Major revamp.

2018-04-17 21:35:56 +02:00
parent 72285487d6
commit 0ea0abd316
32 changed files with 2600 additions and 353 deletions
--- a/lib/pki.nix
+++ b/lib/pki.nix
@@ -0,0 +1,124 @@
+{ pkgs ? import <nixpkgs> {} }: rec {
+  ca-config = pkgs.writeText "ca-config.json" ''
+  {
+      "signing": {
+          "default": {
+              "expiry": "8760h"
+          },
+          "profiles": {
+              "kubernetes": {
+                  "usages": [
+                      "signing",
+                      "key encipherment",
+                      "server auth",
+                      "client auth"
+                  ],
+                  "expiry": "8760h"
+              }
+          }
+      }
+  }
+  '';
+
+  gencsr = args: pkgs.writeText "${args.name}-csr.json" ''
+    {
+      "CN": "${args.cn}",
+      "hosts": [ ${args.hosts} ],
+      "key": {
+          "algo": "rsa",
+          "size": 2048
+      },
+      "names": [
+          {
+            "O": "${args.o}"
+          }
+      ]
+    }
+  '';
+
+  initca =
+    let
+      ca_csr = gencsr {
+        name = "kubernetes";
+        cn = "kubernetes";
+        o = "kubernetes";
+        hosts = "";
+      };
+    in
+      pkgs.runCommand "ca" {
+        buildInputs = [ pkgs.cfssl ];
+      } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
+           mkdir -p $out; cp *.pem $out'';
+  ca = {
+    key = "${initca}/ca-key.pem";
+    cert = "${initca}/ca.pem";
+  };
+
+  cfssl = conf: ''
+    cfssl gencert -ca ${ca.cert} -ca-key ${ca.key} \
+    -config=${ca-config} -profile=kubernetes ${conf.csr} | \
+    cfssljson -bare cert; \
+    mkdir -p $out; cp *.pem $out
+  '';
+
+  gencert = conf:
+    let
+      drv = pkgs.runCommand "${conf.name}" {
+        buildInputs = [ pkgs.cfssl ];
+      } (cfssl conf);
+    in
+      {
+        key = "${drv}/cert-key.pem";
+        cert = "${drv}/cert.pem";
+      };
+
+  admin = gencert rec {
+      name = "admin";
+      csr = gencsr {
+        inherit name;
+        cn = "admin";
+        o = "system:masters";
+        hosts = "";
+      };
+  };
+
+  apiserver = hosts:
+    gencert rec {
+      name = "kubernetes";
+      csr = gencsr {
+        inherit name hosts;
+        cn = "kubernetes";
+        o = "kubernetes";
+      };
+  };
+
+  etcd = hosts: gencert rec {
+    name = "etcd";
+    csr = gencsr {
+      inherit name hosts;
+      cn = "etcd";
+      o = "kubernetes";
+    };
+  };
+
+  kube-proxy = gencert rec {
+    name = "kube-proxy";
+    csr = gencsr {
+      inherit name;
+      cn = "system:kube-proxy";
+      o = "system:node-proxier";
+      hosts = "";
+    };
+  };
+
+  worker = instance:
+    gencert rec {
+      name = instance.name;
+      csr = gencsr {
+        inherit name;
+        cn = "system:node:${instance.name}";
+        o = "system:nodes";
+        hosts = ''"${instance.name}","${instance.ip}"'';
+      };
+  };
+}