-
Notifications
You must be signed in to change notification settings - Fork 2
/
gencert.sh
84 lines (72 loc) · 2.7 KB
/
gencert.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
#!/bin/bash
# Generates the a CA cert, a server key, and a server cert signed by the CA.
# reference:
# https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/admission/webhook/gencerts.sh
set -o errexit
CN_BASE="basic-validation-controller"
TMP_DIR="/tmp/webhook-certs"
SECRET_NAME="webhook-tls-certs"
while [[ $# -gt 0 ]]; do
case ${1} in
--service)
service="$2"
shift
;;
--secret)
secret="$2"
shift
;;
--namespace)
namespace="$2"
shift
;;
*)
esac
shift
done
[ -z "${service}" ] && service=${CN_BASE}
[ -z "${secret}" ] && secret=${SECRET_NAME}
[ -z "${namespace}" ] && namespace=default
echo "${service}"
echo "${secret}"
echo "${namespace}"
if [ ! -x "$(command -v openssl)" ]; then
echo "openssl not found"
exit 1
fi
echo "Generating certs for the Webhook Admission Controller in ${TMP_DIR}."
mkdir -p ${TMP_DIR}
cat > ${TMP_DIR}/server.conf << EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = ${service}
DNS.2 = ${service}.${namespace}
DNS.3 = ${service}.${namespace}.svc
EOF
# Create a certificate authority
openssl genrsa -out ${TMP_DIR}/caKey.pem 2048
set +o errexit
openssl req -x509 -new -nodes -key ${TMP_DIR}/caKey.pem -days 100000 -out ${TMP_DIR}/caCert.pem -subj "/CN=${service}_ca" -addext "subjectAltName = DNS:${service}_ca"
if [[ $? -ne 0 ]]; then
echo "ERROR: Failed to create CA certificate for self-signing. If the error is \"unknown option -addext\", update your openssl version."
exit 1
fi
set -o errexit
# Create a server certiticate
openssl genrsa -out ${TMP_DIR}/serverKey.pem 2048
# Note the CN is the DNS name of the service of the webhook.
openssl req -new -key ${TMP_DIR}/serverKey.pem -out ${TMP_DIR}/server.csr -subj "/CN=${basic-validation-controller}.${namespace}.svc" -config ${TMP_DIR}/server.conf -addext "subjectAltName = DNS:${service}.${namespace}.svc"
openssl x509 -req -in ${TMP_DIR}/server.csr -CA ${TMP_DIR}/caCert.pem -CAkey ${TMP_DIR}/caKey.pem -CAcreateserial -out ${TMP_DIR}/serverCert.pem -days 100000 -extensions SAN -extensions v3_req -extfile ${TMP_DIR}/server.conf
echo "Uploading certs to the cluster."
kubectl create secret --namespace=${namespace} generic ${SECRET_NAME} --from-file=${TMP_DIR}/serverKey.pem --from-file=${TMP_DIR}/caKey.pem --from-file=${TMP_DIR}/caCert.pem --from-file=${TMP_DIR}/serverCert.pem
# Clean up after we're done.
echo "Deleting ${TMP_DIR}."
# rm -rf ${TMP_DIR}