Add controller proxy certs.

nix/kubernetes/keys/package/k8s-controller-proxy/files/ca-config.json

@@ -0,0 +1,13 @@
+{
+  "signing": {
+    "default": {
+      "expiry": "8760h"
+    },
+    "profiles": {
+      "kubernetes": {
+        "usages": ["signing", "key encipherment", "server auth", "client auth"],
+        "expiry": "8760h"
+      }
+    }
+  }
+}

nix/kubernetes/keys/package/k8s-controller-proxy/files/controller0-proxy-csr.json

@@ -0,0 +1,16 @@
+{
+  "CN": "system:node:controller0",
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "C": "US",
+      "L": "Portland",
+      "O": "system:nodes",
+      "OU": "Kubernetes The Hard Way",
+      "ST": "Oregon"
+    }
+  ]
+}

nix/kubernetes/keys/package/k8s-controller-proxy/files/controller1-proxy-csr.json

@@ -0,0 +1,16 @@
+{
+  "CN": "system:node:controller1",
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "C": "US",
+      "L": "Portland",
+      "O": "system:nodes",
+      "OU": "Kubernetes The Hard Way",
+      "ST": "Oregon"
+    }
+  ]
+}

nix/kubernetes/keys/package/k8s-controller-proxy/files/controller2-proxy-csr.json

@@ -0,0 +1,16 @@
+{
+  "CN": "system:node:controller2",
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "C": "US",
+      "L": "Portland",
+      "O": "system:nodes",
+      "OU": "Kubernetes The Hard Way",
+      "ST": "Oregon"
+    }
+  ]
+}

nix/kubernetes/keys/package/k8s-controller-proxy/package.nix

@@ -0,0 +1,48 @@
+# unpackPhase
+# patchPhase
+# configurePhase
+# buildPhase
+# checkPhase
+# installPhase
+# fixupPhase
+# installCheckPhase
+# distPhase
+{
+  lib,
+  stdenv,
+  sqlite,
+  cfssl,
+  k8s,
+  all_hostnames,
+  controllers,
+  ...
+}:
+let
+  get_hostnames = (
+    hostname: (builtins.concatStringsSep "," ([ hostname ] ++ controllers."${hostname}".internal_ips))
+  );
+  install_body = (
+    lib.concatMapStringsSep "\n" (hostname: ''
+      cfssl gencert \
+            -ca=${k8s.requestheader-client-ca}/requestheader-client-ca.pem \
+            -ca-key=${k8s.requestheader-client-ca}/requestheader-client-ca-key.pem \
+            -config=${./files/ca-config.json} \
+            -hostname=${get_hostnames hostname} \
+            -profile=kubernetes \
+            ${./files}/${hostname}-proxy-csr.json | cfssljson -bare ${hostname}-proxy
+    '') (builtins.attrNames controllers)
+  );
+in
+stdenv.mkDerivation (finalAttrs: {
+  name = "k8s-controller-proxy";
+  nativeBuildInputs = [ cfssl ];
+  buildInputs = [ ];
+
+  unpackPhase = "true";
+
+  installPhase = ''
+    mkdir -p "$out"
+    cd "$out"
+  ''
+  + install_body;
+})

nix/kubernetes/keys/package/k8s-keys/package.nix

@@ -10,5 +10,6 @@ symlinkJoin {
     k8s.ca
     k8s.service_account
     k8s.requestheader-client-ca
+    k8s.controller-proxy
   ];
 }