|
| 1 | +#!/bin/bash |
| 2 | +# File originally from https://github.com/banzaicloud/admission-webhook-example/blob/blog/deployment/webhook-create-signed-cert.sh |
| 3 | + |
| 4 | +set -e |
| 5 | + |
| 6 | +usage() { |
| 7 | + cat <<EOF |
| 8 | +Generate certificate suitable for use with a webhook service. |
| 9 | +This script uses k8s' CertificateSigningRequest API to a generate a |
| 10 | +certificate signed by k8s CA suitable for use with webhook |
| 11 | +services. This requires permissions to create and approve CSR. See |
| 12 | +https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster for |
| 13 | +detailed explantion and additional instructions. |
| 14 | +The server key/cert k8s CA cert are stored in a k8s secret. |
| 15 | +usage: ${0} [OPTIONS] |
| 16 | +The following flags are required. |
| 17 | + --service Service name of webhook. |
| 18 | + --namespace Namespace where webhook service and secret reside. |
| 19 | + --secret Secret name for CA certificate and server certificate/key pair. |
| 20 | +EOF |
| 21 | + exit 1 |
| 22 | +} |
| 23 | + |
| 24 | +while [[ $# -gt 0 ]]; do |
| 25 | + case ${1} in |
| 26 | + --service) |
| 27 | + service="$2" |
| 28 | + shift |
| 29 | + ;; |
| 30 | + --secret) |
| 31 | + secret="$2" |
| 32 | + shift |
| 33 | + ;; |
| 34 | + --namespace) |
| 35 | + namespace="$2" |
| 36 | + shift |
| 37 | + ;; |
| 38 | + *) |
| 39 | + usage |
| 40 | + ;; |
| 41 | + esac |
| 42 | + shift |
| 43 | +done |
| 44 | + |
| 45 | +[ -z ${service} ] && service=admission-webhook-example-svc |
| 46 | +[ -z ${secret} ] && secret=admission-webhook-example-certs |
| 47 | +[ -z ${namespace} ] && namespace=default |
| 48 | + |
| 49 | +if [ ! -x "$(command -v openssl)" ]; then |
| 50 | + echo "openssl not found" |
| 51 | + exit 1 |
| 52 | +fi |
| 53 | + |
| 54 | +csrName=${service}.${namespace} |
| 55 | +tmpdir=$(mktemp -d) |
| 56 | +echo "creating certs in tmpdir ${tmpdir} " |
| 57 | + |
| 58 | +cat <<EOF >> ${tmpdir}/csr.conf |
| 59 | +[req] |
| 60 | +req_extensions = v3_req |
| 61 | +distinguished_name = req_distinguished_name |
| 62 | +[req_distinguished_name] |
| 63 | +[ v3_req ] |
| 64 | +basicConstraints = CA:FALSE |
| 65 | +keyUsage = nonRepudiation, digitalSignature, keyEncipherment |
| 66 | +extendedKeyUsage = serverAuth |
| 67 | +subjectAltName = @alt_names |
| 68 | +[alt_names] |
| 69 | +DNS.1 = ${service} |
| 70 | +DNS.2 = ${service}.${namespace} |
| 71 | +DNS.3 = ${service}.${namespace}.svc |
| 72 | +EOF |
| 73 | + |
| 74 | +openssl genrsa -out ${tmpdir}/server-key.pem 2048 |
| 75 | +openssl req -new -key ${tmpdir}/server-key.pem -subj "/CN=${service}.${namespace}.svc" -out ${tmpdir}/server.csr -config ${tmpdir}/csr.conf |
| 76 | + |
| 77 | +# clean-up any previously created CSR for our service. Ignore errors if not present. |
| 78 | +kubectl delete csr ${csrName} 2>/dev/null || true |
| 79 | + |
| 80 | +# create server cert/key CSR and send to k8s API |
| 81 | +cat <<EOF | kubectl create -f - |
| 82 | +apiVersion: certificates.k8s.io/v1beta1 |
| 83 | +kind: CertificateSigningRequest |
| 84 | +metadata: |
| 85 | + name: ${csrName} |
| 86 | +spec: |
| 87 | + groups: |
| 88 | + - system:authenticated |
| 89 | + request: $(cat ${tmpdir}/server.csr | base64 | tr -d '\n') |
| 90 | + usages: |
| 91 | + - digital signature |
| 92 | + - key encipherment |
| 93 | + - server auth |
| 94 | +EOF |
| 95 | + |
| 96 | +# verify CSR has been created |
| 97 | +while true; do |
| 98 | + kubectl get csr ${csrName} |
| 99 | + if [ "$?" -eq 0 ]; then |
| 100 | + break |
| 101 | + fi |
| 102 | +done |
| 103 | + |
| 104 | +# approve and fetch the signed certificate |
| 105 | +kubectl certificate approve ${csrName} |
| 106 | +# verify certificate has been signed |
| 107 | +for x in $(seq 10); do |
| 108 | + serverCert=$(kubectl get csr ${csrName} -o jsonpath='{.status.certificate}') |
| 109 | + if [[ ${serverCert} != '' ]]; then |
| 110 | + break |
| 111 | + fi |
| 112 | + sleep 1 |
| 113 | +done |
| 114 | +if [[ ${serverCert} == '' ]]; then |
| 115 | + echo "ERROR: After approving csr ${csrName}, the signed certificate did not appear on the resource. Giving up after 10 attempts." >&2 |
| 116 | + exit 1 |
| 117 | +fi |
| 118 | +echo ${serverCert} | openssl base64 -d -A -out ${tmpdir}/server-cert.pem |
| 119 | + |
| 120 | + |
| 121 | +# create the secret with CA cert and server cert/key |
| 122 | +kubectl create secret generic ${secret} \ |
| 123 | + --from-file=key.pem=${tmpdir}/server-key.pem \ |
| 124 | + --from-file=cert.pem=${tmpdir}/server-cert.pem \ |
| 125 | + --dry-run -o yaml | |
| 126 | + kubectl -n ${namespace} apply -f - |
0 commit comments