Remove pki scripts and info (now in hspki)
diff --git a/README.md b/README.md
index fb3883d..3f9ccaf 100644
--- a/README.md
+++ b/README.md
@@ -5,46 +5,10 @@
The schema is supposed to be 1:1 mapped to the JSON-RPC EAPI. This is just a dumb proxy.
-PKI Introduction
-----------------
+PKI
+---
-This project is a testing ground for the HSCloud PKI setup. Long story short,
-all gRPC is mutually authenticated via TLS (server & client certs).
-
-All certs for mutual auth have the following CN/SAN format:
-
- <job>.<principal>.<realm>
-
-For example, if principal maps into a 'group' and job into a 'user':
-
- arista-proxy-dcr01u23.prod.c.example.com
-
- job = arista-proxy-dcr01u23
- principal = cluster-management-prod
- realm = c.example.com
-
-The Realm is a DNS name that is global to all jobs that need mutual authentication.
-
-The Principal is any name that carries significance for logical grouping of jobs.
-It can, but doesn't need to, group jobs by similar permissions.
-
-The Job is any name that identifies uniquely (within the principal) a security
-endpoint that describes a single security policy for a gRPC endpoint.
-
-The entire CN should be DNS resolvable into an IP address that would respond to
-gRPC requests on port 42000 (with a server TLS certificate that represents this CN) if the
-job represents a service.
-
-This maps nicely to the Kubernetes Cluster DNS format if you set `realm` to `svc.cluster.local`.
-Then, `principal` maps to a Kubernetes namespace, and `job` maps into a Kubernetes service.
-
- arista-proxy-dcr01u23.arista-prod.svc.cluster.local
-
- job/service = arista-proxy-dcr01u23
- principal/namespace = arista-prod
- realm = svc.cluster.local
-
-ACLs based on job/principal are yet to be implemented :).
+This service uses [HSPKI](https://code.hackerspace.pl/q3k/hspki), you will need to generate development TLS certificates for local use.
Getting and Building
--------------------
@@ -53,34 +17,6 @@
go generate code.hackerspace.pl/q3k/arista-proxy/proto
go build code.hackerspace.pl/q3k/arista-proxy
-PKI Certs for Development
--------------------------
-
-In production, those certs will be automatigacally provided for you by
-automation. In development, you'll have to do the following:
-
- cd pki
- ./gen.sh
-
-This will generate:
- - `pki/ca.pem` - CA certificate
- - `pki/client{,-key}.pem` - certificate and key for `developer.humans.svc.cluster.local`
- - `pki/service{,-key}.pem` - certificate and key for `test.arista-proxy.svc.cluster.local`
-
-You will have to setup an /etc/hosts alias to make `test.arista-proxy.svc.cluster.local` resolve to your machine.
-
- # cat /etc/hosts
- ...
- 127.0.0.1 test.arista-proxy.svc.cluster.local
- ...
-
-You can then start `arista-proxy` with default flags and talk to it via gRPC:
-
- ./arista-proxy
-
- alias grpc-dev="grpc -cacert $(pwd)/pki/ca.pem -key $(pwd)/pki/client-key.pem -cert $(pwd)/pki/client.pem"
- grpc-dev test.arista-proxy.svc.cluster.local:42000 proto.AristaProxy.ShowVersion
-
Debug Status Page
-----------------
@@ -105,16 +41,8 @@
If non-empty, write log files in this directory
-logtostderr
log to standard error instead of files
- -pki_realm string
- PKI realm (default "svc.cluster.local")
-stderrthreshold value
logs at or above this threshold go to stderr
- -tls_ca_path string
- Path to PKI CA certificate (default "pki/ca.pem")
- -tls_certificate_path string
- Path to PKI service certificate (default "pki/service.pem")
- -tls_key_path string
- Path to PKI service private key (default "pki/service-key.pem")
-v value
log level for V logs
-vmodule value
diff --git a/pki/.gitignore b/pki/.gitignore
deleted file mode 100644
index e24607d..0000000
--- a/pki/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*csr
-*pem
diff --git a/pki/ca_config.json b/pki/ca_config.json
deleted file mode 100644
index 113a08f..0000000
--- a/pki/ca_config.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
- "signing": {
- "default": {
- "expiry": "8760h"
- },
- "profiles": {
- "test": {
- "usages": ["signing", "key encipherment", "server auth", "client auth"],
- "expiry": "8760h"
- }
- }
- }
-}
diff --git a/pki/ca_csr.json b/pki/ca_csr.json
deleted file mode 100644
index b24c638..0000000
--- a/pki/ca_csr.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
- "names": [
- {
- "C": "US",
- "L": "San Francisco",
- "O": "Internet Widgets, Inc.",
- "OU": "WWW",
- "ST": "California"
- }
- ]
-}
diff --git a/pki/clean.sh b/pki/clean.sh
deleted file mode 100755
index 490223d..0000000
--- a/pki/clean.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh
-
-set -e -x
-
-rm *pem
-rm *csr
diff --git a/pki/client_csr.json b/pki/client_csr.json
deleted file mode 100644
index 26fc041..0000000
--- a/pki/client_csr.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
- "CN": "developer.humans.svc.cluster.local",
- "names": [
- {
- "C": "US",
- "L": "San Francisco",
- "O": "Internet Widgets, Inc.",
- "OU": "WWW",
- "ST": "California"
- }
- ]
-}
diff --git a/pki/gen.sh b/pki/gen.sh
deleted file mode 100755
index e09e9f3..0000000
--- a/pki/gen.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-set -e -x
-
-test -f ca.pem || ( cfssl gencert -initca ca_csr.json | cfssljson -bare ca )
-test -f service.pem || ( cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca_config.json -profile=test service_csr.json | cfssljson -bare service )
-test -f client.pem || ( cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca_config.json -profile=test client_csr.json | cfssljson -bare client )
diff --git a/pki/service_csr.json b/pki/service_csr.json
deleted file mode 100644
index 72c910e..0000000
--- a/pki/service_csr.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
- "CN": "test.arista-proxy.svc.cluster.local",
- "names": [
- {
- "C": "US",
- "L": "San Francisco",
- "O": "Internet Widgets, Inc.",
- "OU": "WWW",
- "ST": "California"
- }
- ]
-}