1

etcd我已经使用以下命令设置了服务器：

etcd -name infra0 -initial-advertise-peer-urls http://192.168.99.240:2380 -listen-peer-urls http://192.168.99.240:2380 -listen-client-urls https://192.168.99.240:2379,https://127.0.0.1:2379 -advertise-client-urls https://192.168.99.240:2379 -initial-cluster-token etcd-cluster-1 -initial-cluster infra0=http://192.168.99.240:2380 -initial-cluster-state new -client-cert-auth -trusted-ca-file=/home/docker/ssl/ca.crt -cert-file=/home/docker/ssl/server.crt -key-file=/home/docker/ssl/server.key

我可以从中获取数据curl：

curl --cacert /home/kubernetes/ssl/server.crt --cert /home/kubernetes/ssl/ca.crt --key /home/kubernetes/ssl/ca.key -L https://192.168.99.240:2379/v2/keys/coreos.com/network/config -XGET

上面的命令返回：

{"action":"get","node":{"key":"/coreos.com/network/config","value":"{\"Network\":\"10.0.0.0/8\"}","modifiedIndex":10,"createdIndex":10}}

但是当我使用etcdctl：

etcdctl --peers=https://192.168.99.240:2379 --ca-file=/home/kubernetes/ssl/server.crt --cert-file=/home/kubernetes/ssl/ca.crt --key-file=/home/kubernetes/ssl/ca.key ls

它返回：

Error:  client: etcd cluster is unavailable or misconfigured
error #0: x509: cannot validate certificate for 192.168.99.240 because it doesn't contain any IP SANs

我还以为是证书验证失败，为什么--ca-fileflagetcdctl会生效呢？还是我的命令有问题？

我使用的 etcd 版本是：

etcdctl --version
etcdctl version 2.2.1
4

1 回答 1

1

问题解决了。

可以成功访问但curl不能访问的原因是我使用的自签名证书不够安全并忽略它但没有。etcdetcdctlcurletcdctl

以下是生成安全证书的步骤（从kubernetes文档复制并修改）。

首先，您应该修改/etc/ssl/openssl.cnf：将basicConstraints标志设置为CA:TURE并subjectAltName = IP:<MASTER_IP>在下添加v3_ca。

然后您可以按照以下步骤生成证书。

#1. Generate a ca.key with 2048bit 
openssl genrsa -out ca.key 2048
#2. According to the ca.key generate a ca.crt. (-days set the certificate effective time). 
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
#3. Generate a server.key with 2048bit 
openssl genrsa -out server.key 2048
#4. According to the server.key generate a server.csr. 
openssl req -new -key server.key -subj "/CN=${MASTER_IP}" -out server.csr
#5. According to the ca.key, ca.crt and server.csr generate the server.crt.
openssl x509 -req -days 1000 -in server.csr -signkey server.key -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -extensions v3_req -extensions v3_ca -extfile /etc/ssl/openssl.cnf
#6. View the certificate. 
openssl x509 -noout -text -in ./server.crt

然后etcd使用以下命令运行：

etcd -name infra0 -initial-advertise-peer-urls http://192.168.99.240:2380 -listen-peer-urls http://192.168.99.240:2380 -listen-client-urls https://192.168.99.240:2379,https://127.0.0.1:2379 -advertise-client-urls https://192.168.99.240:2379 -initial-cluster-token etcd-cluster-1 -initial-cluster infra0=http://192.168.99.240:2380 -initial-cluster-state new -client-cert-auth -trusted-ca-file=ca.crt -cert-file=server.crt -key-file=server.key

现在我们可以etcd使用以下命令访问：

etcdctl --peers=https://192.168.99.240:2379 --ca-file=ca.crt --cert-file=ca.crt --key-file=ca.key ls

请注意，--ca-file标志etcdctl是ca.crt，不是server.crt。

于 2015-11-25T08:32:59.530 回答