
preferences: {}

clusters:
- name: local
  cluster:
    server: https://39.108.97.109:6443
    certificate-authority: /root/kubernetes/ca.crt

users:
- name: kubelet-bootstrap
  user:
    token: 863f4582d6f5eb82a59089c971b785c3
  name: kubeadmin
  user:
    client-certificate: /root/kubernetes/kubeadmin.crt
    client-key: /root/kubernetes/kubeadmin.key

contexts:
- name: dev-frontend
  context:
    cluster: local
    user: kubeadmin

current-context: dev-frontend

參考資料

TLS Bootstrapping