Skip to content

Commit 494fbd7

Browse files
upodroidupodroid
committed
use easyrsa from Github and remove deprecated options
1 parent 5c14a57 commit 494fbd7

File tree

1 file changed

+37
-38
lines changed

1 file changed

+37
-38
lines changed

‎cluster/gce/util.sh

+37-38
Original file line numberDiff line numberDiff line change
@@ -1781,23 +1781,22 @@ function setup-easyrsa {
17811781
# Note: This was heavily cribbed from make-ca-cert.sh
17821782
(set -x
17831783
cd "${KUBE_TEMP}"
1784-
curl -L -O --connect-timeout 20 --retry 6 --retry-delay 2 https://dl.k8s.io/easy-rsa/easy-rsa.tar.gz
1785-
tar xzf easy-rsa.tar.gz
1786-
mkdir easy-rsa-master/kubelet
1787-
cp -r easy-rsa-master/easyrsa3/* easy-rsa-master/kubelet
1788-
mkdir easy-rsa-master/aggregator
1789-
cp -r easy-rsa-master/easyrsa3/* easy-rsa-master/aggregator
1790-
mkdir easy-rsa-master/cloud-pvl-admission
1791-
cp -r easy-rsa-master/easyrsa3/* easy-rsa-master/cloud-pvl-admission
1792-
mkdir easy-rsa-master/konnectivity-server
1793-
cp -r easy-rsa-master/easyrsa3/* easy-rsa-master/konnectivity-server
1794-
mkdir easy-rsa-master/konnectivity-agent
1795-
cp -r easy-rsa-master/easyrsa3/* easy-rsa-master/konnectivity-agent) &>"${cert_create_debug_output}" || true
1796-
CERT_DIR="${KUBE_TEMP}/easy-rsa-master/easyrsa3"
1797-
AGGREGATOR_CERT_DIR="${KUBE_TEMP}/easy-rsa-master/aggregator"
1798-
CLOUD_PVL_ADMISSION_CERT_DIR="${KUBE_TEMP}/easy-rsa-master/cloud-pvl-admission"
1799-
KONNECTIVITY_SERVER_CERT_DIR="${KUBE_TEMP}/easy-rsa-master/konnectivity-server"
1800-
KONNECTIVITY_AGENT_CERT_DIR="${KUBE_TEMP}/easy-rsa-master/konnectivity-agent"
1784+
curl -L -o easy-rsa.tar.gz --connect-timeout 20 --retry 6 --retry-delay 2 https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.7/EasyRSA-3.1.7.tgz
1785+
mkdir -p easy-rsa && tar xzf easy-rsa.tar.gz -C easy-rsa --strip-components 1
1786+
local -r files_to_copy=(easyrsa openssl-easyrsa.cnf x509-types vars.example)
1787+
mkdir easy-rsa/aggregator
1788+
cp -r easy-rsa/"${files_to_copy[@]}" easy-rsa/aggregator
1789+
mkdir easy-rsa/cloud-pvl-admission
1790+
cp -r easy-rsa/"${files_to_copy[@]}" easy-rsa/cloud-pvl-admission
1791+
mkdir easy-rsa/konnectivity-server
1792+
cp -r easy-rsa/"${files_to_copy[@]}" easy-rsa/konnectivity-server
1793+
mkdir easy-rsa/konnectivity-agent
1794+
cp -r easy-rsa/"${files_to_copy[@]}" easy-rsa/konnectivity-agent) &>"${cert_create_debug_output}" || true
1795+
CERT_DIR="${KUBE_TEMP}/easy-rsa"
1796+
AGGREGATOR_CERT_DIR="${KUBE_TEMP}/easy-rsa/aggregator"
1797+
CLOUD_PVL_ADMISSION_CERT_DIR="${KUBE_TEMP}/easy-rsa/cloud-pvl-admission"
1798+
KONNECTIVITY_SERVER_CERT_DIR="${KUBE_TEMP}/easy-rsa/konnectivity-server"
1799+
KONNECTIVITY_AGENT_CERT_DIR="${KUBE_TEMP}/easy-rsa/konnectivity-agent"
18011800
if [ ! -x "${CERT_DIR}/easyrsa" ] || [ ! -x "${AGGREGATOR_CERT_DIR}/easyrsa" ]; then
18021801
# TODO(roberthbailey,porridge): add better error handling here,
18031802
# see https://github.com/kubernetes/kubernetes/issues/55229
@@ -1830,8 +1829,8 @@ function generate-certs {
18301829
./easyrsa --batch "--req-cn=${PRIMARY_CN}@$(date +%s)" build-ca nopass
18311830
# SANS (expected to be) defined by caller
18321831
# shellcheck disable=SC2153
1833-
./easyrsa --subject-alt-name="${SANS}" build-server-full "${MASTER_NAME}" nopass
1834-
./easyrsa build-client-full kube-apiserver nopass
1832+
./easyrsa --batch --subject-alt-name="${SANS}" build-server-full "${MASTER_NAME}" nopass
1833+
./easyrsa --batch build-client-full kube-apiserver nopass
18351834

18361835
kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl"
18371836

@@ -1844,8 +1843,8 @@ function generate-certs {
18441843
rm -f "kubelet.csr"
18451844

18461845
# Make a superuser client cert with subject "O=system:masters, CN=kubecfg"
1847-
./easyrsa --dn-mode=org \
1848-
--req-cn=kubecfg --req-org=system:masters \
1846+
./easyrsa --batch --dn-mode=org \
1847+
--req-org=system:masters \
18491848
--req-c= --req-st= --req-city= --req-email= --req-ou= \
18501849
build-client-full kubecfg nopass) &>"${cert_create_debug_output}" || true
18511850
local output_file_missing=0
@@ -1891,12 +1890,12 @@ function generate-aggregator-certs {
18911890
local -r cert_create_debug_output=$(mktemp "${KUBE_TEMP}/cert_create_debug_output.XXX")
18921891
# Note: This was heavily cribbed from make-ca-cert.sh
18931892
(set -x
1894-
cd "${KUBE_TEMP}/easy-rsa-master/aggregator"
1893+
cd "${KUBE_TEMP}/easy-rsa/aggregator"
18951894
./easyrsa init-pki
18961895
# this puts the cert into pki/ca.crt and the key into pki/private/ca.key
18971896
./easyrsa --batch "--req-cn=${AGGREGATOR_PRIMARY_CN}@$(date +%s)" build-ca nopass
1898-
./easyrsa --subject-alt-name="${AGGREGATOR_SANS}" build-server-full "${AGGREGATOR_MASTER_NAME}" nopass
1899-
./easyrsa build-client-full aggregator-apiserver nopass
1897+
./easyrsa --batch --subject-alt-name="${AGGREGATOR_SANS}" build-server-full "${AGGREGATOR_MASTER_NAME}" nopass
1898+
./easyrsa --batch build-client-full aggregator-apiserver nopass
19001899

19011900
kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl"
19021901

@@ -1909,8 +1908,8 @@ function generate-aggregator-certs {
19091908
rm -f "proxy-client.csr"
19101909

19111910
# Make a superuser client cert with subject "O=system:masters, CN=kubecfg"
1912-
./easyrsa --dn-mode=org \
1913-
--req-cn=proxy-clientcfg --req-org=system:aggregator \
1911+
./easyrsa --batch --dn-mode=org \
1912+
--req-org=system:aggregator \
19141913
--req-c= --req-st= --req-city= --req-email= --req-ou= \
19151914
build-client-full proxy-clientcfg nopass) &>"${cert_create_debug_output}" || true
19161915
local output_file_missing=0
@@ -1952,12 +1951,12 @@ function generate-konnectivity-server-certs {
19521951
# Note: This was heavily cribbed from make-ca-cert.sh
19531952
(set -x
19541953
# Make the client <-> konnectivity server side certificates.
1955-
cd "${KUBE_TEMP}/easy-rsa-master/konnectivity-server"
1954+
cd "${KUBE_TEMP}/easy-rsa/konnectivity-server"
19561955
./easyrsa init-pki
19571956
# this puts the cert into pki/ca.crt and the key into pki/private/ca.key
19581957
./easyrsa --batch "--req-cn=${KONNECTIVITY_SERVER_PRIMARY_CN}@$(date +%s)" build-ca nopass
1959-
./easyrsa --subject-alt-name="IP:127.0.0.1,${KONNECTIVITY_SERVER_SANS}" build-server-full server nopass
1960-
./easyrsa build-client-full client nopass
1958+
./easyrsa --batch --subject-alt-name="IP:127.0.0.1,${KONNECTIVITY_SERVER_SANS}" build-server-full server nopass
1959+
./easyrsa --batch build-client-full client nopass
19611960

19621961
kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl"
19631962

@@ -1968,12 +1967,12 @@ function generate-konnectivity-server-certs {
19681967
rm -f "konnectivity-server.csr"
19691968

19701969
# Make the agent <-> konnectivity server side certificates.
1971-
cd "${KUBE_TEMP}/easy-rsa-master/konnectivity-agent"
1970+
cd "${KUBE_TEMP}/easy-rsa/konnectivity-agent"
19721971
./easyrsa init-pki
19731972
# this puts the cert into pki/ca.crt and the key into pki/private/ca.key
19741973
./easyrsa --batch "--req-cn=${KONNECTIVITY_SERVER_PRIMARY_CN}@$(date +%s)" build-ca nopass
1975-
./easyrsa --subject-alt-name="${KONNECTIVITY_SERVER_SANS}" build-server-full server nopass
1976-
./easyrsa build-client-full client nopass
1974+
./easyrsa --batch --subject-alt-name="${KONNECTIVITY_SERVER_SANS}" build-server-full server nopass
1975+
./easyrsa --batch build-client-full client nopass
19771976

19781977
kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl"
19791978

@@ -2030,12 +2029,12 @@ function generate-cloud-pvl-admission-certs {
20302029
# Note: This was heavily cribbed from make-ca-cert.sh
20312030
(set -x
20322031
# Make the client <-> cloud-pvl-admission server side certificates.
2033-
cd "${KUBE_TEMP}/easy-rsa-master/cloud-pvl-admission"
2032+
cd "${KUBE_TEMP}/easy-rsa/cloud-pvl-admission"
20342033
./easyrsa init-pki
20352034
# this puts the cert into pki/ca.crt and the key into pki/private/ca.key
20362035
./easyrsa --batch "--req-cn=${CLOUD_PVL_ADMISSION_PRIMARY_CN}@$(date +%s)" build-ca nopass
2037-
./easyrsa --subject-alt-name="IP:127.0.0.1,${CLOUD_PVL_ADMISSION_SANS}" build-server-full server nopass
2038-
./easyrsa build-client-full client nopass
2036+
./easyrsa --batch --subject-alt-name="IP:127.0.0.1,${CLOUD_PVL_ADMISSION_SANS}" build-server-full server nopass
2037+
./easyrsa --batch build-client-full client nopass
20392038

20402039
kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl"
20412040

@@ -2046,12 +2045,12 @@ function generate-cloud-pvl-admission-certs {
20462045
rm -f "cloud-pvl-admission.csr"
20472046

20482047
# Make the cloud-pvl-admission server side certificates.
2049-
cd "${KUBE_TEMP}/easy-rsa-master/cloud-pvl-admission"
2048+
cd "${KUBE_TEMP}/easy-rsa/cloud-pvl-admission"
20502049
./easyrsa init-pki
20512050
# this puts the cert into pki/ca.crt and the key into pki/private/ca.key
20522051
./easyrsa --batch "--req-cn=${CLOUD_PVL_ADMISSION_PRIMARY_CN}@$(date +%s)" build-ca nopass
2053-
./easyrsa --subject-alt-name="${CLOUD_PVL_ADMISSION_SANS}" build-server-full server nopass
2054-
./easyrsa build-client-full client nopass
2052+
./easyrsa --batch --subject-alt-name="${CLOUD_PVL_ADMISSION_SANS}" build-server-full server nopass
2053+
./easyrsa --batch build-client-full client nopass
20552054

20562055
kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl"
20572056

0 commit comments

Comments
 (0)