mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
118 lines
3.1 KiB
Go
118 lines
3.1 KiB
Go
package kubernetesca
|
|
|
|
import (
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/edgelesssys/constellation/coordinator/util"
|
|
"github.com/edgelesssys/constellation/internal/file"
|
|
"k8s.io/klog/v2"
|
|
)
|
|
|
|
const (
|
|
caCertFilename = "/etc/kubernetes/pki/ca.crt"
|
|
caKeyFilename = "/etc/kubernetes/pki/ca.key"
|
|
)
|
|
|
|
// KubernetesCA handles signing of certificates using the Kubernetes root CA.
|
|
type KubernetesCA struct {
|
|
file file.Handler
|
|
}
|
|
|
|
// New creates a new KubernetesCA.
|
|
func New(fileHandler file.Handler) *KubernetesCA {
|
|
return &KubernetesCA{
|
|
file: fileHandler,
|
|
}
|
|
}
|
|
|
|
// GetCertificate creates a certificate for a node and signs it using the Kubernetes root CA.
|
|
func (c KubernetesCA) GetCertificate(nodeName string) (cert []byte, key []byte, err error) {
|
|
klog.V(6).Info("CA: loading Kubernetes CA certificate")
|
|
parentCertRaw, err := c.file.Read(caCertFilename)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
parentCertPEM, _ := pem.Decode(parentCertRaw)
|
|
parentCert, err := x509.ParseCertificate(parentCertPEM.Bytes)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
klog.V(6).Info("CA: loading Kubernetes CA private key")
|
|
parentKeyRaw, err := c.file.Read(caKeyFilename)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
parentKeyPEM, _ := pem.Decode(parentKeyRaw)
|
|
var parentKey any
|
|
switch parentKeyPEM.Type {
|
|
case "EC PRIVATE KEY":
|
|
parentKey, err = x509.ParseECPrivateKey(parentKeyPEM.Bytes)
|
|
case "RSA PRIVATE KEY":
|
|
parentKey, err = x509.ParsePKCS1PrivateKey(parentKeyPEM.Bytes)
|
|
case "PRIVATE KEY":
|
|
parentKey, err = x509.ParsePKCS8PrivateKey(parentKeyPEM.Bytes)
|
|
default:
|
|
return nil, nil, fmt.Errorf("unsupported key type %q", parentCertPEM.Type)
|
|
}
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
klog.V(6).Info("CA: creating kubelet private key")
|
|
privK, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
keyBytes, err := x509.MarshalECPrivateKey(privK)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
kubeletKey := pem.EncodeToMemory(&pem.Block{
|
|
Type: "EC PRIVATE KEY",
|
|
Bytes: keyBytes,
|
|
})
|
|
|
|
klog.V(6).Info("CA: creating kubelet certificate")
|
|
serialNumber, err := util.GenerateCertificateSerialNumber()
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
now := time.Now()
|
|
// Create the kubelet certificate
|
|
// For a reference on the certificate fields, see: https://kubernetes.io/docs/setup/best-practices/certificates/
|
|
certTmpl := &x509.Certificate{
|
|
SerialNumber: serialNumber,
|
|
NotBefore: now.Add(-2 * time.Hour),
|
|
NotAfter: now.Add(24 * 365 * time.Hour),
|
|
Subject: pkix.Name{
|
|
Organization: []string{"system:nodes"},
|
|
CommonName: fmt.Sprintf("system:node:%s", nodeName),
|
|
},
|
|
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
|
ExtKeyUsage: []x509.ExtKeyUsage{
|
|
x509.ExtKeyUsageClientAuth,
|
|
},
|
|
IsCA: false,
|
|
BasicConstraintsValid: true,
|
|
}
|
|
certRaw, err := x509.CreateCertificate(rand.Reader, certTmpl, parentCert, &privK.PublicKey, parentKey)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
kubeletCert := pem.EncodeToMemory(&pem.Block{
|
|
Type: "CERTIFICATE",
|
|
Bytes: certRaw,
|
|
})
|
|
|
|
return kubeletCert, kubeletKey, nil
|
|
}
|