cat /etc/kubernetes/pki/ca.crt

1.直接使用二进制源码包安装cfssl
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
chmod +x cfssl_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x cfssljson_linux-amd64
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl-certinfo_linux-amd64
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
export PATH=/usr/local/bin:$PATH

准备证书签名请求
mkdir /usr/local/k8s/cfssl
cd /usr/local/k8s/cfssl

vi admin-csr.json
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "HangZhou",
      "L": "XS",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}

3.创建证书和私钥
cd /usr/local/k8s/cfssl
cfssl gencert -ca=/etc/kubernetes/pki/ca.crt -ca-key=/etc/kubernetes/pki/ca.key --profile=kubernetes admin-csr.json | cfssljson -bare admin
 生成以下三个文件
ls -l 
admin.csr
admin-key.pem
admin.pem

4.我们可以通过openssl来转换成pkc格式： 
openssl pkcs12 -export -out ./jenkins-admin.pfx -inkey ./admin-key.pem -in ./admin.pem -passout pass:secret
生成jenkins-admin.pfxpfx文件
ls
 jenkins-admin.pfx

docker pull cnych/jenkins:jnlp6

docker tag cnych/jenkins:jnlp6 harbor.demo.com/private/demo-jenkins:jnlp

docker push harbor.demo.com/private/demo-jenkins:jnlp

podTemplate(label: 100kip, cloud: kubernetes) {
    node(100kip) {

        environment {
            harborHost = ""
            harborCertificate = ""
            kubeconfigId = ""
            privateHarbor = ""
            version=""
            images=""
            yamlPath="";
        }

        stage(Clone) {
            echo "1.Clone Stage"
            checkout([$class: GitSCM,
             branches: [[name: */${branch}]],
             doGenerateSubmoduleConfigurations: false,
             extensions: [[$class: CloneOption, depth: 1, honorRefspec: true, noTags: true, reference: , shallow: true]],
             submoduleCfg: [],
             userRemoteConfigs: [[credentialsId: jenkins_gitlab, url: ${git_url}]]]
             )
        }

        stage(pom version) {
            echo "2.pom version"
            def pom = readMavenPom file: pom.xml
            version = "${pom.version}"
            harborHost = "harbor.demo.com"
            harborCertificate = "harbor_username_password"
            kubeconfigId = "kubernetes_config"
            privateHarbor = "${harborHost}\\/kb"
            images = "${privateHarbor}\\/${module}:${version}-${BUILD_NUMBER}"
            echo "version:${version}-----privateHarbor:${privateHarbor}----images:${images}"
            def isCanary="${canary}";
            if(isCanary == "true"){
                echo "灰度发布"
                yamlPath = "k8s/${profiles}/canary/${module}-canary.yaml";
            }else{
                yamlPath = "k8s/${profiles}/${module}.yaml";
            }
        }

        stage(Maven bulid) {
          echo "2.Maven bulid"
          sh "mvn clean package -pl ${module} -P ${profiles} -DskipTests -U "
        }

        stage(Docker build) {
            echo "3.Build Docker Image Stage"
            def buildArg = "-f ${module}/Dockerfile --build-arg version=${version} --build-arg module=${module} ."
            def customImage = docker.build("${images}", "${buildArg}")
            docker.withRegistry("http://${harborHost}", "${harborCertificate}") {
                customImage.push()
            }
        }

        stage(K8S Deploy) {
             echo "K8S Deploy"
             sh "sed -i s/${module}:lastest/${images}/g ${yamlPath}"
             kubernetesDeploy configs: "${yamlPath}", kubeconfigId: "${kubeconfigId}"
             echo "Service deploy successfully! please request http://${domain}"
        }

    }
}