Improve base deployment and pki handling

lib/pki.nix

@@ -1,5 +1,12 @@
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs, ca ? "" }:
 let
+  initca = import ./initca.nix { inherit pkgs ca; };
+
+  ca' = {
+    key = "${initca}/ca-key.pem";
+    cert = "${initca}/ca.pem";
+  };
+
   ca-config = pkgs.writeText "ca-config.json" ''
   {
       "signing": {
@@ -7,7 +14,7 @@ let
               "expiry": "8760h"
           },
           "profiles": {
-              "kubernetes": {
+              "default": {
                   "usages": [
                       "signing",
                       "key encipherment",
@@ -21,135 +28,55 @@ let
   }
   '';
 
-  csr = o: {
-    key = {
-      algo = "rsa";
-      size = 2048;
-    };
-    names = [
-      {
-        CN = "kubernetes-cluster-ca";
-        O = "${o}";
-        OU = "services.kubernetes.pki.caSpec";
-        L = "generated";
-      }
-    ];
-  };
-
-  gencsr = args: pkgs.writeText "${args.name}-csr.json" (builtins.toJSON {
-      CN = "${args.cn}";
-      hosts = [ "${args.hosts}" ];
-    } // csr args.o
-  );
-
-  initca' =
+  gencsr = args:
     let
-      ca_csr = pkgs.writeText "kube-pki-cacert-csr.json" (
-        builtins.toJSON (csr "NixOS")
-      );
+      csr = {
+        CN = "${args.cn}";
+        key = {
+          algo = "rsa";
+          size = 2048;
+        };
+        names = [
+          {
+            CN = "${args.cn}";
+            O = "${args.o}";
+            OU = "${args.cn}.${args.o}.pki.caSpec";
+            L = "generated";
+          }
+        ];
+        hosts = [ "${args.hosts}" ];
+      };
     in
-      pkgs.runCommand "initca" {
-        buildInputs = [ pkgs.cfssl ];
-      } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
-           mkdir -p $out; cp *.pem $out'';
-
-  # make ca derivation sha depend on initca cfssl output
-  initca = pkgs.stdenv.mkDerivation {
-    name = "ca";
-    src = initca';
-    buildCommand = ''
-      mkdir -p $out;
-      cp -r $src/* $out
-    '';
-  };
-
-  ca = {
-    key = "${initca}/ca-key.pem";
-    cert = "${initca}/ca.pem";
-  };
-
-  cfssl = conf: ''
-    cfssl gencert -ca ${ca.cert} -ca-key ${ca.key} \
-    -config=${ca-config} -profile=kubernetes ${conf.csr} | \
-    cfssljson -bare cert; \
-    mkdir -p $out; cp *.pem $out
-  '';
-
-  gencert = conf:
-    let crt =
-      pkgs.runCommand "${conf.name}" {
-        buildInputs = [ pkgs.cfssl ];
-      } (cfssl conf);
+      pkgs.writeText "${args.cn}-csr.json" (builtins.toJSON csr);
+in
+# Example usage:
+#
+# gencert { cn = "test"; ca = ca; o = "test; };
+#
+rec {
+  inherit initca;
+  ca = ca';
+  gencert = attrs:
+    let
+      conf = {
+        cn = attrs.cn;
+        ca = attrs.ca;
+        csr = gencsr { cn = attrs.cn; o = attrs.o; hosts = ""; };
+      };
+      cfssl = conf:
+        ''
+          cfssl gencert -ca ${ca.cert} -ca-key ${ca.key} \
+          -config=${ca-config} -profile=default ${conf.csr} | \
+          cfssljson -bare cert; \
+          mkdir -p $out; cp *.pem $out
+        '';
+      crt =
+        pkgs.runCommand "${attrs.cn}" {
+          buildInputs = [ pkgs.cfssl ];
+        } (cfssl conf);
     in
     {
       key = "${crt}/cert-key.pem";
       cert = "${crt}/cert.pem";
     };
-
-  trust = name: hosts:
-    let
-      hosts' = "\"${name}\", " + hosts;
-    in gencert rec {
-      inherit name;
-      csr = gencsr {
-        inherit name;
-        hosts = hosts';
-        cn = name;
-        o = name;
-      };
-    };
-in
-{
-    inherit ca;
-
-    admin = gencert rec {
-        name = "admin";
-        csr = gencsr {
-          inherit name;
-          cn = "admin";
-          o = "system:masters";
-          hosts = "";
-        };
-    };
-
-    apiserver = hosts:
-      gencert rec {
-        name = "kubernetes";
-        csr = gencsr {
-          inherit name hosts;
-          cn = "kubernetes";
-          o = "kubernetes";
-        };
-    };
-
-    etcd = hosts: gencert rec {
-      name = "etcd";
-      csr = gencsr {
-        inherit name hosts;
-        cn = "etcd";
-        o = "kubernetes";
-      };
-    };
-
-    kube-proxy = gencert rec {
-      name = "kube-proxy";
-      csr = gencsr {
-        inherit name;
-        cn = "system:kube-proxy";
-        o = "system:node-proxier";
-        hosts = "";
-      };
-    };
-
-    worker = instance:
-      gencert rec {
-        name = instance.name;
-        csr = gencsr {
-          inherit name;
-          cn = "system:node:${instance.name}";
-          o = "system:nodes";
-          hosts = ''"${instance.name}","${instance.ip}"'';
-        };
-    };
 }
-