metalk8s/pillar/metalk8s/roles/ca.sls at 9f38ed757cab8af122378e8585b492bd7654dff0 · scality/metalk8s · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
mine_functions:
  kubernetes_root_ca_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/kubernetes/pki/ca.crt

  kubernetes_etcd_ca_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/kubernetes/pki/etcd/ca.crt

  kubernetes_front_proxy_ca_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/kubernetes/pki/front-proxy-ca.crt

  kubernetes_sa_pub_key_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/kubernetes/pki/sa.pub

  dex_ca_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/metalk8s/pki/dex/ca.crt

  ingress_ca_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/metalk8s/pki/nginx-ingress/ca.crt

  backup_server_ca_b64:
    - mine_function: hashutil.base64_encodefile
    - /etc/metalk8s/pki/backup-server/ca.crt

x509_signing_policies:
  kube_apiserver_client_policy:
    - minions: '*'
    - signing_private_key: /etc/kubernetes/pki/ca.key
    - signing_cert: /etc/kubernetes/pki/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: clientAuth
    - authorityKeyIdentifier: keyid
  kube_apiserver_server_policy:
    - minions: '*'
    - signing_private_key: /etc/kubernetes/pki/ca.key
    - signing_cert: /etc/kubernetes/pki/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: serverAuth
    - authorityKeyIdentifier: keyid
  etcd_client_policy:
    - minions: '*'
    - signing_private_key: /etc/kubernetes/pki/etcd/ca.key
    - signing_cert: /etc/kubernetes/pki/etcd/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: clientAuth
    - authorityKeyIdentifier: keyid
  etcd_server_client_policy:
    - minions: '*'
    - signing_private_key: /etc/kubernetes/pki/etcd/ca.key
    - signing_cert: /etc/kubernetes/pki/etcd/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: serverAuth, clientAuth
    - authorityKeyIdentifier: keyid
  front_proxy_client_policy:
    - minions: '*'
    - signing_private_key: /etc/kubernetes/pki/front-proxy-ca.key
    - signing_cert: /etc/kubernetes/pki/front-proxy-ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: clientAuth
    - authorityKeyIdentifier: keyid
  ingress_server_policy:
    - minions: '*'
    - signing_private_key: /etc/metalk8s/pki/nginx-ingress/ca.key
    - signing_cert: /etc/metalk8s/pki/nginx-ingress/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: serverAuth
    - authorityKeyIdentifier: keyid
  dex_server_policy:
    - minions: '*'
    - signing_private_key: /etc/metalk8s/pki/dex/ca.key
    - signing_cert: /etc/metalk8s/pki/dex/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: serverAuth
    - authorityKeyIdentifier: keyid
  backup_server_policy:
    - minions: '*'
    - signing_private_key: /etc/metalk8s/pki/backup-server/ca.key
    - signing_cert: /etc/metalk8s/pki/backup-server/ca.crt
    - keyUsage: critical digitalSignature, keyEncipherment
    - extendedKeyUsage: serverAuth
    - authorityKeyIdentifier: keyid