talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Generate certificates for the aggregation layer.

Browse Source
This commit is contained in:
Tom Alexander
2026-01-09 18:19:34 -05:00
parent c0ace47d95
commit fd1ea9e890
13 changed files with 204 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
nix/kubernetes/roles/kube_apiserver/default.nix
View File

@@ -65,15 +65,15 @@ in
"--audit-log-path=/var/log/audit.log"
"--authorization-mode=Node,RBAC"
"--bind-address=0.0.0.0"
"--client-ca-file=/.persist/keys/kube/ca.crt"
"--client-ca-file=/.persist/keys/kube/client-ca.crt"
"--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
"--etcd-cafile=/.persist/keys/kube/ca.crt"
"--etcd-cafile=/.persist/keys/kube/client-ca.crt"
"--etcd-certfile=/.persist/keys/kube/kube-api-server.crt"
"--etcd-keyfile=/.persist/keys/kube/kube-api-server.key"
"--etcd-servers=${builtins.concatStringsSep "," config.me.kube_apiserver.etcd_services}"
"--event-ttl=1h"
"--encryption-provider-config=/.persist/keys/kube/encryption-config.yaml"
"--kubelet-certificate-authority=/.persist/keys/kube/ca.crt"
"--kubelet-certificate-authority=/.persist/keys/kube/client-ca.crt"
"--kubelet-client-certificate=/.persist/keys/kube/kube-api-server.crt"
"--kubelet-client-key=/.persist/keys/kube/kube-api-server.key"
"--runtime-config='api/all=true'"
@@ -85,6 +85,14 @@ in
"--tls-private-key-file=/.persist/keys/kube/kube-api-server.key"
"--tls-min-version=VersionTLS13"
"--service-cluster-ip-range=fd00:3e42:e349::/112,10.197.0.0/16"
"--requestheader-client-ca-file=/.persist/keys/kube/requestheader-client-ca.crt"
"--requestheader-allowed-names=\"\"" # CN must be in this list to be valid. Blank = accept all CN.
"--requestheader-extra-headers-prefix=X-Remote-Extra"
"--requestheader-group-headers=X-Remote-Group"
"--requestheader-username-headers=X-Remote-User"
"--proxy-client-cert-file=/.persist/keys/kube/proxy.crt"
"--proxy-client-key-file=/.persist/keys/kube/proxy.key"
"--enable-aggregator-routing=true"
"--v=2"
# OLD: