Add expression for generating linkerd trust anchors

modules/initca.nix

@@ -1,9 +1,9 @@
-{ pkgs ? import <nixpkgs> {}, ca ? "", name ? "ca", ...}:
+{ pkgs ? import <nixpkgs> {}, ca ? null, name ? "ca", hosts ? [], ...}:
 with pkgs;
-let
-  ca' =
 let
   ca_csr = pkgs.writeText "${name}-csr.json" (builtins.toJSON {
+      inherit hosts;
+      CN = "${name}";
       key = {
           algo = "rsa";
           size = 2048;
@@ -16,13 +16,14 @@ let
           L = "generated";
         }
       ];
-        });
-    in
+    }
+  );
+  ca' =
       pkgs.runCommand "initca" {
         buildInputs = [ pkgs.cfssl ];
-      } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
+      } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca;
            mkdir -p $out; cp *.pem $out '';
-   initca = if ca != "" then ca else ca';
+   initca = if ca != null then ca else ca';
 in
   # make ca derivation sha depend on initca cfssl output
   pkgs.stdenv.mkDerivation {

modules/linkerd-certs.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+let
+  identity = import ./initca.nix {
+    inherit pkgs;
+    name = "linkerd-identity-ca";
+    hosts = [ "identity.linkerd.cluster.local" ];
+  };
+
+  webhook = import ./initca.nix {
+    inherit pkgs;
+    name = "linkerd-webhook-ca";
+    hosts = [ "webhook.linkerd.cluster.local" ];
+  };
+in {
+    inherit identity webhook;
+}