From: stephan48 Date: Fri, 30 Aug 2024 00:29:32 +0000 (+0200) Subject: (no commit message) X-Git-Url: https://blog.stejau.de/gitweb/gitweb.cgi?a=commitdiff_plain;h=9b1eb0ddbb8195ff2152744f92a95e0649e271a7;p=stejau-blog.git --- diff --git a/posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn b/posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn new file mode 100644 index 0000000..0f49ec1 --- /dev/null +++ b/posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn @@ -0,0 +1,201 @@ +.... + +This is just a wip command by command play by play for now, i will add context and infos later(TM). + +random comments: + +- root$ denotes stuff done as root +- $ denotes stuff done as normal user +- you totally can use a different easy-rsa instance to generate your sub-ca, it does not need to be done in the root-ca "pki" - i will try to mark the points where you need to divert at a later time, essentially you need two easy-rsa instances(go figure, one with a ca build and one without - and then move the CSR/Finished cert between them) + +Relevant Domains: + +- kubecluster.example.org - subdomain your cluster should have +- step-certificates.step-ca.svc.cluster.local - service and namespace under which your intermediate is reachable in the cluster +- kubemaster.example.org - node fqdn +- kubenode01.example.org - node fqdn +- kubenode02.example.org - node fqdn +- (add/remove more node fqdns) + +Derived domains: +- ca.kubecluster.example.org - fqdn for your ca +- .kubecluster.example.org - subdomain for your cluster including "children" + + +You need a root ca managed by easy-rsa. +Our first step is to create a template for our intermediate. + + + +``` +$ cd $CA_PATH +$ cat > x509-types/ca.kubecluster.example.org <