gce-centos-k8s/scripts/2_cert_and_auth_create.sh

#!/bin/bash
##
## Script to automate the Kubernetes CentOS client side pieces
##
echo "#####################################"
echo "Grabbing the CloudFlare SSL tools ..."
echo "#####################################"
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 \
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64

mkdir ~/bin
mv cfssl_linux-amd64 ~/bin/cfssl
mv cfssljson_linux-amd64 ~/bin/cfssljson
chmod 755 ~/bin/cfssl*

echo "CloudFlare tools have been installed into ~/bin"
echo ""

echo "######################################"
echo "Set the gcloud compute region and zone"
echo "######################################"
. .gce_kubernetes.config
gcloud config set compute/region $GCE_REGION
gcloud config set compute/zone $GCE_ZONE
gcloud config set project $GCE_PROJECT
echo "Compute region and zone set"
echo ""

mkdir certs-dir
cd certs-dir
echo "#############################"
echo "Creating the CA configuration"
echo "#############################"
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "8760h"
    },
    "profiles": {
      "kubernetes": {
        "usages": ["signing", "key encipherment", "server auth", "client auth"],
        "expiry": "8760h"
      }
    }
  }
}
EOF

echo "CA config file created"
echo ""

echo "###############################"
echo "Creating the CA signing request"
echo "###############################"
cat > ca-csr.json <<EOF
{
  "CN": "Kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "Kubernetes",
      "OU": "CA",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

ls -al ca*
echo "CA and CA config files created"
echo""

echo "#####################################"
echo "Creating the admin client certificate"
echo "#####################################"
cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "system:masters",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

ls -al admin*
echo "Admin client certificate and key created

###############################################
Creating the worker kubelet client certificates
###############################################"
for i in worker-0 worker-1; do
cat > ${i}-csr.json <<EOF
{
  "CN": "system:node:${i}",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "system:nodes",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

EXTERNAL_IP=$(gcloud compute instances describe ${i} --format 'value(networkInterfaces[0].accessConfigs[0].natIP)')
INTERNAL_IP=$(gcloud compute instances describe ${i} --format 'value(networkInterfaces[0].networkIP)')

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -hostname=${i},${EXTERNAL_IP},${INTERNAL_IP} -profile=kubernetes ${i}-csr.json | cfssljson -bare ${i}

done

ls -al worker-*
echo "If this has worked, worker keys and certificates should be created"
echo ""

echo "##################################################"
echo "Creating the Controller Manager client certificate"
echo "##################################################"
cat > kube-controller-manager-csr.json <<EOF
{
  "CN": "system:kube-controller-manager",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "system:kube-controller-manager",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

ls -al kube-controller-manager*
echo "Created the controller manager client certificate and key"
echo ""

echo "##########################################"
echo "Creating the Kube Proxy client certificate"
echo "##########################################"
cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "system:node-proxier",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

ls -al kube-proxy*
echo "Created the Kube Proxy client certificate"
echo ""

echo "####################################################"
echo "Creating the Kubernetes Scheduler Client Certificate"
echo "####################################################"
cat > kube-scheduler-csr.json <<EOF
{
  "CN": "system:kube-scheduler",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "system:kube-scheduler",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

ls -al kube-scheduler*
echo "Created the Kubernetes Scheduler Client Certificate"
echo ""

echo "################################################"
echo "#Creating the Kubernetes API Server Certificate#"
echo "################################################"
KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe $KUBE_NETWORK --region $GCE_REGION --format 'value(address)')

cat > kubernetes-csr.json <<EOF
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "Kubernetes",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -hostname=10.32.0.1,10.240.0.10,10.240.0.11,${KUBERNETES_PUBLIC_ADDRESS},127.0.0.1,kubernetes.default -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes

ls -al kubernetes*
echo "Created the Kubernetes API Server certificate"
echo ""

echo "########################################"
echo "Creating the service account certificate"
echo "########################################"
cat > service-account-csr.json <<EOF
{
  "CN": "service-accounts",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "US",
      "L": "Portland",
      "O": "Kubernetes",
      "OU": "Kubernetes - CentOS",
      "ST": "Oregon"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes service-account-csr.json | cfssljson -bare service-account

ls -al service-account*
echo "Created the service account certificate"
echo ""

echo "#####################################################"
echo "Creating the client authentication files (kubeconfig)"
echo "#####################################################"
KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe $KUBE_NETWORK --region $GCE_REGION --format 'value(address)')
for instance in worker-0 worker-1; do
  kubectl config set-cluster $KUBE_CLUSTER --certificate-authority=ca.pem --embed-certs=true --server=https://${KUBERNETES_PUBLIC_ADDRESS}:6443 --kubeconfig=${instance}.kubeconfig
  kubectl config set-credentials system:node:${instance} --client-certificate=${instance}.pem --client-key=${instance}-key.pem --embed-certs=true --kubeconfig=${instance}.kubeconfig
  kubectl config set-context default --cluster=$KUBE_CLUSTER --user=system:node:${instance} --kubeconfig=${instance}.kubeconfig
  kubectl config use-context default --kubeconfig=${instance}.kubeconfig
done

ls -al worker*.kubeconfig
echo "Worker kubeconfig files created"
echo ""

kubectl config set-cluster $KUBE_CLUSTER --certificate-authority=ca.pem --embed-certs=true --server=https://${KUBERNETES_PUBLIC_ADDRESS}:6443 --kubeconfig=kube-proxy.kubeconfig
kubectl config set-credentials system:kube-proxy --client-certificate=kube-proxy.pem --client-key=kube-proxy-key.pem --embed-certs=true --kubeconfig=kube-proxy.kubeconfig
kubectl config set-context default --cluster=$KUBE_CLUSTER --user=system:kube-proxy --kubeconfig=kube-proxy.kubeconfig
kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

ls -al kube-proxy.kubeconfig
echo "Kube Proxy kubeconfig file created"
echo ""

kubectl config set-cluster $KUBE_CLUSTER --certificate-authority=ca.pem --embed-certs=true --server=https://127.0.0.1:6443 --kubeconfig=kube-controller-manager.kubeconfig
kubectl config set-credentials system:kube-controller-manager --client-certificate=kube-controller-manager.pem --client-key=kube-controller-manager-key.pem --embed-certs=true --kubeconfig=kube-controller-manager.kubeconfig
kubectl config set-context default --cluster=$KUBE_CLUSTER --user=system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig
kubectl config use-context default --kubeconfig=kube-controller-manager.kubeconfig

ls -al kube-controller-manager.kubeconfig
echo "Kubernetes Controller Manager kubeconfig file created"
echo ""

kubectl config set-cluster $KUBE_CLUSTER --certificate-authority=ca.pem --embed-certs=true --server=https://127.0.0.1:6443 --kubeconfig=kube-scheduler.kubeconfig
kubectl config set-credentials system:kube-scheduler --client-certificate=kube-scheduler.pem --client-key=kube-scheduler-key.pem --embed-certs=true --kubeconfig=kube-scheduler.kubeconfig
kubectl config set-context default --cluster=$KUBE_CLUSTER --user=system:kube-scheduler --kubeconfig=kube-scheduler.kubeconfig
kubectl config use-context default --kubeconfig=kube-scheduler.kubeconfig

ls -al kube-scheduler*
echo "Kubernetes Scheduler kubeconfig file created"
echo ""

kubectl config set-cluster $KUBE_CLUSTER --certificate-authority=ca.pem --embed-certs=true --server=https://127.0.0.1:6443 --kubeconfig=admin.kubeconfig
kubectl config set-credentials admin --client-certificate=admin.pem --client-key=admin-key.pem --embed-certs=true --kubeconfig=admin.kubeconfig
kubectl config set-context default --cluster=$KUBE_CLUSTER --user=admin --kubeconfig=admin.kubeconfig
kubectl config use-context default --kubeconfig=admin.kubeconfig

ls -al admin.kubeconfig
echo "Admin client certificate created"
echo ""

echo "Hopefully all client certificates are now created"
echo ""

echo "############################################################"
echo "Copying the certificates and kubeconfig files to the servers"
echo "############################################################"

KUBE_WORKERS=$((KUBE_WORKERS-1))
for ((i=0; i<=$KUBE_WORKERS; i++)); do
  gcloud compute scp ca.pem worker-${i}-key.pem worker-${i}.pem worker-${i}.kubeconfig kube-proxy.kubeconfig worker-${i}:~/
done

KUBE_CONTROLLERS=$((KUBE_CONTROLLERS-1))
for ((i=0; i<=$KUBE_CONTROLLERS; i++)); do
  gcloud compute scp ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem service-account-key.pem service-account.pem admin.kubeconfig kube-controller-manager.kubeconfig kube-scheduler.kubeconfig controller-${i}:~/
done

echo "Kubeconfig and client certificates should now be copied"
echo ""

echo "############################################"
echo "Creating and copying the data encryption key"
echo "############################################"
ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64)

cat > encryption-config.yaml <<EOF
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: ${ENCRYPTION_KEY}
      - identity: {}
EOF

for ((i=0; i<=$KUBE_CONTROLLERS; i++)); do
  gcloud compute scp encryption-config.yaml controller-${i}:~/
done

echo "Encryption key created and copied"
echo ""
echo "Next step is to install and configure Kubernetes on the controllers and workers"