Improve certificate generation.

pki/ca-config.json

@@ -0,0 +1,34 @@
+{
+    "signing": {
+        "default": {
+            "expiry": "43800h"
+        },
+        "profiles": {
+            "server": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                "key encipherment",
+                "server auth"
+                    ]
+            },
+            "client": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                "key encipherment",
+                "client auth"
+                    ]
+            },
+            "peer": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                "key encipherment",
+                "server auth",
+                "client auth"
+                    ]
+            }
+        }
+    }
+}

pki/ca.json

@@ -1,9 +1,5 @@
 {
-    "hosts": [
+    "CN": "k8s0",
-        "itpartner.no",
-        "itpartner.intern",
-        "cluster.local"
-    ],
     "key": {
         "algo": "rsa",
         "size": 2048

pki/client.json

@@ -1,9 +1,6 @@
 {
-    "CN": "@host@",
+    "CN": "client",
-    "hosts": [
+    "hosts": [ "" ],
-        "@host@",
-        "@ip@"
-    ],
     "key": {
         "algo": "rsa",
         "size": 2048

pki/etcd.json

@@ -1,7 +1,8 @@
 {
+    "CN": "@host@",
     "hosts": [
-        "etcd0",
+        "@host@",
-        "etcd1"
+        "@ip"
     ],
     "key": {
         "algo": "rsa",

pki/mkcerts.sh

@@ -1,57 +1,55 @@
 #!/usr/bin/env bash
 
-hosts="k8s0-0,100 k8s0-1,101 k8s0-2,102"
+etcd="etcd0,100 etcd1,101"
 
-mkcacert () {
+cacert () {
     cfssl genkey -initca ca.json | cfssljson -bare ca
 }
 
-mkapicert () {
+servercert () {
-    cfssl gencert -ca ca.pem -ca-key ca-key.pem apiserver.json \
+    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
-    | cfssljson -bare apiserver
+        -config=ca-config.json -profile=server server.json \
+        | cfssljson -bare server
 }
 
-mketcdcert () {
+etcdcert () {
-    cfssl gencert -ca ca.pem -ca-key ca-key.pem etcd.json \
-    | cfssljson -bare etcd
-}
-
-# mkclientcert () {
-#     cfssl gencert -ca ca.pem -ca-key ca-key.pem client.json \
-#     | cfssljson -bare client
-# }
-
-mkclientcert () {
     host=$1
     ip=$2
-    sed "s/@host@/$host/g; s/@ip@/$ip/g; " client.json \
+    sed "s/@host@/$host/g; s/@ip@/$ip/g;" etcd.json \
-        | cfssl gencert -ca ca.pem -ca-key ca-key.pem - \
+        | cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
+        -config=ca-config.json -profile=peer - \
         | cfssljson -bare $host
 }
 
-mkclientcerts () {
+clientcert () {
-    for i in $hosts; do
+    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
+        -config=ca-config.json -profile=client client.json \
+        | cfssljson -bare client
+}
+
+mketcdcerts () {
+    for i in $etcd; do
         IFS=","
         set -- $i
-        mkclientcert $1 10.253.18.$2
+        etcdcert $1 10.253.18.$2
     done
 }
 
 case $1 in
     all)
-        mkcacert
+        cacert
-        mkapicert
+        servercert
-        mketcdcert
+        mketcdcerts
-        mkclientcert
+        clientcert
         ;;
     client)
-        mkclientcerts
+        clientcert
         ;;
     api)
-        mkapicert
+        servercert
         ;;
     etcd)
-        mketcdcert
+        mketcdcerts
         ;;
     *)
         echo "usege: mkcerts.sh (all|client|api|etcd)"

pki/server.json

@@ -1,4 +1,5 @@
 {
+    "CN": "server",
     "hosts": [
         "k8s0-0",
         "kubernetes",

test/gitlab.yaml

@@ -0,0 +1,56 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitlab
+  labels:
+    run: gitlab
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+  - port: 443
+    protocol: TCP
+    name: https
+  - port: 22
+    protocol: TCP
+    name: ssh
+  selector:
+   run: gitlab
+---
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: gitlab
+  namespace: default
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: busybox
+      containers:
+      - image: gitlab/gitlab-ce:latest
+        name: gitlab-container
+        ports:
+        - containerPort: 80
+        - containerPort: 22
+        - containerPort: 443
+      volumeMounts:
+      - mountPath: /etc/gitlab
+        name: gitlab-data
+        subPath: config
+      - mountPath: /var/log/gitlab
+        name: gitlab-data
+        subPath: logs
+      - mountPath: /var/opt/gitlab
+        name: gitlab-data
+        subPath: data
+      volumes:
+      - name: gitlab-data
+        nfs:
+          server: 10.253.10.103
+          path: /data/gitlab
+          ReadOnly: false