21.2 k8s中etcd的tls双向认证原理解析

devtools/2024/10/19 10:51:32/

本节重点介绍 :

  • tls单向认证原理
  • tls双向认证原理
    • 在k8s中etcd监控的应用
    • 以ca.crt client.crt client.key创建的secret并挂载到prometheus中
    • prometheus配置证书信息打到采集etcd的目的

tls单向认证

image

  • 在单向SSL身份认证过程中，客户端需要验证服务端证书，比如访问baidu.com
[root@k8s-master01 ~]# curl -vvv https://www.baidu.com
* About to connect() to www.baidu.com port 443 (#0)
*   Trying 103.235.46.39...
* Connected to www.baidu.com (103.235.46.39) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crtCApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=baidu.com,O="Beijing Baidu Netcom Science Technology Co., Ltd",OU=service operation department,L=beijing,ST=beijing,C=CN
*       start date: Jul 01 01:16:03 2021 GMT
*       expire date: Aug 02 01:16:03 2022 GMT
*       common name: baidu.com
*       issuer: CN=GlobalSign Organization Validation CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.baidu.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Connection: keep-alive
< Content-Length: 2443
< Content-Type: text/html
< Date: Tue, 24 Aug 2021 07:28:01 GMT
< Etag: "58860411-98b"
< Last-Modified: Mon, 23 Jan 2017 13:24:33 GMT
< Pragma: no-cache
< Server: bfe/1.0.8.18
< Set-Cookie: BDORZ=27315; max-age=86400; domain=.baidu.com; path=/
<

prometheus_48">对应prometheus中的配置

  • tls_config.ca_file指定ca_file
  bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/tokentls_config:ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crtinsecure_skip_verify: true

追踪ca_file源码

  • 位置 D:\go_path\pkg\mod\github.com\prometheus\common@v0.30.0\config\http_config.go

func NewTLSConfig(cfg *TLSConfig) (*tls.Config, error) {tlsConfig := &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify}// If a CA cert is provided then let's read it in so we can validate the// scrape target's certificate properly.if len(cfg.CAFile) > 0 {b, err := readCAFile(cfg.CAFile)if err != nil {return nil, err}if !updateRootCA(tlsConfig, b) {return nil, fmt.Errorf("unable to use specified CA cert %s", cfg.CAFile)}}
  • 在上述代码中可以看到当用户配置了ca_file，则会将RootCA设置为这个值
  • 如果RootCA没设置，则默认使用主机的
// updateRootCA parses the given byte slice as a series of PEM encoded certificates and updates tls.Config.RootCAs.
func updateRootCA(cfg *tls.Config, b []byte) bool {caCertPool := x509.NewCertPool()if !caCertPool.AppendCertsFromPEM(b) {return false}cfg.RootCAs = caCertPoolreturn true
}

service account ca.crt来源

kubectl -n kube-system exec prometheus-0 -c prometheus -ti -- /bin/sh/prometheus $ cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt 
-----BEGIN CERTIFICATE-----
MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
cm5ldGVzMB4XDTIxMDQwNjEyMjAzMloXDTMxMDQwNDEyMjAzMlowFTETMBEGA1UE
AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKwi
+0eDgehQaaJU5mIy5GhtMAgQdsHEps9zYSkzQ0TDPdEcsv5zwzCXionv0aTWmFB4
kKG6EkhhxiuBUG8qz1kJwm4Pog7Hlx0SsLCpAxLW750ASHE/4CVZ7TCDW4Yl/jns
rGWeqj+3POO1dId1WUSvXiwEcusLHLBY8v4wCApRB81KM7RUGIgP4WEenxwVG4tP
LQ44I7V1fLsMfl+hA/wyr94Ufyqe+TzVVY8CMS8PL5SKwviVOxrE2GrTfU/bjmjH
NpKZgTqRU2oFThAa2A7O820FJE/a0K8FleyvOuZ+dWHZXF0JxV4buiw4r5d1LnEh
+eRX8KZykeSCFNeyXEsCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
/wQFMAMBAf8wHQYDVR0OBBYEFIOi7ByyvNV7vQJP9CPWFT2iHgGaMA0GCSqGSIb3
DQEBCwUAA4IBAQCFp5z/FsbPFbu2kCLNOjSYrA7mhF+QA+qv6Fgv0ljQfE1PYzqm
Q8PJuqEoSWS3z8OgtBOUvkOyofLPLr5DKyoCcOipkC4NhFiZWILJ61i441IAzseE
uC1FESFwhO/HVQZVtt6M1G4DcG7afv9gVw4R2lFfWRsmVQY8kW97aqCq72OsgbAp
U6mDvPR6ISkfkxMmkSMY4+Fa9jyeRCsm4i7S8Jp61jYkqsSbMjYUnApykaadYpCs
FpNNKNTq63XkC1N4WOW86RskoCNhnuztt1NvHdvgASqcwjCmheFh+JKjgBScCUNo
mqBXsmuXNzVetojQvulMKxsmr/L+hh3ekpaW
-----END CERTIFICATE-----
  • 可以发现和 master节点上的/etc/kubernetes/pki/ca.crt 一致
[root@k8s-master01 prome_k8s_all_pod]# cat /etc/kubernetes/pki/ca.crt 
-----BEGIN CERTIFICATE-----
MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
cm5ldGVzMB4XDTIxMDQwNjEyMjAzMloXDTMxMDQwNDEyMjAzMlowFTETMBEGA1UE
AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKwi
+0eDgehQaaJU5mIy5GhtMAgQdsHEps9zYSkzQ0TDPdEcsv5zwzCXionv0aTWmFB4
kKG6EkhhxiuBUG8qz1kJwm4Pog7Hlx0SsLCpAxLW750ASHE/4CVZ7TCDW4Yl/jns
rGWeqj+3POO1dId1WUSvXiwEcusLHLBY8v4wCApRB81KM7RUGIgP4WEenxwVG4tP
LQ44I7V1fLsMfl+hA/wyr94Ufyqe+TzVVY8CMS8PL5SKwviVOxrE2GrTfU/bjmjH
NpKZgTqRU2oFThAa2A7O820FJE/a0K8FleyvOuZ+dWHZXF0JxV4buiw4r5d1LnEh
+eRX8KZykeSCFNeyXEsCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
/wQFMAMBAf8wHQYDVR0OBBYEFIOi7ByyvNV7vQJP9CPWFT2iHgGaMA0GCSqGSIb3
DQEBCwUAA4IBAQCFp5z/FsbPFbu2kCLNOjSYrA7mhF+QA+qv6Fgv0ljQfE1PYzqm
Q8PJuqEoSWS3z8OgtBOUvkOyofLPLr5DKyoCcOipkC4NhFiZWILJ61i441IAzseE
uC1FESFwhO/HVQZVtt6M1G4DcG7afv9gVw4R2lFfWRsmVQY8kW97aqCq72OsgbAp
U6mDvPR6ISkfkxMmkSMY4+Fa9jyeRCsm4i7S8Jp61jYkqsSbMjYUnApykaadYpCs
FpNNKNTq63XkC1N4WOW86RskoCNhnuztt1NvHdvgASqcwjCmheFh+JKjgBScCUNo
mqBXsmuXNzVetojQvulMKxsmr/L+hh3ekpaW
-----END CERTIFICATE-----

tls双向认证

image

为什么需要TLS双向认证？

  • 一般Web应用都是采用SSL单向认证的，用户数自由无限制，且无需在通讯层对用户身份进行验证，一般都在应用逻辑层来保证用户的合法登入
  • 但如果是企业应用对接，数据信息相对较多且复杂，可能会要求对客户端做身份验证，这时就需要做SSL双向认证，这也是保护公司内部数据信息的最好的方法
  • 或者说在访问特别重要的系统时需要做tls双向认证

双向认证的必备条件

  • 私钥 client.key
  • 个人认证证书 client.crt
  • CA根证书 如ca.crt
  • CA中间证书（非所有情况下必需）
  • 有了以上必备东西，当客户端验证服务器身份后，服务器才能验证客户端身份。双方都有自己独立的SSL证书，而且这些证书必须是由受信任的第三方CA机构颁发的。

etcd_158">k8s中的etcd需要双向认证

重要性说明

prometheus_etcd_job_161">prometheus采集 etcd job配置

- job_name: kube-etcdhonor_timestamps: truescrape_interval: 30sscrape_timeout: 10smetrics_path: /metricsscheme: httpsauthorization:type: Bearercredentials_file: /var/run/secrets/kubernetes.io/serviceaccount/tokentls_config:ca_file: /etc/prometheus/secrets/etcd-certs/ca.crtcert_file: /etc/prometheus/secrets/etcd-certs/healthcheck-client.crtkey_file: /etc/prometheus/secrets/etcd-certs/healthcheck-client.keyinsecure_skip_verify: truefollow_redirects: truerelabel_configs:- source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name]separator: ;regex: kube-system;kube-etcdreplacement: $1action: keepkubernetes_sd_configs:- role: endpointskubeconfig_file: ""follow_redirects: true
  • 其中ca_file代表 ca的证书
  • cert_file代表 client的公钥
  • key_file代表 client的私钥
同时我们在采集之初，使用master上的文件创建了对应的secret
kubectl create secret generic etcd-certs --from-file=/etc/kubernetes/pki/etcd/healthcheck-client.crt --from-file=/etc/kubernetes/pki/etcd/healthcheck-client.key --from-file=/etc/kubernetes/pki/etcd/ca.crt -n kube-system
prometheusvolume__etcdcerts_199">prometheus配置的volume 挂载了 etcd-certs
      volumes:- name: secret-volumesecret:secretName: etcd-certs   

[root@k8s-master01 ~]# kubectl -n kube-system exec prometheus-0 -c prometheus -ti -- /bin/sh/prometheus $ ls /etc/prometheus/secrets/etcd-certs/ -lrt
total 0
lrwxrwxrwx    1 root     root            29 Aug 20 04:56 healthcheck-client.key -> ..data/healthcheck-client.key
lrwxrwxrwx    1 root     root            29 Aug 20 04:56 healthcheck-client.crt -> ..data/healthcheck-client.crt
lrwxrwxrwx    1 root     root            13 Aug 20 04:56 ca.crt -> ..data/ca.crt
手动访问，在master上
[root@k8s-master01 ~]#  curl -s -vvv  https://localhost:2379/metrics  --cert /etc/kubernetes/pki/etcd/healthcheck-client.crt --key /etc/kubernetes/pki/etcd/healthcheck-client.key --cacert /etc/kubernetes/pki/etcd/ca.crt  |head  
* About to connect() to localhost port 2379 (#0)
*   Trying ::1...
* Connection refused
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 2379 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/kubernetes/pki/etcd/ca.crtCApath: none
* NSS: client certificate from file
*       subject: CN=kube-etcd-healthcheck-client,O=system:masters
*       start date: Apr 06 12:20:33 2021 GMT
*       expire date: Apr 06 12:20:33 2022 GMT
*       common name: kube-etcd-healthcheck-client
*       issuer: CN=etcd-ca
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*       subject: CN=k8s-master01
*       start date: Apr 06 12:20:33 2021 GMT
*       expire date: Apr 06 12:20:33 2022 GMT
*       common name: k8s-master01
*       issuer: CN=etcd-ca
> GET /metrics HTTP/1.1
> User-Agent: curl/7.29.0
> Host: localhost:2379
> Accept: */*
> 
< HTTP/1.1 200 OK
< Access-Control-Allow-Headers: accept, content-type, authorization
< Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
< Access-Control-Allow-Origin: *
< Content-Type: text/plain; version=0.0.4; charset=utf-8
< Date: Tue, 24 Aug 2021 07:57:33 GMT
< Transfer-Encoding: chunked
< 
{ [data not shown]
# HELP etcd_cluster_version Which version is running. 1 for 'cluster_version' label with current cluster version
# TYPE etcd_cluster_version gauge
etcd_cluster_version{cluster_version="3.4"} 1
# HELP etcd_debugging_auth_revision The current revision of auth store.
# TYPE etcd_debugging_auth_revision gauge
etcd_debugging_auth_revision 1
# HELP etcd_debugging_disk_backend_commit_rebalance_duration_seconds The latency distributions of commit.rebalance called by bboltdb backend.
# TYPE etcd_debugging_disk_backend_commit_rebalance_duration_seconds histogram
etcd_debugging_disk_backend_commit_rebalance_duration_seconds_bucket{le="0.001"} 4.561017e+06
etcd_debugging_disk_backend_commit_rebalance_duration_seconds_bucket{le="0.002"} 4.561069e+06
* Failed writing body (0 != 2048)
* Failed writing data
* Closing connection 0
  • –cacert指定ca的公钥
  • –cert指定客户端公钥
  • –key指定客户端私钥

本节重点总结 :

  • tls单向认证原理
  • tls双向认证原理
    • 在k8s中etcd监控的应用
    • 以ca.crt client.crt client.key创建的secret并挂载到prometheus中
    • prometheus配置证书信息打到采集etcd的目的

http://www.ppmy.cn/devtools/120483.html

相关文章

Laravel部署后，CPU 使用率过高

Laravel部署后，CPU 使用率过高

我在部署 Laravel 应用程序时遇到严重问题。当访问量稍微大一点的时候&#xff0c;cpu马上就到100%了&#xff0c; 找了一大堆文档和说明&#xff0c;都是说明laravel处理并发的能力太弱&#xff0c;还不如原生的php。最后找到swoole解决问题。 1、php下载swoole插件&#xff0…
阅读更多...
滚雪球学MySQL[4.3讲]：MySQL表设计与优化：正规化、表分区与性能调优详解

滚雪球学MySQL[4.3讲]：MySQL表设计与优化：正规化、表分区与性能调优详解

全文目录&#xff1a; 前言4.3 表设计与优化1. 正规化与反规范化1.1 正规化正规化的步骤&#xff1a;正规化的优点&#xff1a; 1.2 反规范化示例&#xff1a;反规范化提升性能反规范化的优点&#xff1a;反规范化的缺点&#xff1a; 2. 表的分区与分区策略2.1 分区的类型1. **…
阅读更多...
Llama微调以及Ollama部署

Llama微调以及Ollama部署

1 Llama微调 在基础模型的基础上&#xff0c;通过一些特定的数据集&#xff0c;将具有特定功能加在原有的模型上。 1.1 效果对比 特定数据集 未使用微调的基础模型的回答 使用微调后的回答 1.2 基础模型 基础大模型我选择Mistral-7B-v0.3-Chinese-Chat-uncensored&#x…
阅读更多...
智慧防灾，科技先行：EasyCVR平台助力地质灾害视频监测系统建设

智慧防灾，科技先行：EasyCVR平台助力地质灾害视频监测系统建设

随着科技的飞速发展&#xff0c;视频监控技术已成为地质灾害监测与预警的重要手段之一。在众多视频监控平台中&#xff0c;EasyCVR视频汇聚平台凭借其强大的视频整合、实时传输、视频处理及分发等能力&#xff0c;在地质灾害场景中展现出显著的应用优势。 一、实时监测与远程监…
阅读更多...
三维地图场景学习总结 20241002

三维地图场景学习总结 20241002

1. 学习内容 1.1 cesium 学习 基础教程&#xff1a;提供了cesium的配置方式及简单案例 dvgis&#xff1a;该网址提供了关系cesium的使用案例 1.2 OpenStreetMap 学习 List_of_OSM-based_services&#xff1a;提供了openstreetmap所有相关工具及相关使用案例 1.3 三维场景渲…
阅读更多...
计算机网络--HTTP协议

计算机网络--HTTP协议

1.TCP,UDP的对比图 TCP:面向连接的,可靠的,字节流服务; UDP:无连接的,不可靠的,数据报服务; 2.补充网络部分的其他知识点 1).复位报文段 在某些特殊条件下&#xff0c; TCP 连接的一端会向另一端发送携带 RST 标志的报文段&#xff0c;即复位报文段&#xff0c;已通知对方…
阅读更多...
Ubuntu23.10下处理libncurses5-dev包的安装问题

Ubuntu23.10下处理libncurses5-dev包的安装问题

Ubuntu23.10下处理libncurses5-dev包的安装问题 导语环境准备问题和解决方案总结参考文献 导语 使用Ubuntu23.10的时候&#xff0c;遇到需要termios的场景&#xff0c;结果发现无论是codeblocks还是系统本身的gcc都无法找到term.h和curse.h&#xff0c;网上找了很多解决方案都…
阅读更多...
CSP-S 2022 T1假期计划

CSP-S 2022 T1假期计划

CSP-S 2022 T1假期计划 先思考暴力做法&#xff0c;题目需要找到四个不相同的景点&#xff0c;那我们就枚举这四个景点&#xff0c;判断它们之间的距离是否符合条件&#xff0c;条件是任意两个点之间的距离是否大于 k k k&#xff0c;所以我们需要求出任意两点之间的距离。常用…
阅读更多...
最新文章

Copyright @ 2022~2023