blob: bc2a6e2dd25233068a36099b1ea8d37730f1d435 [file] [log] [blame]
Serge Bazanskic6fd6622018-11-01 22:39:01 +01001# source me to have all the nice things
2
3if [ "$0" == "$BASH_SOURCE" ]; then
4 echo "You should be sourcing this."
5 exit 1
6fi
7
8hscloud_root="$( cd "$(dirname "$BASH_SOURCE")"; pwd -P )"
9
10hscloud-dc() {
11 ( cd "$hscloud_root" && docker-compose -f "docker/docker-compose.yml" "$@" )
12}
13
14hscloud-pki-dev() {
15 (
16 set -e
17
18 cd "$hscloud_root"
19 rm -rf docker/pki
20
21 cp -rv go/pki/dev-certs docker/pki
22 cd docker/pki
23 bash gen.sh m6220-proxy arista-proxy cmc-proxy topo client
24 ls *pem
25 )
26}
27
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010028# Generate a per-node certificate remotely on the node.
29hscloud-node-remote-cert() {
Serge Bazanskia5be0d82018-12-23 01:35:07 +010030 (
31 set -e
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010032 if [ -z "$1" ] || [ -z "$2" ] || [ -x "$3" ]; then
33 echo >&2 "Usage: hscloud-node-remote-cert node.fqdn.com certname subj"
Serge Bazanskia5be0d82018-12-23 01:35:07 +010034 exit 1
35 fi
36 fqdn="$1"
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010037 certname="$2"
38 subj="$3"
39
40 echo "Node: ${fqdn}; Cert: ${certname}"
Serge Bazanskia5be0d82018-12-23 01:35:07 +010041
42 echo "Checking node livenes..."
43 ssh root@$fqdn uname -a
44
45 echo "Checking if node already has key..."
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010046 ssh root@$fqdn stat /opt/hscloud/${certname}.key || (
Serge Bazanskia5be0d82018-12-23 01:35:07 +010047 echo "Generating key..."
48 ssh root@$fqdn -- mkdir -p /opt/hscloud
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010049 ssh root@$fqdn -- nix-shell -p openssl --command "\"openssl genrsa -out /opt/hscloud/${certname}.key 4096\""
50 ssh root@$fqdn -- chmod 400 /opt/hscloud/${certname}.key
Serge Bazanskia5be0d82018-12-23 01:35:07 +010051 )
52
53 echo "Checking if node already has cert..."
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010054 ssh root@$fqdn stat /opt/hscloud/${certname}.crt && exit 0
Serge Bazanskia5be0d82018-12-23 01:35:07 +010055 echo "No cert, will generate..."
56
57 cd "$hscloud_root"
58 secrets="$hscloud_root/secrets"
59 ca="$secrets/plain/ca.key"
60 [ ! -f "$ca" ] && ( scripts/secretstore decrypt "$secrets/cipher/ca.key" > $ca )
61
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010062 ssh root@$fqdn -- nix-shell -p openssl --command "\"openssl req -new -key /opt/hscloud/${certname}.key -out /opt/hscloud/${certname}.csr -subj '${subj}'\""
63 scp root@$fqdn:/opt/hscloud/${certname}.csr ${fqdn}-${certname}.csr
64 openssl x509 -req -in ${fqdn}-${certname}.csr -CA data/ca.crt -CAkey "$ca" -CAcreateserial -out "data/${fqdn}-${certname}.crt"
Serge Bazanskia5be0d82018-12-23 01:35:07 +010065
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010066 scp "data/${fqdn}-${certname}.crt" root@$fqdn:/opt/hscloud/${certname}.crt
Serge Bazanskia5be0d82018-12-23 01:35:07 +010067 scp "data/ca.crt" root@$fqdn:/opt/hscloud/ca.crt
Sergiusz Bazanski52c87182019-01-12 22:30:41 +010068 ssh root@$fqdn -- chmod 444 /opt/hscloud/${certname}.crt /opt/hscloud/ca.crt
69 rm ${fqdn}-${certname}.csr
70 )
71}
72
73# Generate locally (if not present) a shared certificate, and upload it to the node
74hscloud-node-shared-cert() {
75 (
76 set -e
77 if [ -z "$1" ] || [ -z "$2" ] || [ -x "$3" ]; then
78 echo >&2 "Usage: hscloud-node-shared-cert node.fqdn.com certname subj"
79 exit 1
80 fi
81 fqdn="$1"
82 certname="$2"
83 subj="$3"
84
85 cd "$hscloud_root"
86 secrets="$hscloud_root/secrets"
87 keyfile="$secrets/$certname.key"
88 cert="$hscloud_root/data/$certname.crt"
89 csr="$hscloud_root/data/$certname.csr"
90 ca="$secrets/plain/ca.key"
91 [ ! -f "$ca" ] && ( scripts/secretstore decrypt "$secrets/cipher/ca.key" > $ca )
92
93 echo "Checking if key exists..."
94 if [ ! -f "$keyfile" ]; then
95 echo "No key, trying to decrypt..."
96 if ! scripts/secretstore decrypt "$secrets/cipher/$certname.key" > "$keyfile" ; then
97 echo "No encrypted key, generating..."
98 openssl genrsa -out $keyfile 4096
99 echo "Encrypting..."
100 scripts/secretstore encrypt "$keyfile" > "$secrets/cipher/$certname.key"
101 fi
102 fi
103
104 echo "Checking if cert exists..."
105 if [ ! -f "$cert" ]; then
106 echo "No cert, generating..."
107 rm -f "${csr}"
108 openssl req -new -key "${keyfile}" -out "${csr}" -subj "${subj}"
109 openssl x509 -req -in "${csr}" -CA data/ca.crt -CAkey "$ca" -CAcreateserial -out "${cert}"
110 fi
111
112 echo "Copying certificate to node..."
113 scp "${cert}" root@$fqdn:/opt/hscloud/${certname}.crt
114 scp "${keyfile}" root@$fqdn:/opt/hscloud/${certname}.key
115 ssh root@$fqdn -- chmod 444 /opt/hscloud/${certname}.crt
116 ssh root@$fqdn -- chmod 400 /opt/hscloud/${certname}.key
117 )
118}
119
120hscloud-node-certs() {
121 (
122 set -e
123
124 if [ -z "$1" ]; then
125 echo >&2 "Usage: hscloud-node-certs node.fqdn.com"
126 exit 1
127 fi
128 fqdn="$1"
129
130 hscloud-node-remote-cert ${fqdn} node "/C=PL/ST=Mazowieckie/L=Mazowieckie/O=Stowarzyszenie Warszawski Hackerspace/OU=Node Bootstrap Certificate/CN=\"$fqdn\""
131 hscloud-node-remote-cert ${fqdn} kube-node "/C=PL/ST=Mazowieckie/L=Mazowieckie/O=system:nodes/OU=Kubernetes Node Certificate/CN=system:node:\"$fqdn\""
132 for component in controller-manager proxy scheduler; do
133 hscloud-node-shared-cert ${fqdn} kube-${component} "/C=PL/ST=Mazowieckie/L=Mazowieckie/O=system:kube-${component}/OU=Kubernetes Component ${component}/CN=system:kube-${component}"
134 done
Serge Bazanskia5be0d82018-12-23 01:35:07 +0100135 )
136}
137
Serge Bazanskic6fd6622018-11-01 22:39:01 +0100138echo "Now playing:"
139echo " hscloud-dc - run docker-compose"
140echo " hscloud-pki-dev - generate dev PKI certs"
Serge Bazanskia5be0d82018-12-23 01:35:07 +0100141echo " hscloud-node-push-certs - push a node cert to the node"
Serge Bazanski9ec50e32018-12-23 01:40:28 +0100142echo ""