Deploy GitHub Pages
This commit is contained in:
Travis Bot
parent
7356ddd980
commit
7e487c12b5
38 changed files with 1815 additions and 276 deletions
|
|
@ -1212,7 +1212,15 @@
|
|||
<h2 id="tls-certificates">TLS certificates<a class="headerlink" href="#tls-certificates" title="Permanent link">¶</a></h2>
|
||||
<p>Unless otherwise mentioned, the TLS secret used in examples is a 2048 bit RSA
|
||||
key/cert pair with an arbitrarily chosen hostname, created as follows</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl req -x509 -nodes -days <span class="m">365</span> -newkey rsa:2048 -keyout tls.key -out tls.crt -subj <span class="s2">"/CN=nginxsvc/O=nginxsvc"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl req -x509 -nodes -days <span class="m">365</span> -newkey rsa:2048 -keyout tls.key -out tls.crt -subj <span class="s2">"/CN=nginxsvc/O=nginxsvc"</span>
|
||||
<span class="go">Generating a 2048 bit RSA private key</span>
|
||||
<span class="go">................+++</span>
|
||||
<span class="go">................+++</span>
|
||||
|
|
@ -1222,6 +1230,7 @@ key/cert pair with an arbitrarily chosen hostname, created as follows</p>
|
|||
<span class="gp">$</span> kubectl create secret tls tls-secret --key tls.key --cert tls.crt
|
||||
<span class="go">secret "tls-secret" created</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="ca-authentication">CA Authentication<a class="headerlink" href="#ca-authentication" title="Permanent link">¶</a></h2>
|
||||
<p>You can act as your very own CA, or use an existing one. As an exercise / learning, we're going to generate our
|
||||
|
|
@ -1230,7 +1239,16 @@ own CA, and also generate a client certificate.</p>
|
|||
<h3 id="generating-a-ca">Generating a CA<a class="headerlink" href="#generating-a-ca" title="Permanent link">¶</a></h3>
|
||||
<p>First of all, you've to generate a CA. This is going to be the one who will sign your client certificates.
|
||||
In real production world, you may face CAs with intermediate certificates, as the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl s_client -connect www.google.com:443
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl s_client -connect www.google.com:443
|
||||
<span class="go">[...]</span>
|
||||
<span class="go">---</span>
|
||||
<span class="go">Certificate chain</span>
|
||||
|
|
@ -1241,11 +1259,14 @@ In real production world, you may face CAs with intermediate certificates, as th
|
|||
<span class="go"> 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA</span>
|
||||
<span class="go"> i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>To generate our CA Certificate, we've to run the following commands:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out ca.key <span class="m">2048</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out ca.key <span class="m">2048</span>
|
||||
<span class="gp">$</span> openssl req -x509 -new -nodes -key ca.key -days <span class="m">10000</span> -out ca.crt -subj <span class="s2">"/CN=example-ca"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>This will generate two files: A private key (ca.key) and a public key (ca.crt). This CA is valid for 10000 days.
|
||||
The ca.crt can be used later in the step of creation of CA authentication secret.</p>
|
||||
|
|
@ -1253,7 +1274,13 @@ The ca.crt can be used later in the step of creation of CA authentication secret
|
|||
<p>The following steps generate a client certificate signed by the CA generated above. This client can be
|
||||
used to authenticate in a tls-auth configured ingress.</p>
|
||||
<p>First, we need to generate an 'openssl.cnf' file that will be used while signing the keys:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">[req]</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">[req]</span>
|
||||
<span class="go">req_extensions = v3_req</span>
|
||||
<span class="go">distinguished_name = req_distinguished_name</span>
|
||||
<span class="go">[req_distinguished_name]</span>
|
||||
|
|
@ -1261,47 +1288,68 @@ used to authenticate in a tls-auth configured ingress.</p>
|
|||
<span class="go">basicConstraints = CA:FALSE</span>
|
||||
<span class="go">keyUsage = nonRepudiation, digitalSignature, keyEncipherment</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then, a user generates his very own private key (that he needs to keep secret)
|
||||
and a CSR (Certificate Signing Request) that will be sent to the CA to sign and generate a certificate.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out client1.key <span class="m">2048</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out client1.key <span class="m">2048</span>
|
||||
<span class="gp">$</span> openssl req -new -key client1.key -out client1.csr -subj <span class="s2">"/CN=client1"</span> -config openssl.cnf
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>As the CA receives the generated 'client1.csr' file, it signs it and generates a client.crt certificate:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days <span class="m">365</span> -extensions v3_req -extfile openssl.cnf
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days <span class="m">365</span> -extensions v3_req -extfile openssl.cnf
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then, you'll have 3 files: the client.key (user's private key), client.crt (user's public key) and client.csr (disposable CSR).</p>
|
||||
<h3 id="creating-the-ca-authentication-secret">Creating the CA Authentication secret<a class="headerlink" href="#creating-the-ca-authentication-secret" title="Permanent link">¶</a></h3>
|
||||
<p>If you're using the CA Authentication feature, you need to generate a secret containing
|
||||
all the authorized CAs. You must download them from your CA site in PEM format (like the following):</p>
|
||||
<div class="codehilite"><pre><span></span>-----BEGIN CERTIFICATE-----
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>-----BEGIN CERTIFICATE-----
|
||||
[....]
|
||||
-----END CERTIFICATE-----
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>You can have as many certificates as you want. If they're in the binary DER format,
|
||||
you can convert them as the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -in certificate.der -inform der -out certificate.crt -outform pem
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -in certificate.der -inform der -out certificate.crt -outform pem
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then, you've to concatenate them all in only one file, named 'ca.crt' as the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>The final step is to create a secret with the content of this file. This secret is going to be used in
|
||||
the TLS Auth directive:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p><strong>Note:</strong> You can also generate the CA Authentication Secret along with the TLS Secret by using:
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt> --from-file<span class="o">=</span>tls.crt<span class="o">=</span><tls.crt> --from-file<span class="o">=</span>tls.key<span class="o">=</span><tls.key>
|
||||
</pre></div></p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt> --from-file<span class="o">=</span>tls.crt<span class="o">=</span><tls.crt> --from-file<span class="o">=</span>tls.key<span class="o">=</span><tls.key>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<h2 id="test-http-service">Test HTTP Service<a class="headerlink" href="#test-http-service" title="Permanent link">¶</a></h2>
|
||||
<p>All examples that require a test HTTP Service use the standard http-svc pod,
|
||||
which you can deploy as follows</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f http-svc.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f http-svc.yaml
|
||||
<span class="go">service "http-svc" created</span>
|
||||
<span class="go">replicationcontroller "http-svc" created</span>
|
||||
|
||||
|
|
@ -1313,9 +1361,56 @@ which you can deploy as follows</p>
|
|||
<span class="go">NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span>
|
||||
<span class="go">http-svc 10.0.122.116 <pending> 80:30301/TCP 1d</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>You can test that the HTTP Service works by exposing it temporarily</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc http-svc -p <span class="s1">'{"spec":{"type": "LoadBalancer"}}'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39
|
||||
40
|
||||
41
|
||||
42
|
||||
43
|
||||
44
|
||||
45
|
||||
46
|
||||
47</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc http-svc -p <span class="s1">'{"spec":{"type": "LoadBalancer"}}'</span>
|
||||
<span class="go">"http-svc" patched</span>
|
||||
|
||||
<span class="gp">$</span> kubectl get svc http-svc
|
||||
|
|
@ -1363,6 +1458,7 @@ which you can deploy as follows</p>
|
|||
<span class="gp">$</span> kubectl patch svc http-svc -p <span class="s1">'{"spec":{"type": "NodePort"}}'</span>
|
||||
<span class="go">"http-svc" patched</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue