Manage certificates using nix.

base/pki.nix

@@ -1,4 +1,3 @@
-# {pkgs, ...}:
 with import <nixpkgs> {};
 let
   ca-config = pkgs.writeText "ca-config.json" ''
@@ -37,6 +36,7 @@ let
       }
   }
   '';
+
   csr = args: pkgs.writeText "${args.cn}-cert.json" ''
     {
     "CN": "${args.cn}",
@@ -62,6 +62,7 @@ let
       buildInputs = [ pkgs.cfssl ];
     } '' cfssl genkey -initca ${ca-csr} | cfssljson -bare ca; \
          mkdir -p $out; cp *.pem $out'';
+
   ca_cert = "${ca}/ca.pem";
   ca_key = "${ca}/ca-key.pem";
 
@@ -70,58 +71,15 @@ let
     -config=${ca-config} -profile=${profile} ${name} | cfssljson -bare cert; \
     mkdir -p $out; cp *.pem $out
   '';
-  mkCert = cert:
+in
+  rec {
+    inherit ca_cert;
+    inherit ca_key;
+    inherit csr;
+
+    mkCert = cert:
     pkgs.runCommand "${cert.name}-cert" {
       buildInputs = [ pkgs.cfssl ];
     } (cfssl cert.csr cert.profile);
 
-  server-csr = csr {
-    cn = "kubernetes";
-    hosts = ''"kubernetes", "k8s0-0", "10.253.18.100"'';
-  };
-  server_cert = "${ca}/cert.pem";
-  server_key = "${ca}/cert-key.pem";
-
-  etcd0-csr = csr {
-    cn = "etcd0";
-    hosts = ''"etcd0", "10.253.18.100"'';
-  };
-  etcd0_cert = "${ca}/cert.pem";
-  etcd0_key = "${ca}/cert-key.pem";
-
-  etcd1-csr = csr {
-    cn = "etcd1";
-    hosts = ''"etcd1", "10.253.18.101"'';
-  };
-  etcd1_cert = "${ca}/cert.pem";
-  etcd1_key = "${ca}/cert-key.pem";
-
-  client-csr = csr {
-    cn = "client";
-    hosts = '''';
-  };
-  client_cert = "${ca}/cert.pem";
-  client_key = "${ca}/cert-key.pem";
-in
-rec {
-  server-cert = mkCert {
-      name = "kubernetes";
-      csr = server-csr;
-      profile = "server";
-  };
-  etcd0-cert = mkCert {
-      name = "etcd0";
-      csr = etcd0-csr;
-      profile = "peer";
-  };
-  etcd1-cert = mkCert {
-      name = "etcd1";
-      csr = etcd1-csr;
-      profile = "peer";
-  };
-  client-cert = mkCert {
-      name = "client";
-      csr = client-csr;
-      profile = "client";
-  };
-}
+  }