talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Generate certificates for the aggregation layer.

Browse Source
This commit is contained in:
Tom Alexander
2026-01-09 18:19:34 -05:00
parent c0ace47d95
commit fd1ea9e890
13 changed files with 204 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
nix/kubernetes/roles/etcd/default.nix
View File

@@ -59,8 +59,8 @@
keyFile = "/.persist/keys/etcd/kube-api-server.key";
peerCertFile = "/.persist/keys/etcd/kube-api-server.crt";
peerKeyFile = "/.persist/keys/etcd/kube-api-server.key";
trustedCaFile = "/.persist/keys/etcd/ca.crt";
peerTrustedCaFile = "/.persist/keys/etcd/ca.crt";
trustedCaFile = "/.persist/keys/etcd/client-ca.crt";
peerTrustedCaFile = "/.persist/keys/etcd/client-ca.crt";
peerClientCertAuth = true;
clientCertAuth = true;
initialAdvertisePeerUrls = (

14
nix/kubernetes/roles/kube_apiserver/default.nix
View File

@@ -65,15 +65,15 @@ in
"--audit-log-path=/var/log/audit.log"
"--authorization-mode=Node,RBAC"
"--bind-address=0.0.0.0"
"--client-ca-file=/.persist/keys/kube/ca.crt"
"--client-ca-file=/.persist/keys/kube/client-ca.crt"
"--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
"--etcd-cafile=/.persist/keys/kube/ca.crt"
"--etcd-cafile=/.persist/keys/kube/client-ca.crt"
"--etcd-certfile=/.persist/keys/kube/kube-api-server.crt"
"--etcd-keyfile=/.persist/keys/kube/kube-api-server.key"
"--etcd-servers=${builtins.concatStringsSep "," config.me.kube_apiserver.etcd_services}"
"--event-ttl=1h"
"--encryption-provider-config=/.persist/keys/kube/encryption-config.yaml"
"--kubelet-certificate-authority=/.persist/keys/kube/ca.crt"
"--kubelet-certificate-authority=/.persist/keys/kube/client-ca.crt"
"--kubelet-client-certificate=/.persist/keys/kube/kube-api-server.crt"
"--kubelet-client-key=/.persist/keys/kube/kube-api-server.key"
"--runtime-config='api/all=true'"
@@ -85,6 +85,14 @@ in
"--tls-private-key-file=/.persist/keys/kube/kube-api-server.key"
"--tls-min-version=VersionTLS13"
"--service-cluster-ip-range=fd00:3e42:e349::/112,10.197.0.0/16"
"--requestheader-client-ca-file=/.persist/keys/kube/requestheader-client-ca.crt"
"--requestheader-allowed-names=\"\"" # CN must be in this list to be valid. Blank = accept all CN.
"--requestheader-extra-headers-prefix=X-Remote-Extra"
"--requestheader-group-headers=X-Remote-Group"
"--requestheader-username-headers=X-Remote-User"
"--proxy-client-cert-file=/.persist/keys/kube/proxy.crt"
"--proxy-client-key-file=/.persist/keys/kube/proxy.key"
"--enable-aggregator-routing=true"
"--v=2"
# OLD:

6
nix/kubernetes/roles/kube_controller_manager/default.nix
View File

@@ -44,10 +44,10 @@ in
"--node-cidr-mask-size-ipv4=20" # default is 24
"--node-cidr-mask-size-ipv6=112" # default is 64, must be smaller than cluster-cidr mask
"--cluster-name=kubernetes"
"--cluster-signing-cert-file=/.persist/keys/kube/ca.crt"
"--cluster-signing-key-file=/.persist/keys/kube/ca.key"
"--cluster-signing-cert-file=/.persist/keys/kube/client-ca.crt"
"--cluster-signing-key-file=/.persist/keys/kube/client-ca.key"
"--kubeconfig=/.persist/keys/kube/kube-controller-manager.kubeconfig"
"--root-ca-file=/.persist/keys/kube/ca.crt"
"--root-ca-file=/.persist/keys/kube/client-ca.crt"
"--service-account-private-key-file=/.persist/keys/kube/service-accounts.key"
# "--service-cluster-ip-range=10.197.0.0/16"
# "--service-cluster-ip-range=2620:11f:7001:7:ffff:ffff:0ac5:0000/16"

2
nix/kubernetes/roles/kubelet/default.nix
View File

@@ -22,7 +22,7 @@ let
enabled = true;
};
x509 = {
clientCAFile = "/.persist/keys/kube/ca.crt";
clientCAFile = "/.persist/keys/kube/client-ca.crt";
};
};
authorization = {