External authentication
@@ -1212,15 +1200,7 @@
TLS certificates
Unless otherwise mentioned, the TLS secret used in examples is a 2048 bit RSA
key/cert pair with an arbitrarily chosen hostname, created as follows
-1
-2
-3
-4
-5
-6
-7
-8
-9 | $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
+$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
Generating a 2048 bit RSA private key
................+++
................+++
@@ -1230,7 +1210,6 @@ key/cert pair with an arbitrarily chosen hostname, created as follows
$ kubectl create secret tls tls-secret --key tls.key --cert tls.crt
secret "tls-secret" created
|
CA Authentication
You can act as your very own CA, or use an existing one. As an exercise / learning, we're going to generate our
@@ -1239,16 +1218,7 @@ own CA, and also generate a client certificate.
Generating a CA
First of all, you've to generate a CA. This is going to be the one who will sign your client certificates.
In real production world, you may face CAs with intermediate certificates, as the following:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10 | $ openssl s_client -connect www.google.com:443
+$ openssl s_client -connect www.google.com:443
[...]
---
Certificate chain
@@ -1259,14 +1229,11 @@ In real production world, you may face CAs with intermediate certificates, as th
2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
|
To generate our CA Certificate, we've to run the following commands:
- | $ openssl genrsa -out ca.key 2048
+$ openssl genrsa -out ca.key 2048
$ openssl req -x509 -new -nodes -key ca.key -days 10000 -out ca.crt -subj "/CN=example-ca"
|
This will generate two files: A private key (ca.key) and a public key (ca.crt). This CA is valid for 10000 days.
The ca.crt can be used later in the step of creation of CA authentication secret.
@@ -1274,13 +1241,7 @@ The ca.crt can be used later in the step of creation of CA authentication secret
The following steps generate a client certificate signed by the CA generated above. This client can be
used to authenticate in a tls-auth configured ingress.
First, we need to generate an 'openssl.cnf' file that will be used while signing the keys:
- | [req]
+[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
@@ -1288,68 +1249,47 @@ used to authenticate in a tls-auth configured ingress.
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
Then, a user generates his very own private key (that he needs to keep secret)
and a CSR (Certificate Signing Request) that will be sent to the CA to sign and generate a certificate.
- | $ openssl genrsa -out client1.key 2048
+$ openssl genrsa -out client1.key 2048
$ openssl req -new -key client1.key -out client1.csr -subj "/CN=client1" -config openssl.cnf
|
As the CA receives the generated 'client1.csr' file, it signs it and generates a client.crt certificate:
- | $ openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days 365 -extensions v3_req -extfile openssl.cnf
+$ openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days 365 -extensions v3_req -extfile openssl.cnf
|
Then, you'll have 3 files: the client.key (user's private key), client.crt (user's public key) and client.csr (disposable CSR).
Creating the CA Authentication secret
If you're using the CA Authentication feature, you need to generate a secret containing
all the authorized CAs. You must download them from your CA site in PEM format (like the following):
- | -----BEGIN CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
[....]
-----END CERTIFICATE-----
|
You can have as many certificates as you want. If they're in the binary DER format,
you can convert them as the following:
- | $ openssl x509 -in certificate.der -inform der -out certificate.crt -outform pem
+$ openssl x509 -in certificate.der -inform der -out certificate.crt -outform pem
|
Then, you've to concatenate them all in only one file, named 'ca.crt' as the following:
- | $ cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
+$ cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
|
The final step is to create a secret with the content of this file. This secret is going to be used in
the TLS Auth directive:
- | $ kubectl create secret generic caingress --namespace=default --from-file=ca.crt=<ca.crt>
+$ kubectl create secret generic caingress --namespace=default --from-file=ca.crt=<ca.crt>
|
Note: You can also generate the CA Authentication Secret along with the TLS Secret by using:
-
| $ kubectl create secret generic caingress --namespace=default --from-file=ca.crt=<ca.crt> --from-file=tls.crt=<tls.crt> --from-file=tls.key=<tls.key>
- |
+$ kubectl create secret generic caingress --namespace=default --from-file=ca.crt=<ca.crt> --from-file=tls.crt=<tls.crt> --from-file=tls.key=<tls.key>
+
Test HTTP Service
All examples that require a test HTTP Service use the standard http-svc pod,
which you can deploy as follows
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11 | $ kubectl create -f http-svc.yaml
+$ kubectl create -f http-svc.yaml
service "http-svc" created
replicationcontroller "http-svc" created
@@ -1361,56 +1301,9 @@ which you can deploy as follows
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
http-svc 10.0.122.116 <pending> 80:30301/TCP 1d
|
You can test that the HTTP Service works by exposing it temporarily
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47 | $ kubectl patch svc http-svc -p '{"spec":{"type": "LoadBalancer"}}'
+$ kubectl patch svc http-svc -p '{"spec":{"type": "LoadBalancer"}}'
"http-svc" patched
$ kubectl get svc http-svc
@@ -1458,7 +1351,6 @@ which you can deploy as follows
$ kubectl patch svc http-svc -p '{"spec":{"type": "NodePort"}}'
"http-svc" patched
|
diff --git a/examples/affinity/cookie/index.html b/examples/affinity/cookie/index.html
index 8d1cfed49..d639f7a6c 100644
--- a/examples/affinity/cookie/index.html
+++ b/examples/affinity/cookie/index.html
@@ -596,8 +596,8 @@
