端点。默认情况下，apiserver不验证kubelet的证书，这使得连接可能会受到中间⼈的 攻击，并且在不可信/公共⽹络上运⾏是不安全的。 要验证此连接，请使⽤ --kubelet-certificate-authority 标志，为apiserver提供⼀个根证书包，⽤于验证kubelet的证 书。 如果不能这样做，如果需要，请在apiiserver和kubelet之间使⽤ SSH tunneling internet | [ Ingress ] --|-----|-- [ Services ] 可配置Ingress，从⽽提供外部可访问的URL、负载均衡流量、SSL、提供基于名称的虚拟主机等。⽤户通过POST Ingress资源到API Server的⽅式来请求Ingress。 Ingress controller 负责实现Ingress，通常使⽤负载均衡器，也可配置

token Step5: 生成 SSL 证书的 secret //生成自签名 SSL 证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=k8s-dashboard.xxx.com" //生成 SSL 证书的 secret kubectl yaml Step7: 创建 SSL 证书的 secret //生成自签名 SSL 证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=k8s-dashboard.xxx.com" //生成 SSL 证书的 secret kubectl (for HTTPs)创建 secret tls //生成自签名 SSL 证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=iot.xxx.com" //生成 SSL 证书的 secret kubectl create secret tls

Plane will be created. Would you like to use existing CA? [1] I'll provide CA certificate and key [2] Generate CA certificate and key Please enter your numeric choice [2]: 2 Enter the path to the SSH

的 disabled_plugins = ["cri"] #再重启containerd即可有 unix:///run/containerd/containerd.sock 接口 #信任私有镜像仓库ssl证书，添加或修改以下几行配置 [plugins."io.containerd.grpc.v1.cri".registry.configs] [plugins."io.containerd privatekey=${HOME}/.ssh/id_rsa \ --from-file=ssh-publickey=${HOME}/.ssh/id_rsa.pub 创建ssl证书secret # kubectl create secret tls cof-lee.com-ssl --key=./cof-lee.com.key --cert=./cof- lee.com.crt # kubectl get secret secret NAME TYPE DATA AGE cof-lee.com-ssl kubernetes.io/tls 2 7s database-auth Opaque 2 10m myssh-key-secret Opaque 2

daemonset [1] • kms-plugins deployed as deployment • Interfaces • https + connection reuse • certificate: similar to apiserver ó etcd (X.509) • Version-based key synchronization • Adaption • apiserver

Manager AWS WAF AWS IAM Amazon GuardDuty Amazon Macie AWS Security Hub AWS CloudHSM AWS Certificate Manager AWS CloudTrail host container dependencies code config userdata © 2019, Amazon