Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateAllCertificates ¶
GenerateAllCertificates creates all certificates needed for the specified component it generates the CA certificate, kubelet certificate, apiserver certificate, controller-manager certificate, admin certificate, webhook certificate, and request header certificates all certificates are generated as self-signed certificates
func InvalidateIfStale ¶ added in v1.2.1
InvalidateIfStale checks whether the existing apiserver certificate still matches the configuration. If it does not, it removes the leaf certificates so that GenerateAllCertificates will re-sign fresh ones on the next call.
Two things can make it stale. The advertised node IP may have moved, which handles DHCP address changes between restarts: the old certs embed the previous IP in their SANs, causing TLS failures until the PKI is regenerated. The configured extra SANs may also have changed — adding one to the configuration has no other trigger to re-sign, so without this the new name is silently rejected by TLS until the certificate expires or the node IP moves.
The CA is deliberately preserved (see removeLeafCerts): regenerating it on every IP change would rotate the cluster's trust anchor and force every previously distributed kubeconfig to be updated. Keeping the CA stable lets re-signed leaf certs (and existing client certs) keep validating.
Types ¶
type CertOptions ¶
type CertOptions struct {
// Type of certificate to generate
Type CertificateType
// Basic information
CommonName string
Organization []string
// Subject Alternative Names
DNSNames []string
IPAddresses []net.IP
// Certificate properties
NotAfterDays int
KeySize int // RSA key size in bits
// For signed certificates
SignerCertDir string
SignerKeyDir string
// Output Dirs
CertDir string
KeyDir string
}
CertOptions holds configuration for certificate generation
type CertificateDirs ¶
CertificateDirs holds Dirs to certificate files
type CertificateType ¶
type CertificateType string
CertificateType defines what type of certificate to generate
const ( // CACert is a certificate authority CACert CertificateType = "ca" // KubeletCert is for the kubelet KubeletCert CertificateType = "kubelet" // APIServerCert is for the API server APIServerCert CertificateType = "apiserver" // ControllerManagerCert is for the kube-controller-manager ControllerManagerCert CertificateType = "controller-manager" // AdminCert is for admin users AdminCert CertificateType = "admin" // WebhookCert is for the webhook WebhookCert CertificateType = "webhook" // RequestHeaderCACert is the request header CA certificate RequestHeaderCACert CertificateType = "request-header-ca" // RequestHeaderClientCert is the request header client certificate RequestHeaderClientCert CertificateType = "request-header-client" // D2KServerCert is the TLS server certificate for the d2k Docker-compatible // API endpoint, signed by the kubesolo CA. D2KServerCert CertificateType = "d2k-server" // D2KClientCert is the TLS client certificate operators present to the d2k // endpoint via `docker --tlscert/--tlskey`, signed by the kubesolo CA. D2KClientCert CertificateType = "d2k-client" )
Source Files