cluster/certs: remove old kube CA
This completes the migration away from the old CA/cert infrastructure.
The tool which was used to generate all these certs will come next. It's
effectively a reimplementation of clustercfg in Go.
We also removed the unused kube-serviceaccounts cert, which was
generated by the old tooling for no good reason (we only need a key for
service accounts, not an actual cert...).
Change-Id: Ied9e5d8fc90c64a6b4b9fdd20c33981410c884b4
Reviewed-on: https://gerrit.hackerspace.pl/c/hscloud/+/1501
Reviewed-by: q3k <q3k@hackerspace.pl>
diff --git a/cluster/machines/modules/kube-common.nix b/cluster/machines/modules/kube-common.nix
index f4c6066..6707efa 100644
--- a/cluster/machines/modules/kube-common.nix
+++ b/cluster/machines/modules/kube-common.nix
@@ -86,9 +86,7 @@
# We do not use any nixpkgs predefined roles for k8s. Instead, we enable
# k8s components manually.
roles = [];
- # TODO(q3k): undo after CA migration done
- #caFile = cfg.pki.kube.apiserver.ca;
- caFile = ../../certs/ca-kube-new-and-old.crt;
+ caFile = cfg.pki.kube.apiserver.ca;
clusterCidr = "10.10.16.0/20";
addons.dns.enable = false;
};