Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 2625aef

Browse files
windsonseawindsonsea
committedMar 13, 2025·
[zh] Add tls/certificate-issue-client-csr.md
1 parent a8162ed commit 2625aef

File tree

1 file changed

+316
-0
lines changed

1 file changed

+316
-0
lines changed
 

‎content/zh-cn/docs/tasks/tls/certificate-issue-client-csr.md

+316
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,316 @@
1+
---
2+
title: 使用 CertificateSigningRequest 为 Kubernetes API 客户端颁发证书
3+
api_metadata:
4+
- apiVersion: "certificates.k8s.io/v1"
5+
kind: "CertificateSigningRequest"
6+
override_link_text: "CSR v1"
7+
weight: 80
8+
9+
# 文档维护说明
10+
#
11+
# 如果将来新增页面 /docs/tasks/tls/certificate-issue-client-manually/
12+
# 那么需要在此页面添加新的交叉引用链接，而新增的页面也应链接回此页面
13+
---
14+
<!--
15+
title: Issue a Certificate for a Kubernetes API Client Using A CertificateSigningRequest
16+
api_metadata:
17+
- apiVersion: "certificates.k8s.io/v1"
18+
kind: "CertificateSigningRequest"
19+
override_link_text: "CSR v1"
20+
weight: 80
21+
22+
# Docs maintenance note
23+
#
24+
# If there is a future page /docs/tasks/tls/certificate-issue-client-manually/ then this page
25+
# should link there, and the new page should link back to this one.
26+
-->
27+
28+
<!-- overview -->
29+
30+
<!--
31+
Kubernetes lets you use a public key infrastructure (PKI) to authenticate to your cluster
32+
as a client.
33+
34+
A few steps are required in order to get a normal user to be able to
35+
authenticate and invoke an API. First, this user must have an [X.509](https://www.itu.int/rec/T-REC-X.509) certificate
36+
issued by an authority that your Kubernetes cluster trusts. The client must then present that certificate to the Kubernetes API.
37+
-->
38+
Kubernetes 允许你使用公钥基础设施 (PKI) 作为客户端对集群进行身份认证。
39+
40+
为了让普通用户能够认证并调用 API，需要执行几个步骤。首先，此用户必须拥有由你的
41+
Kubernetes 集群所信任的权威机构颁发的 [X.509](https://www.itu.int/rec/T-REC-X.509)
42+
证书。之后客户端必须向 Kubernetes API 提交该证书。
43+
44+
<!--
45+
You use a [CertificateSigningRequest](/concepts/security/certificate-signing-requests/)
46+
as part of this process, and either you or some other principal must approve the request.
47+
48+
You will create a private key, and then get a certificate issued, and finally configure
49+
that private key for a client.
50+
-->
51+
在这个过程中，你需要使用
52+
[CertificateSigningRequest](/zh-cn/concepts/security/certificate-signing-requests/)，并且你或其他主体必须批准此请求。
53+
54+
你将创建私钥，然后获取颁发的证书，最后为客户端配置该私钥。
55+
56+
## {{% heading "prerequisites" %}}
57+
58+
* {{< include "task-tutorial-prereqs.md" >}}
59+
60+
<!--
61+
* You need the `kubectl`, `openssl` and `base64` utilities.
62+
63+
This page assumes you are using Kubernetes {{< glossary_tooltip term_id="rbac" text="role based access control" >}} (RBAC).
64+
If you have alternative or additional security mechanisms around authorization, you need to account for those as well.
65+
-->
66+
* 你需要 `kubectl`、`openssl` 和 `base64` 实用工具。
67+
68+
此页面假设你使用的是 Kubernetes {{< glossary_tooltip term_id="rbac" text="基于角色的访问控制" >}} (RBAC)。
69+
如果你在鉴权方面有替代或额外的安全机制，也需要将其考虑在内。
70+
71+
<!-- steps -->
72+
73+
<!--
74+
## Create private key
75+
76+
In this step, you create a private key. You need to keep this document secret; anyone who has it can impersonate the user.
77+
78+
```shell
79+
# Create a private key
80+
openssl genrsa -out myuser.key 3072
81+
```
82+
-->
83+
## 创建私钥 {#create-private-key}
84+
85+
在这一步中，你将创建一个私钥。你需要对此文件保密，因为任何拥有私钥的人都可以伪装成该用户。
86+
87+
```shell
88+
# 创建一个私钥
89+
openssl genrsa -out myuser.key 3072
90+
```
91+
92+
<!--
93+
## Create an X.509 certificate signing request {#create-x.509-certificatessigningrequest}
94+
-->
95+
## 创建 X.509 证书签名请求 {#create-x.509-certificatessigningrequest}
96+
97+
{{< note >}}
98+
<!--
99+
This is not the same as the similarly-named CertificateSigningRequest API; the file you generate here goes into the
100+
CertificateSigningRequest.
101+
-->
102+
这与类似名称的 CertificateSigningRequest API 不同；你在此处生成的文件将放入 CertificateSigningRequest。
103+
{{< /note >}}
104+
105+
<!--
106+
It is important to set CN and O attribute of the CSR. CN is the name of the user and O is the group that this user will belong to.
107+
You can refer to [RBAC](/docs/reference/access-authn-authz/rbac/) for standard groups.
108+
109+
```shell
110+
# Change the common name "myuser" to the actual username that you want to use
111+
openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser"
112+
```
113+
-->
114+
设置 CSR 的 CN 和 O 属性非常重要。CN 是用户的名称，O 是此用户所属的组。
115+
你可以参阅 [RBAC](/zh-cn/docs/reference/access-authn-authz/rbac/) 了解标准的组。
116+
117+
```shell
118+
# 将通用名称 "myuser" 更改为你要使用的实际用户名
119+
openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser"
120+
```
121+
122+
<!--
123+
## Create a Kubernetes CertificateSigningRequest {#create-k8s-certificatessigningrequest}
124+
125+
Encode the CSR document using this command:
126+
-->
127+
## 创建 Kubernetes CertificateSigningRequest {#create-k8s-certificatessigningrequest}
128+
129+
使用以下命令对 CSR 文档进行编码：
130+
131+
```shell
132+
cat myuser.csr | base64 | tr -d "\n"
133+
```
134+
135+
<!--
136+
Create a [CertificateSigningRequest](/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1/)
137+
and submit it to a Kubernetes Cluster via kubectl. Below is a snippet of shell that you can use to generate the
138+
CertificateSigningRequest.
139+
-->
140+
创建 [CertificateSigningRequest](/zh-cn/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1/)
141+
并通过 kubectl 将其提交到 Kubernetes 集群。以下是你可以用于生成 CertificateSigningRequest 的 Shell 片段。
142+
143+
<!--
144+
# example
145+
# This is an encoded CSR. Change this to the base64-encoded contents of myuser.csr
146+
-->
147+
```shell
148+
cat <<EOF | kubectl apply -f -
149+
apiVersion: certificates.k8s.io/v1
150+
kind: CertificateSigningRequest
151+
metadata:
152+
name: myuser # 示例
153+
spec:
154+
# 这是已编码的 CSR。将此更改为 myuser.csr 的经 base64 编码的内容
155+
request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0dZVzVuWld4aE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQTByczhJTHRHdTYxakx2dHhWTTJSVlRWMDNHWlJTWWw0dWluVWo4RElaWjBOCnR2MUZtRVFSd3VoaUZsOFEzcWl0Qm0wMUFSMkNJVXBGd2ZzSjZ4MXF3ckJzVkhZbGlBNVhwRVpZM3ExcGswSDQKM3Z3aGJlK1o2MVNrVHF5SVBYUUwrTWM5T1Nsbm0xb0R2N0NtSkZNMUlMRVI3QTVGZnZKOEdFRjJ6dHBoaUlFMwpub1dtdHNZb3JuT2wzc2lHQ2ZGZzR4Zmd4eW8ybmlneFNVekl1bXNnVm9PM2ttT0x1RVF6cXpkakJ3TFJXbWlECklmMXBMWnoyalVnald4UkhCM1gyWnVVV1d1T09PZnpXM01LaE8ybHEvZi9DdS8wYk83c0x0MCt3U2ZMSU91TFcKcW90blZtRmxMMytqTy82WDNDKzBERHk5aUtwbXJjVDBnWGZLemE1dHJRSURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBR05WdmVIOGR4ZzNvK21VeVRkbmFjVmQ1N24zSkExdnZEU1JWREkyQTZ1eXN3ZFp1L1BVCkkwZXpZWFV0RVNnSk1IRmQycVVNMjNuNVJsSXJ3R0xuUXFISUh5VStWWHhsdnZsRnpNOVpEWllSTmU3QlJvYXgKQVlEdUI5STZXT3FYbkFvczFqRmxNUG5NbFpqdU5kSGxpT1BjTU1oNndLaTZzZFhpVStHYTJ2RUVLY01jSVUyRgpvU2djUWdMYTk0aEpacGk3ZnNMdm1OQUxoT045UHdNMGM1dVJVejV4T0dGMUtCbWRSeEgvbUNOS2JKYjFRQm1HCkkwYitEUEdaTktXTU0xMzhIQXdoV0tkNjVoVHdYOWl4V3ZHMkh4TG1WQzg0L1BHT0tWQW9FNkpsYWFHdTlQVmkKdjlOSjVaZlZrcXdCd0hKbzZXdk9xVlA3SVFjZmg3d0drWm89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
156+
signerName: kubernetes.io/kube-apiserver-client
157+
expirationSeconds: 86400 # one day
158+
usages:
159+
- client auth
160+
EOF
161+
```
162+
163+
<!--
164+
Some points to note:
165+
166+
- `usages` has to be `client auth`
167+
- `expirationSeconds` could be made longer (i.e. `864000` for ten days) or shorter (i.e. `3600` for one hour).
168+
You cannot request a duration shorter than 10 minutes.
169+
- `request` is the base64 encoded value of the CSR file content.
170+
-->
171+
一些注意点：
172+
173+
- `usages` 必须是 `client auth`
174+
- `expirationSeconds` 可以设置得更长（例如 `864000` 表示十天）或更短（例如 `3600` 表示一小时）。
175+
你不能请求短于 10 分钟的持续时间。
176+
- `request` 是 CSR 文件内容的 base64 编码值。
177+
178+
<!--
179+
## Approve the CertificateSigningRequest {#approve-certificate-signing-request}
180+
181+
Use kubectl to find the CSR you made, and manually approve it.
182+
183+
Get the list of CSRs:
184+
-->
185+
## 批准 CertificateSigningRequest {#approve-certificate-signing-request}
186+
187+
使用 kubectl 找到你创建的 CSR，并手动批准它。
188+
189+
获取 CSR 列表：
190+
191+
```shell
192+
kubectl get csr
193+
```
194+
195+
<!--
196+
Approve the CSR:
197+
-->
198+
批准 CSR：
199+
200+
```shell
201+
kubectl certificate approve myuser
202+
```
203+
204+
<!--
205+
## Get the certificate
206+
207+
Retrieve the certificate from the CSR, to check it looks OK.
208+
-->
209+
## 获取证书 {#get-the-certificate}
210+
211+
从 CSR 中检索证书，以检查其是否正常。
212+
213+
```shell
214+
kubectl get csr/myuser -o yaml
215+
```
216+
217+
<!--
218+
The certificate value is in Base64-encoded format under `.status.certificate`.
219+
220+
Export the issued certificate from the CertificateSigningRequest.
221+
-->
222+
证书值以 Base64 编码格式显示在 `.status.certificate` 下。
223+
224+
从 CertificateSigningRequest 导出已颁发的证书。
225+
226+
```shell
227+
kubectl get csr myuser -o jsonpath='{.status.certificate}'| base64 -d > myuser.crt
228+
```
229+
230+
<!--
231+
## Configure the certificate into kubeconfig
232+
233+
The next step is to add this user into the kubeconfig file.
234+
235+
First, you need to add new credentials:
236+
-->
237+
## 将证书配置到 kubeconfig 中 {#configure-the-certificate-into-kubeconfig}
238+
239+
下一步是将此用户添加到 kubeconfig 文件中。
240+
241+
首先，你需要添加新的凭证：
242+
243+
```shell
244+
kubectl config set-credentials myuser --client-key=myuser.key --client-certificate=myuser.crt --embed-certs=true
245+
```
246+
247+
<!--
248+
Then, you need to add the context:
249+
-->
250+
然后，你需要添加上下文：
251+
252+
```shell
253+
kubectl config set-context myuser --cluster=kubernetes --user=myuser
254+
```
255+
256+
<!--
257+
To test it:
258+
-->
259+
对其执行测试：
260+
261+
```shell
262+
kubectl --context myuser auth whoami
263+
```
264+
265+
<!--
266+
You should see output confirming that you are “myuser“.
267+
268+
## Create Role and RoleBinding
269+
-->
270+
你应该看到确认你是 “myuser” 的输出。
271+
272+
## 创建 Role 和 RoleBinding {#create-role-and-rolebinding}
273+
274+
{{< note >}}
275+
<!--
276+
If you don't use Kubernetes RBAC, skip this step and make the appropriate changes for the authorization mechanism
277+
your cluster actually uses.
278+
-->
279+
如果你不使用 Kubernetes RBAC，请跳过这一步，并对集群实际使用的鉴权机制进行适当更改。
280+
{{< /note >}}
281+
282+
<!--
283+
With the certificate created it is time to define the Role and RoleBinding for
284+
this user to access Kubernetes cluster resources.
285+
286+
This is a sample command to create a Role for this new user:
287+
-->
288+
创建证书之后，就可以为此用户定义 Role 和 RoleBinding，以访问 Kubernetes 集群资源。
289+
290+
这是为新用户创建 Role 的示例命令：
291+
292+
```shell
293+
kubectl create role developer --verb=create --verb=get --verb=list --verb=update --verb=delete --resource=pods
294+
```
295+
296+
<!--
297+
This is a sample command to create a RoleBinding for this new user:
298+
-->
299+
这是为新用户创建 RoleBinding 的示例命令：
300+
301+
```shell
302+
kubectl create rolebinding developer-binding-myuser --role=developer --user=myuser
303+
```
304+
305+
## {{% heading "whatsnext" %}}
306+
307+
<!--
308+
* Read [Manage TLS Certificates in a Cluster](/docs/tasks/tls/managing-tls-in-a-cluster/)
309+
* For details of X.509 itself, refer to [RFC 5280](https://tools.ietf.org/html/rfc5280#section-3.1) section 3.1
310+
* For information on the syntax of PKCS#10 certificate signing requests, refer to [RFC 2986](https://tools.ietf.org/html/rfc2986)
311+
* Read about [ClusterTrustBundles](/docs/reference/access-authn-authz/certificate-signing-requests/#cluster-trust-bundles)
312+
-->
313+
* 阅读[管理集群中的 TLS 证书](/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)
314+
* 有关 X.509 本身的细节，参阅 [RFC 5280](https://tools.ietf.org/html/rfc5280#section-3.1) 第 3.1 节
315+
* 有关 PKCS#10 证书签名请求的语法信息，请参阅 [RFC 2986](https://tools.ietf.org/html/rfc2986)
316+
* 参阅 [ClusterTrustBundles](/zh-cn/docs/reference/access-authn-authz/certificate-signing-requests/#cluster-trust-bundles)

0 commit comments

Comments
 (0)
Please sign in to comment.