summaryrefslogtreecommitdiff
path: root/magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh
diff options
context:
space:
mode:
authorSpyros Trigazis <strigazi@gmail.com>2016-09-09 11:27:32 +0200
committerSpyros Trigazis <strigazi@gmail.com>2016-09-09 18:10:08 +0200
commit2c635692aef8031a7212fbca18570d6700ad40cf (patch)
tree32504e97c09431cf4e0538ba6d9423db1432c040 /magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh
parent8b354e3e108d417ed91447f797ee48221e526dc6 (diff)
Split k8s atomic vm and ironic drivers
The 2 k8s atomic drivers we currently support are added to the same driver. This breaks ironic support with the stevedore work I'm currently doing. With stevedore, we can choose only one driver based on the server_type, os and coe. We won't be able to pick a driver and then choose an implementation bases on server_type. Partially-Implements: blueprint magnum-baremetal-full-support Co-Authored-By: Spyros Trigazis <strigazi@gmail.com> Change-Id: Ic1b8103551f48f85baa2ed9ff32d5b70b1fab84e
Notes
Notes (review): Code-Review+1: Murali Allada <murali.allada@rackspace.com> Code-Review+2: Hongbin Lu <hongbin.lu@huawei.com> Workflow+1: Madhuri Kumari <madhuri.kumari@intel.com> Verified+2: Jenkins Submitted-by: Jenkins Submitted-at: Mon, 12 Sep 2016 09:45:41 +0000 Reviewed-on: https://review.openstack.org/360625 Project: openstack/magnum Branch: refs/heads/master
Diffstat (limited to 'magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh')
-rw-r--r--magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh128
1 files changed, 128 insertions, 0 deletions
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh b/magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh
new file mode 100644
index 0000000..1612184
--- /dev/null
+++ b/magnum/drivers/common/templates/kubernetes/fragments/make-cert.sh
@@ -0,0 +1,128 @@
1#!/bin/sh
2
3# Copyright 2014 The Kubernetes Authors All rights reserved.
4#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9# http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
16
17. /etc/sysconfig/heat-params
18
19set -o errexit
20set -o nounset
21set -o pipefail
22
23if [ "$TLS_DISABLED" == "True" ]; then
24 exit 0
25fi
26
27if [[ -z "${KUBE_NODE_PUBLIC_IP}" ]]; then
28 KUBE_NODE_PUBLIC_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
29fi
30if [[ -z "${KUBE_NODE_IP}" ]]; then
31 KUBE_NODE_IP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
32fi
33
34sans="IP:${KUBE_NODE_PUBLIC_IP},IP:${KUBE_NODE_IP}"
35if [ "${KUBE_NODE_PUBLIC_IP}" != "${KUBE_API_PUBLIC_ADDRESS}" ] \
36 && [ -n "${KUBE_API_PUBLIC_ADDRESS}" ]; then
37 sans="${sans},IP:${KUBE_API_PUBLIC_ADDRESS}"
38fi
39if [ "${KUBE_NODE_IP}" != "${KUBE_API_PRIVATE_ADDRESS}" ] \
40 && [ -n "${KUBE_API_PRIVATE_ADDRESS}" ]; then
41 sans="${sans},IP:${KUBE_API_PRIVATE_ADDRESS}"
42fi
43MASTER_HOSTNAME=${MASTER_HOSTNAME:-}
44if [[ -n "${MASTER_HOSTNAME}" ]]; then
45 sans="${sans},DNS:${MASTER_HOSTNAME}"
46fi
47sans="${sans},IP:127.0.0.1"
48
49cert_dir=/srv/kubernetes
50cert_conf_dir=${cert_dir}/conf
51
52mkdir -p "$cert_dir"
53mkdir -p "$cert_conf_dir"
54
55CA_CERT=$cert_dir/ca.crt
56SERVER_CERT=$cert_dir/server.crt
57SERVER_CSR=$cert_dir/server.csr
58SERVER_KEY=$cert_dir/server.key
59
60#Get a token by user credentials and trust
61auth_json=$(cat << EOF
62{
63 "auth": {
64 "identity": {
65 "methods": [
66 "password"
67 ],
68 "password": {
69 "user": {
70 "id": "$TRUSTEE_USER_ID",
71 "password": "$TRUSTEE_PASSWORD"
72 }
73 }
74 },
75 "scope": {
76 "OS-TRUST:trust": {
77 "id": "$TRUST_ID"
78 }
79 }
80 }
81}
82EOF
83)
84
85#trust is introduced in Keystone v3 version
86AUTH_URL=${AUTH_URL/v2.0/v3}
87content_type='Content-Type: application/json'
88url="$AUTH_URL/auth/tokens"
89USER_TOKEN=`curl -s -i -X POST -H "$content_type" -d "$auth_json" $url \
90 | grep X-Subject-Token | awk '{print $2}' | tr -d '[[:space:]]'`
91
92# Get CA certificate for this cluster
93curl -X GET \
94 -H "X-Auth-Token: $USER_TOKEN" \
95 $MAGNUM_URL/certificates/$CLUSTER_UUID | python -c 'import sys, json; print json.load(sys.stdin)["pem"]' > ${CA_CERT}
96
97# Create config for server's csr
98cat > ${cert_conf_dir}/server.conf <<EOF
99[req]
100distinguished_name = req_distinguished_name
101req_extensions = req_ext
102prompt = no
103[req_distinguished_name]
104CN = kubernetes.invalid
105[req_ext]
106subjectAltName = ${sans}
107extendedKeyUsage = clientAuth,serverAuth
108EOF
109
110# Generate server's private key and csr
111openssl genrsa -out "${SERVER_KEY}" 4096
112chmod 400 "${SERVER_KEY}"
113openssl req -new -days 1000 \
114 -key "${SERVER_KEY}" \
115 -out "${SERVER_CSR}" \
116 -reqexts req_ext \
117 -config "${cert_conf_dir}/server.conf"
118
119# Send csr to Magnum to have it signed
120csr_req=$(python -c "import json; fp = open('${SERVER_CSR}'); print json.dumps({'cluster_uuid': '$CLUSTER_UUID', 'csr': fp.read()}); fp.close()")
121curl -X POST \
122 -H "X-Auth-Token: $USER_TOKEN" \
123 -H "Content-Type: application/json" \
124 -d "$csr_req" \
125 $MAGNUM_URL/certificates | python -c 'import sys, json; print json.load(sys.stdin)["pem"]' > ${SERVER_CERT}
126
127chmod 500 "${cert_dir}"
128chown -R kube:kube "${cert_dir}"