certificat • signature de l'émetteur du certificat (thumbprint) · ... ## Composants d'une PKI¹ CA : Autorité de certification - VA : Autorité de validation - RA : Autorité d'enregistrement

timeoutForControlPlane: 4m0s apiVersion: kubeadm.k8s.io/v1beta2 certificatesDir: /etc/kubernetes/pki clusterName: kubernetes controllerManager: {} dns: type: CoreDNS etcd: local: ★如果不想配置信任私有镜像仓库，也可将服务器证书添加到操作系统的 ca 证书库里 # cat ca.com.crt >> /etc/pki/tls/certs/ca-bundle.crt # 将 ca 证书添加到 centos 系统证书信任列表中，链接到： /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ## ② 安装 k8s 二进制组件 #使用 timeoutForControlPlane: 4m0s apiVersion: kubeadm.k8s.io/v1beta3 certificatesDir: /etc/kubernetes/pki clusterName: kubernetes controllerManager: {} dns: {} etcd: local: dataDir: /var/lib/etcd

./easyrsa init-pki Note: using Easy-RSA configuration from: /home/user/CA/vars init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /home/user/CA/pki $ ./easyrsa build-ca now import and sign cert requests. Your new CA certificate file for publishing is at: /home/user/CA/pki/ca.crt Your CA is now configured and you should be able to generate certs easily now. Application 21 Apr 2020 Generating a RSA private key .....++++++ writing new private key to '/home/user/CA/pki/easy-rsa-178308.W6uc3G/tmp.Iqlvgf You are about to be asked to enter information that will be incorporated

generic etc-pki-entitlement --from-file /path/to/entitlement/{ID}.pem \ > --from-file /path/to/entitlement/{ID}-key.pem ... 2. 在构建配置中将 secret 添加为构建输入： source: secrets: - secret: name: etc-pki-entitlement etc-pki-entitlement destinationDir: etc-pki-entitlement 可以通过两个途径来拉取基础 RHEL 镜像： - 将 registry.redhat.io 的 pull secret 添加到您的项目中。 在 openshift 命名空间中为基于 RHEL 的镜像创建镜像流。这样可在整个集群中使用该镜像流。 #### 10.3. 使用 SUBSCRIPTION MANAGER Manager 安装内容： FROM registry.redhat.io/rhel7:latest USER root # Copy entitlements COPY ./etc-pki-entitlement /etc/pki/entitlement # Copy subscription manager configurations COPY ./rhsm-conf /etc/rhsm COPY

509 certificates as identities, adopting a traditional Public Key Infrastructure (PKI) hierarchical model (more on PKI later). ## A Simple Scenario to Explain the Use of an Identity Imagine that you work together in the same way — a PKI provides a list of identities, and an MSP says which of these are members of a given organization that participates in the network. PKI certificate authorities and MSPs MSPs provide a similar combination of functionalities. A PKI is like a card provider — it dispenses many different types of verifiable identities. An MSP, on the other hand, is like the list of card providers

509 certificates as identities, adopting a traditional Public Key Infrastructure (PKI) hierarchical model (more on PKI later). #### 2.4.2 A Simple Scenario to Explain the Use of an Identity Imagine that work together in the same way — a PKI provides a list of identities, and an MSP says which of these are members of a given organization that participates in the network. PKI certificate authorities and MSPs MSPs provide a similar combination of functionalities. A PKI is like a card provider — it dispenses many different types of verifiable identities. An MSP, on the other hand, is like the list of card providers

Docker 策略中将 etc-pki-entitlement secret 添加为构建卷： strategy: dockerStrategy: from: kind: ImageStreamTag name: ubi:latest volumes: - name: etc-pki-entitlement mounts: - destinationPath: /etc/pki/entitlement source: source: type: Secret secret: secretName: etc-pki-entitlement ##### 2.10.3. 使用 Subscription Manager 运行构建 ###### 2.10.3.1. 使用 Subscription Manager 执行 Docker 构建 Docker 策略构建可以使用 Subscription Manager 来安装订阅内容。 /7/7Server/x86_64/os enabled=1 gpgcheck=0 sslverify=0 sslclientkey = /etc/pki/entitlement/...-key.pem sslclientcert = /etc/pki/entitlement/...pem ## 流程 1. 创建包含 Satellite 存储库配置文件的 ConfigMap: $ oc create

“database” directory. Depending on the application, it can be in the following places by default: • ~/.pki/nssdb/pkcs11.txt This is where the system-provided libnss3 library will look by default. ~/snap/firefox/common/ the system NSS libraries. For these examples, we will be using the configuration file located in ~/.pki/nssdb/pkcs11.txt. As noted before, depending on the application this file can be in another directory which has the necessary tools we will need: ## sudo apt install libnss3-tools If you don’t have a ~/.pki/nssdb directory yet, it will have to be created first. For that, we will use the certutil command,

will take you through the critical role identities play in a Fabric network (using an established PKI structure and x.509 certificates). • Membership (conceptual documentation) Talks through the role 509 certificates as identities, adopting a traditional Public Key Infrastructure (PKI) hierarchical model (more on PKI later). #### 4.5.2 A Simple Scenario to Explain the Use of an Identity Imagine that work together in the same way — a PKI provides a list of identities, and an MSP says which of these are members of a given organization that participates in the network. PKI certificate authorities and MSPs

will take you through the critical role identities play in a Fabric network (using an established PKI structure and x.509 certificates). • Membership (conceptual documentation) Talks through the role 509 certificates as identities, adopting a traditional Public Key Infrastructure (PKI) hierarchical model (more on PKI later). ## A Simple Scenario to Explain the Use of an Identity Imagine that you work together in the same way — a PKI provides a list of identities, and an MSP says which of these are members of a given organization that participates in the network. PKI certificate authorities and MSPs