*: rejigger tls certs and more
This pretty large change does the following:
- moves nix from bootstrap.hswaw.net to nix/
- changes clustercfg to use cfssl and moves it to cluster/clustercfg
- changes clustercfg to source information about target location of
certs from nix
- changes clustercfg to push nix config
- changes tls certs to have more than one CA
- recalculates all TLS certs
(it keeps the old serviceaccoutns key, otherwise we end up with
invalid serviceaccounts - the cert doesn't match, but who cares,
it's not used anyway)
diff --git a/cluster/certs/kube-kubelet-bc01n01.hswaw.net.cert b/cluster/certs/kube-kubelet-bc01n01.hswaw.net.cert
new file mode 100644
index 0000000..94b95df
--- /dev/null
+++ b/cluster/certs/kube-kubelet-bc01n01.hswaw.net.cert
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFVjCCBD6gAwIBAgIUPmXvbmeRs74W9l5NLg6qG8QKJ90wDQYJKoZIhvcNAQEL
+BQAwgYMxCzAJBgNVBAYTAlBMMRQwEgYDVQQIEwtNYXpvd2llY2tpZTEPMA0GA1UE
+BxMGV2Fyc2F3MRswGQYDVQQKExJXYXJzYXcgSGFja2Vyc3BhY2UxEzARBgNVBAsT
+CmNsdXN0ZXJjZmcxGzAZBgNVBAMTEmt1YmVybmV0ZXMgbWFpbiBDQTAeFw0xOTA0
+MDYyMDMwMDBaFw0yMDA0MDUyMDMwMDBaMIGFMQswCQYDVQQGEwJQTDEUMBIGA1UE
+CBMLTWF6b3dpZWNraWUxDzANBgNVBAcTBldhcnNhdzEVMBMGA1UEChMMc3lzdGVt
+Om5vZGVzMRAwDgYDVQQLEwdLdWJlbGV0MSYwJAYDVQQDEx1zeXN0ZW06bm9kZTpi
+YzAxbjAxLmhzd2F3Lm5ldDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+AMCCerGanIpykEvuJnxkz1ZqoHDvrAfM7Yyb7Ca7+njBPmrg7WVkHFQdn1ylSvRZ
+69vrtosUheOfkzAPT5sqRhQ/8VIAoHA1bXhAW19NmkK5I1FyWGjjGn1sjfmEvk4o
+cLf6gcvErRJdPbGz/vzBZ0X0FeCfqGPcUnLZYbh8wCdS9PkqeEq6m2CH6Toxb8jx
+Kz1fZbJf3gVnGxR3xUA9Fj8FmhpyOvnTXVa4mLh67x197lII1t86yTuc+8uwVQUR
+iC8PK15hgUm2q+MNWlNlXAxq0V5ZnZfiI9Qwdh43TqCKPI2kmgEu8ehT0qICbr6J
+SaB8OASLqhb3xI5CQLeZtX2tTdyQDD9DpGKquQHjdZ7uEA437KsG9MHLhrRW48RY
+O4bMgwhQ9V0+5Hc1NWOrccn4qmULwgFXaDWMjId5jRcWxBKtRW+jy0Vgqo4iFwZk
+b50unO0/VMmNw5bQQpfMnH1ubbctialjZqUevrV8zqcVaUMrHqdQbVjiitVzZghg
+FQL2wALYLNYt+dXYAQan2OqEaL+WuCUeP1LGlhXHqxfNjhXJjj1U/EAvEnNzFQ0M
+QQwe1QTYA4k0i1GlbbvtK4/PFECY/YzVgm70/lnH5AkkC+dQduQ69KTZx2YDD0iD
+QaaisNvK2CqFoim0cjiBWWTlpUxv3XF0TCnlso18z5EVAgMBAAGjgb0wgbowDgYD
+VR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNV
+HRMBAf8EAjAAMB0GA1UdDgQWBBRQZwM3WgGW+l8MKQBF2DZ5IWBh6jAfBgNVHSME
+GDAWgBSYMl0OTzMe+wnpiSQTFkJqgNGZ0DA7BgNVHREENDAygh1zeXN0ZW06bm9k
+ZTpiYzAxbjAxLmhzd2F3Lm5ldIIRYmMwMW4wMS5oc3dhdy5uZXQwDQYJKoZIhvcN
+AQELBQADggEBALQ9uq5DCJYilyUQ1HYT1pP0PD8szSscTsQCVA5ExEuevlTn4ka/
+qtru+4Ht9eap12cmHqEQFpVZpBQyLmgRSVZPALNVYmaCrATyskz3uKDWUtRM1yAF
++CfSR9Ibi6l9U4FOoA8U2xDrOAzJN2WYpmv/W363TJt0HuvpbrXEUsN6GFc0c/Sq
+7h/UWzyskoBup8eJrR6WX79pQSfoNCXJrEmGGZ2+hoU1/tF6siWMhwAu1UTpKQCw
+/rcnKwc04WRGl2zk84cffFnmpjJXf2BFdItVDBD5N/e4oRoaNocZjkHnZ/Xg1LoJ
+jC7BMy4ScK4S5Nxem8PVYnpLS7o5KLqqTnI=
+-----END CERTIFICATE-----