下载组件

wget https://github.com/OpenVPN/easy-rsa/archive/master.zip
unzip master.zip
cd easy-rsa-master/easyrsa3

./easyrsa init-pki
./easyrsa --batch "--req-cn=192.168.51.26@`date +%s`" build-ca nopass
# 注意一下：这需要加上你的master ip跟cluster ip,加上kubernetes.default
./easyrsa --subject-alt-name="IP:192.168.51.26,IP:10.254.0.1,DNS:kubernetes.default" build-server-full kubernetes-master nopass
cp -fr pki/issued/kubernetes-master.crt /run/kubernetes/server.crt
cp -fr pki/private/kubernetes-master.key /run/kubernetes/server.key
./easyrsa --dn-mode=org --req-cn=kubecfg --req-org=system:masters --req-c= --req-st= --req-city= --req-email= --req-ou= build-client-full kubecfg nopass
cp -fr pki/ca.crt /run/kubernetes/
cp -fr pki/issued/kubecfg.crt /run/kubernetes/
cp -fr pki/private/kubecfg.key /run/kubernetes/

#chgrp kube "/etc/kubernetes/server.key" "/etc/kubernetes/server.crt" "/etc/kubernetes/ca.crt"
chmod 777 "/run/kubernetes/server.key" "/run/kubernetes/server.crt" "/run/kubernetes/ca.crt"
openssl x509  -noout -text -in  /run/kubernetes/server.crt

echo 123456,admin,001 > /run/kubernetes/basic_auth.csv # 格式：密码,用户名,用户ID

vi /etc/kubernetes/apiserver

KUBE_API_ARGS="--client-ca-file=/run/kubernetes/ca.crt --tls-cert-file=/run/kubernetes/server.crt --tls-private-key-file=/run/kubernetes/server.key --basic-auth-file=/run/kubernetes/basic_auth.csv"

/etc/kubernetes/controller-manager

KUBE_CONTROLLER_MANAGER_ARGS="--service-account-private-key-file=/run/kubernetes/server.key --root-ca-file=/run/kubernetes/ca.crt"

重启服务

service kube-apiserver restart
service kube-controller-manager restart

访问master节点的6443端口如果出现如图所示则说明配置成功

kubectl get secrets –all-namespaces

NAMESPACE     NAME                   TYPE                                  DATA      AGE
default       default-token-7mpwp    kubernetes.io/service-account-token   3         4m
kube-system   default-token-gfgt2    kubernetes.io/service-account-token   3         4m
kube-system   kube-dns-token-nn6nn   kubernetes.io/service-account-token   3         3m
test          default-token-1nhqk    kubernetes.io/service-account-token   3         4m
test-ns       default-token-thw5t    kubernetes.io/service-account-token   3         4m
test-ns       mysecret               Opaque                                2         6d
test1-ns      default-token-25tsw    kubernetes.io/service-account-token   3         4m

参考文献
设置https证书