*: rejigger tls certs and more
This pretty large change does the following:
- moves nix from bootstrap.hswaw.net to nix/
- changes clustercfg to use cfssl and moves it to cluster/clustercfg
- changes clustercfg to source information about target location of
certs from nix
- changes clustercfg to push nix config
- changes tls certs to have more than one CA
- recalculates all TLS certs
(it keeps the old serviceaccoutns key, otherwise we end up with
invalid serviceaccounts - the cert doesn't match, but who cares,
it's not used anyway)
diff --git a/cluster/certs/kube-kubelet-bc01n02.hswaw.net.cert b/cluster/certs/kube-kubelet-bc01n02.hswaw.net.cert
new file mode 100644
index 0000000..835386d
--- /dev/null
+++ b/cluster/certs/kube-kubelet-bc01n02.hswaw.net.cert
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFVjCCBD6gAwIBAgIUd3WmIRGYLAcILkm11fqlgkalJEowDQYJKoZIhvcNAQEL
+BQAwgYMxCzAJBgNVBAYTAlBMMRQwEgYDVQQIEwtNYXpvd2llY2tpZTEPMA0GA1UE
+BxMGV2Fyc2F3MRswGQYDVQQKExJXYXJzYXcgSGFja2Vyc3BhY2UxEzARBgNVBAsT
+CmNsdXN0ZXJjZmcxGzAZBgNVBAMTEmt1YmVybmV0ZXMgbWFpbiBDQTAeFw0xOTA0
+MDYyMDMyMDBaFw0yMDA0MDUyMDMyMDBaMIGFMQswCQYDVQQGEwJQTDEUMBIGA1UE
+CBMLTWF6b3dpZWNraWUxDzANBgNVBAcTBldhcnNhdzEVMBMGA1UEChMMc3lzdGVt
+Om5vZGVzMRAwDgYDVQQLEwdLdWJlbGV0MSYwJAYDVQQDEx1zeXN0ZW06bm9kZTpi
+YzAxbjAyLmhzd2F3Lm5ldDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+ALGiO5ptrZhlirWp39sHiO7qw0/MXuNsluwdXV0DlOsnnTUF3LcyANpZukJQNEq/
+IBZmvnYTyRIvLCJWXXr3jTjqCpIU+I3xRFu39190aohcqGbu2Qkj3weqYQiwCM7l
+0qh4YUTEVoiYMAShgXl5+MDvcJYw3jpfm0P9VUukVznzlhMsesV0TZlgHF04FHeM
+hTwtzgDBsNkCpJP+2Wba1IVegjIU9m7ayKjurjQaSxlDUL1MTTTrU7bNVwyvIpHh
+0jBCCtWrFVZF6eZFrpipGl7rmNC5weIVz9m/4D39DX049m0nsqUj2vjZFM7zT/sl
+Z+Ne+4L6pv4+Fwm3TzFXXxIxdZzCgTbqmgqd57Esr1s928tckrYOCC8paZ/oNW8i
+ndXFkolN1umc5CBb7TVNtXQ42mrZ7Hw66sF8gmF3l+xWNXWj04BmbTkfPULYd53+
+CD7/Pslvo0kOeaEA8UVjdIS8siAdhgCP5T3kUubaneQvRDuRHjzbmi//bUDkxFQ8
+CkkP6oDcjPfnJZ4KkZdfDflGdLRnY5ODzPYCd2xiy5+fFCS+pgtks3Q2SoYkkfV1
+ACl7JmpVhX+4hRi7/QkrwnLkNC+3zwouWCKy+DrVCOBjtJYFOStdCwh41zJB5lC6
+GJzRDqOv3q3hGo7+a6gVMU60DHsgTFbTKJ1TUh0V+D1nAgMBAAGjgb0wgbowDgYD
+VR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNV
+HRMBAf8EAjAAMB0GA1UdDgQWBBSnIgfLJiK7R+k9wfSCeKuqjpkYNjAfBgNVHSME
+GDAWgBSYMl0OTzMe+wnpiSQTFkJqgNGZ0DA7BgNVHREENDAygh1zeXN0ZW06bm9k
+ZTpiYzAxbjAyLmhzd2F3Lm5ldIIRYmMwMW4wMi5oc3dhdy5uZXQwDQYJKoZIhvcN
+AQELBQADggEBAEV3RzyxUHspOi5ZX3p2y66dJaRpF2ja8EUgXZHZ9ls+IsuKkxBe
+2pSfo9rWAJu10h05UztN8ruL1+OuVitUYWPvhr3XpdmxfklGgU6yfGjfb9HeBAC8
+qfoeLZ9T59qiYfGTmm/KO8C2BGynd/VeWpRNrCcREdCyxP8v97oSqS88qY6GHAn/
+ijnbnTSEVc65P/YS7CayAoXzBFgtmcvwE0E9JxuJ9RlD3TZQd4Vo77V++QKGPr34
+Z2inu7WSGou1tsuue/fyuuDHHm82ZdPYjYLM6/HHkx5v7t0e+EM1ghc8qVbrpBdi
+dzgdOByF7drN8eQurjOgSCh0BzNLMdXm8Rc=
+-----END CERTIFICATE-----