cluster/certs: remove old kube CA
This completes the migration away from the old CA/cert infrastructure.
The tool which was used to generate all these certs will come next. It's
effectively a reimplementation of clustercfg in Go.
We also removed the unused kube-serviceaccounts cert, which was
generated by the old tooling for no good reason (we only need a key for
service accounts, not an actual cert...).
Change-Id: Ied9e5d8fc90c64a6b4b9fdd20c33981410c884b4
Reviewed-on: https://gerrit.hackerspace.pl/c/hscloud/+/1501
Reviewed-by: q3k <q3k@hackerspace.pl>
diff --git a/cluster/machines/modules/kube-dataplane.nix b/cluster/machines/modules/kube-dataplane.nix
index fd87dbc..45efcd2 100644
--- a/cluster/machines/modules/kube-dataplane.nix
+++ b/cluster/machines/modules/kube-dataplane.nix
@@ -72,9 +72,7 @@
hostname = fqdn;
tlsCertFile = pki.kube.kubelet.cert;
tlsKeyFile = pki.kube.kubelet.key;
- # TODO(q3k): undo after CA migration done
- #clientCaFile = pki.kube.kubelet.ca;
- clientCaFile = ../../certs/ca-kube-new-and-old.crt;
+ clientCaFile = pki.kube.kubelet.ca;
nodeIp = config.hscloud.base.ipAddr;
networkPlugin = "cni";
clusterDns = "10.10.12.254";