Question

我已使用以下命令设置etcd服务器：

etcd -name infra0 -initial-advertise-peer-urls http://192.168.99.240:2380 -listen-peer-urls http://192.168.99.240:2380 -listen-client-urls https://192.168.99.240:2379,https://127.0.0.1:2379 -advertise-client-urls https://192.168.99.240:2379 -initial-cluster-token etcd-cluster-1 -initial-cluster infra0=http://192.168.99.240:2380 -initial-cluster-state new -client-cert-auth -trusted-ca-file=/home/docker/ssl/ca.crt -cert-file=/home/docker/ssl/server.crt -key-file=/home/docker/ssl/server.key

我可以使用curl

从中获取数据

curl --cacert /home/kubernetes/ssl/server.crt --cert /home/kubernetes/ssl/ca.crt --key /home/kubernetes/ssl/ca.key -L https://192.168.99.240:2379/v2/keys/coreos.com/network/config -XGET

上面的命令返回：

{"action":"get","node":{"key":"/coreos.com/network/config","value":"{\"Network\":\"10.0.0.0/8\"}","modifiedIndex":10,"createdIndex":10}}

但是当我使用etcdctl：

时

etcdctl --peers=https://192.168.99.240:2379 --ca-file=/home/kubernetes/ssl/server.crt --cert-file=/home/kubernetes/ssl/ca.crt --key-file=/home/kubernetes/ssl/ca.key ls

它返回：

Error:  client: etcd cluster is unavailable or misconfigured
error #0: x509: cannot validate certificate for 192.168.99.240 because it doesn't contain any IP SANs

我认为这是因为证书验证失败，为什么--ca-file的{{1}}标志会生效？或者我的命令有问题吗？

我使用的etcd版本是：

etcdctl

Answer 1

问题解决了。

curl成功访问etcd但etcdctl无法访问的原因是我使用的自签名证书不够安全且curl忽略它但是etcdctl没有。

以下是生成安全证书的步骤（从kubernetes的文档中复制并修改）。

首先，您应该修改/etc/ssl/openssl.cnf：将basicConstraints标记设置为CA:TURE并在subjectAltName = IP:<MASTER_IP>下添加v3_ca。

然后您可以按照以下步骤生成证书。

#1. Generate a ca.key with 2048bit 
openssl genrsa -out ca.key 2048
#2. According to the ca.key generate a ca.crt. (-days set the certificate effective time). 
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
#3. Generate a server.key with 2048bit 
openssl genrsa -out server.key 2048
#4. According to the server.key generate a server.csr. 
openssl req -new -key server.key -subj "/CN=${MASTER_IP}" -out server.csr
#5. According to the ca.key, ca.crt and server.csr generate the server.crt.
openssl x509 -req -days 1000 -in server.csr -signkey server.key -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -extensions v3_req -extensions v3_ca -extfile /etc/ssl/openssl.cnf
#6. View the certificate. 
openssl x509 -noout -text -in ./server.crt

然后使用以下命令运行etcd：

etcd -name infra0 -initial-advertise-peer-urls http://192.168.99.240:2380 -listen-peer-urls http://192.168.99.240:2380 -listen-client-urls https://192.168.99.240:2379,https://127.0.0.1:2379 -advertise-client-urls https://192.168.99.240:2379 -initial-cluster-token etcd-cluster-1 -initial-cluster infra0=http://192.168.99.240:2380 -initial-cluster-state new -client-cert-auth -trusted-ca-file=ca.crt -cert-file=server.crt -key-file=server.key

现在我们可以使用以下命令访问etcd：

etcdctl --peers=https://192.168.99.240:2379 --ca-file=ca.crt --cert-file=ca.crt --key-file=ca.key ls

请注意--ca-file的{{1}}标记为etcdctl，而不是ca.crt。

＆＃39; - ca-file＆＃39; etcdctl的旗子没用？

1 个答案: