152 lines
4.1 KiB
Bash
152 lines
4.1 KiB
Bash
#!/bin/sh
|
|
|
|
# Copyright 2014 The Kubernetes Authors All rights reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
. /etc/sysconfig/heat-params
|
|
|
|
set -o errexit
|
|
set -o nounset
|
|
set -o pipefail
|
|
|
|
if [ "$TLS_DISABLED" == "True" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
if [ "$VERIFY_CA" == "True" ]; then
|
|
VERIFY_CA=""
|
|
else
|
|
VERIFY_CA="-k"
|
|
fi
|
|
|
|
if [ -z "${KUBE_NODE_IP}" ]; then
|
|
KUBE_NODE_IP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
|
|
fi
|
|
|
|
cert_dir=/etc/kubernetes/certs
|
|
|
|
mkdir -p "$cert_dir"
|
|
|
|
CA_CERT=$cert_dir/ca.crt
|
|
|
|
function generate_certificates {
|
|
_CERT=$cert_dir/${1}.crt
|
|
_CSR=$cert_dir/${1}.csr
|
|
_KEY=$cert_dir/${1}.key
|
|
_CONF=$2
|
|
#Get a token by user credentials and trust
|
|
auth_json=$(cat << EOF
|
|
{
|
|
"auth": {
|
|
"identity": {
|
|
"methods": [
|
|
"password"
|
|
],
|
|
"password": {
|
|
"user": {
|
|
"id": "$TRUSTEE_USER_ID",
|
|
"password": "$TRUSTEE_PASSWORD"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
)
|
|
|
|
content_type='Content-Type: application/json'
|
|
url="$AUTH_URL/auth/tokens"
|
|
USER_TOKEN=`curl $VERIFY_CA -s -i -X POST -H "$content_type" -d "$auth_json" $url \
|
|
| grep X-Subject-Token | awk '{print $2}' | tr -d '[[:space:]]'`
|
|
|
|
# Get CA certificate for this cluster
|
|
curl $VERIFY_CA -X GET \
|
|
-H "X-Auth-Token: $USER_TOKEN" \
|
|
-H "OpenStack-API-Version: container-infra latest" \
|
|
$MAGNUM_URL/certificates/$CLUSTER_UUID | python -c 'import sys, json; print json.load(sys.stdin)["pem"]' > $CA_CERT
|
|
|
|
# Generate client's private key and csr
|
|
openssl genrsa -out "${_KEY}" 4096
|
|
chmod 400 "${_KEY}"
|
|
openssl req -new -days 1000 \
|
|
-key "${_KEY}" \
|
|
-out "${_CSR}" \
|
|
-reqexts req_ext \
|
|
-config "${_CONF}"
|
|
|
|
# Send csr to Magnum to have it signed
|
|
csr_req=$(python -c "import json; fp = open('${_CSR}'); print json.dumps({'cluster_uuid': '$CLUSTER_UUID', 'csr': fp.read()}); fp.close()")
|
|
curl $VERIFY_CA -X POST \
|
|
-H "X-Auth-Token: $USER_TOKEN" \
|
|
-H "OpenStack-API-Version: container-infra latest" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$csr_req" \
|
|
$MAGNUM_URL/certificates | python -c 'import sys, json; print json.load(sys.stdin)["pem"]' > ${_CERT}
|
|
}
|
|
|
|
#Kubelet Certs
|
|
INSTANCE_NAME=$(hostname --short | sed 's/\.novalocal//')
|
|
HOSTNAME=$(hostname)
|
|
|
|
cat > ${cert_dir}/kubelet.conf <<EOF
|
|
[req]
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = req_ext
|
|
prompt = no
|
|
[req_distinguished_name]
|
|
CN = system:node:${INSTANCE_NAME}
|
|
O=system:nodes
|
|
OU=OpenStack/Magnum
|
|
C=US
|
|
ST=TX
|
|
L=Austin
|
|
[req_ext]
|
|
subjectAltName = IP:${KUBE_NODE_IP},DNS:${INSTANCE_NAME},DNS:${HOSTNAME}
|
|
keyUsage=critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage=clientAuth,serverAuth
|
|
EOF
|
|
|
|
#kube-proxy Certs
|
|
cat > ${cert_dir}/proxy.conf <<EOF
|
|
[req]
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = req_ext
|
|
prompt = no
|
|
[req_distinguished_name]
|
|
CN = system:kube-proxy
|
|
O=system:node-proxier
|
|
OU=OpenStack/Magnum
|
|
C=US
|
|
ST=TX
|
|
L=Austin
|
|
[req_ext]
|
|
keyUsage=critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage=clientAuth
|
|
EOF
|
|
|
|
generate_certificates kubelet ${cert_dir}/kubelet.conf
|
|
generate_certificates proxy ${cert_dir}/proxy.conf
|
|
|
|
# Common certs and key are created for both etcd and kubernetes services.
|
|
# Both etcd and kube user should have permission to access the certs and key.
|
|
groupadd kube_etcd
|
|
usermod -a -G kube_etcd etcd
|
|
usermod -a -G kube_etcd kube
|
|
chmod 550 "${cert_dir}"
|
|
chown -R kube:kube_etcd "${cert_dir}"
|
|
chmod 440 ${cert_dir}/kubelet.key
|
|
chmod 440 ${cert_dir}/proxy.key
|
|
mkdir -p /etc/flanneld/certs
|
|
cp ${cert_dir}/* /etc/flanneld/certs
|