36 lines
909 B
Nix
36 lines
909 B
Nix
{ pkgs ? import <nixpkgs> {}, initca ? "", ...}:
|
|
with pkgs;
|
|
let
|
|
initca' =
|
|
let
|
|
ca_csr = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
|
|
key = {
|
|
algo = "rsa";
|
|
size = 2048;
|
|
};
|
|
names = [
|
|
{
|
|
CN = "kubernetes-cluster-ca";
|
|
O = "NixOS";
|
|
OU = "services.kubernetes.pki.caSpec";
|
|
L = "generated";
|
|
}
|
|
];
|
|
});
|
|
in
|
|
pkgs.runCommand "initca" {
|
|
buildInputs = [ pkgs.cfssl ];
|
|
} '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
|
|
mkdir -p $out; cp *.pem $out'';
|
|
ca = if initca != "" then initca else initca';
|
|
in
|
|
# make ca derivation sha depend on initca cfssl output
|
|
pkgs.stdenv.mkDerivation {
|
|
name = "ca";
|
|
src = ca;
|
|
buildCommand = ''
|
|
mkdir -p $out;
|
|
cp -r $src/* $out
|
|
'';
|
|
}
|