{"id":827,"date":"2020-05-07T09:35:13","date_gmt":"2020-05-07T07:35:13","guid":{"rendered":"https:\/\/loeilduse.fr\/?p=827"},"modified":"2020-05-07T10:55:32","modified_gmt":"2020-05-07T08:55:32","slug":"ajouter-un-self-signed-certificat-dans-kubernetes-avec-containerd","status":"publish","type":"post","link":"https:\/\/loeilduse.fr\/?p=827&lang=fr","title":{"rendered":"Ajouter un self-signed certificat dans Kubernetes avec Containerd"},"content":{"rendered":"

Dans cet article (D\u00e9ployer Harbor avec type loadBalancer)<\/a><\/span> j’ai expliqu\u00e9 comment d\u00e9ployer Habor et utiliser le certificat self-signed pour que Docker puisse l’utiliser. Si vous utilisez Kubernetes avec docker, vous pouvez aussi suivre cette proc\u00e9dure sur chaque worker node. Sinon vous risquez d’avoir l’erreur suivante :<\/span><\/p>\n

Unknown desc = failed to pull and unpack image “harbor.cpod-tkg.az-lab.shwrfr.com\/memecached\/hello-world:latest”: failed to resolve reference “harbor.cpod-tkg.az-lab.shwrfr.com\/memecached\/hello-world:latest”: failed to do request: Head https:\/\/harbor.cpod-tkg.az-lab.shwrfr.com\/v2\/memecached\/hello-world\/manifests\/latest: x509: certificate signed by unknown authority<\/strong><\/span><\/em><\/span>
\nWarning Failed 12s (x2 over 24s) kubelet, tkg-utility-md-0-798c695db5-pjgsk Error: ErrImagePull<\/em><\/span><\/p>\n

Si vous utilisez Kubernetes avec Containerd, la proc\u00e9dure est diff\u00e9rente. Mon coll\u00e8gue Rob Hardt (https:\/\/gist.github.com\/rhardt-pivotal\/<\/a>)<\/span> a d\u00e9velopp\u00e9 un script pour \u00e7a : https:\/\/gist.githubusercontent.com\/rhardt-pivotal\/4aa09ced6302194561936717262bb203\/raw\/623c707748925c969c525ade4bb432f95b61cff0\/node-ca-updater-daemonset.yaml<\/span><\/a><\/span><\/p>\n

Il faut n\u00e9anmoins modifier les 3 champs en rouge :<\/span><\/p>\n

apiVersion: v1<\/span><\/em><\/span>
\ndata:<\/span><\/em><\/span>
\n\u00a0 ca.pem: |+<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 —–BEGIN CERTIFICATE—–<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 Mettre votre certificat<\/strong><\/span><\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 —–END CERTIFICATE—–<\/span><\/em><\/span><\/p>\n

kind: ConfigMap<\/span><\/em><\/span>
\nmetadata:<\/span><\/em><\/span>
\n\u00a0name: trusted-ca-cm<\/span><\/em><\/span>
\n\u00a0namespace: default<\/span><\/em><\/span><\/p>\n

\u00a0\u00a0 —-<\/span><\/p>\n

apiVersion: v1<\/span><\/em><\/span>
\ndata:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 build-ca.sh: “#!\/usr\/bin\/env bash \\nset -euxo pipefail\\ntdnf update \\ntdnf install -y ca-certificates\\ntdnf install -y openssl-c_rehash\\necho \\”$TRUSTED_CERT\\” > \/etc\/ssl\/certs\/my-trusted-cert.pem\\n\/usr\/bin\/rehash_ca_certificates.sh\\ncurl -vv https:\/\/<Votre URL HARBOR><\/span><\/strong><\/span>\\n”<\/span><\/em><\/span>
\nkind: ConfigMap<\/span><\/em><\/span>
\nmetadata:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 name: rehash-script<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 namespace: default<\/span><\/em><\/span>
\n—\u00a0\u00a0\u00a0<\/span><\/em><\/span>
\napiVersion: apps\/v1<\/span><\/em><\/span>
\nkind: DaemonSet<\/span><\/em><\/span>
\nmetadata:<\/span><\/em><\/span>
\n\u00a0 name: trusted-ca-updater<\/span><\/em><\/span>
\n\u00a0 namespace: default<\/span><\/em><\/span>
\n\u00a0 labels:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 k8s-app: trusted-ca-updater<\/span><\/em><\/span>
\nspec:<\/span><\/em><\/span>
\n\u00a0 selector:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 matchLabels:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 name: trusted-ca-updater<\/span><\/em><\/span>
\n\u00a0 template:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 metadata:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 labels:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name: trusted-ca-updater<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0 spec:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 tolerations:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 # this toleration is to have the daemonset runnable on master nodes<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 # remove it if your masters can’t run pods<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 – key: node-role.kubernetes.io\/master<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 effect: NoSchedule<\/span><\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 initContainers:<\/span><\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 – name: script-runner<\/span><\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 image: photon:3.0<\/span><\/span><\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 command: [“\/bin\/sh”, “-c”, “\/root\/build-ca.sh” ]<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 volumeMounts:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 – name: update-trusted-certs-script<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mountPath: \/root\/<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 – name: certs-dir<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mountPath: \/etc\/ssl\/certs<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 – name: agg-certs-dir<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 mountPath: \/etc\/pki\/tls\/certs\/<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 env:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 – name: TRUSTED_CERT<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 valueFrom:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 configMapKeyRef:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name: trusted-ca-cm<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 key: ca.pem\u00a0\u00a0\u00a0<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 resources:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 limits:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ephemeral-storage: 30G # mettre une plus petite taille<\/span><\/strong><\/span><\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 containers:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 – name: sleepy<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 image: photon:3.0<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 command: [“\/bin\/sh”]<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 args: [“-c”, “while true; do sleep 3600;done”]<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 volumes:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 – name: update-trusted-certs-script<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 configMap:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name: rehash-script<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 defaultMode: 0766<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 – name: certs-dir<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 hostPath:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 path: \/etc\/ssl\/certs<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 type: Directory<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 – name: agg-certs-dir<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 hostPath:<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 path: \/etc\/pki\/tls\/certs\/<\/span><\/em><\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 type: Directory<\/span><\/em><\/span><\/p>\n

 <\/p>\n

Il faut ensuite se connecter sur les workernodes pour relancer containerd. Ci-dessous un exemple pour TKG (<\/span><\/span>Une solution Kubernetes as a Service pour tous les Clouds)<\/span><\/a><\/span><\/span><\/p>\n

# ssh capv@<ip-YourWokerNode><\/span><\/em><\/p>\n

capv@YourWokerNode$ sudo systemctl restart containerd<\/span><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Dans cet article (D\u00e9ployer Harbor avec type loadBalancer) j’ai expliqu\u00e9 comment d\u00e9ployer Habor et utiliser le certificat self-signed pour que Docker puisse l’utiliser. Si vous utilisez Kubernetes avec docker, vous pouvez aussi suivre cette proc\u00e9dure sur chaque worker node. Sinon vous risquez d’avoir l’erreur suivante : Unknown desc = failed to pull and unpack image<\/p><\/div>\n

Lire la suite<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[147],"tags":[177,176,99,148,180,29,28,167,179,150,6,178,181],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/loeilduse.fr\/index.php?rest_route=\/wp\/v2\/posts\/827"}],"collection":[{"href":"https:\/\/loeilduse.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/loeilduse.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/loeilduse.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/loeilduse.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=827"}],"version-history":[{"count":2,"href":"https:\/\/loeilduse.fr\/index.php?rest_route=\/wp\/v2\/posts\/827\/revisions"}],"predecessor-version":[{"id":829,"href":"https:\/\/loeilduse.fr\/index.php?rest_route=\/wp\/v2\/posts\/827\/revisions\/829"}],"wp:attachment":[{"href":"https:\/\/loeilduse.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/loeilduse.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/loeilduse.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}