From 9b1eb0ddbb8195ff2152744f92a95e0649e271a7 Mon Sep 17 00:00:00 2001 From: stephan48 Date: Fri, 30 Aug 2024 02:29:32 +0200 Subject: [PATCH] --- ...ep-ca-intermediate-with-existing-root.mdwn | 201 ++++++++++++++++++ 1 file changed, 201 insertions(+) create mode 100644 posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn diff --git a/posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn b/posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn new file mode 100644 index 0000000..0f49ec1 --- /dev/null +++ b/posts/2024-08-29-k8s-cluster-step-ca-intermediate-with-existing-root.mdwn @@ -0,0 +1,201 @@ +.... + +This is just a wip command by command play by play for now, i will add context and infos later(TM). + +random comments: + +- root$ denotes stuff done as root +- $ denotes stuff done as normal user +- you totally can use a different easy-rsa instance to generate your sub-ca, it does not need to be done in the root-ca "pki" - i will try to mark the points where you need to divert at a later time, essentially you need two easy-rsa instances(go figure, one with a ca build and one without - and then move the CSR/Finished cert between them) + +Relevant Domains: + +- kubecluster.example.org - subdomain your cluster should have +- step-certificates.step-ca.svc.cluster.local - service and namespace under which your intermediate is reachable in the cluster +- kubemaster.example.org - node fqdn +- kubenode01.example.org - node fqdn +- kubenode02.example.org - node fqdn +- (add/remove more node fqdns) + +Derived domains: +- ca.kubecluster.example.org - fqdn for your ca +- .kubecluster.example.org - subdomain for your cluster including "children" + + +You need a root ca managed by easy-rsa. +Our first step is to create a template for our intermediate. + + + +``` +$ cd $CA_PATH +$ cat > x509-types/ca.kubecluster.example.org <