|
| 1 | +#!/usr/bin/env bash |
| 2 | +set -euo pipefail |
| 3 | + |
| 4 | +NAMESPACE=$1 |
| 5 | +DEPLOYMENT=$2 |
| 6 | +SERVICE="${DEPLOYMENT}-service" |
| 7 | +CSR_NAME="${SERVICE}.${NAMESPACE}" |
| 8 | +SECRET_NAME=${3:-"audit-webhook"} |
| 9 | +# The binaries downloaded by the install-binaries script are located in the /tmp directory. |
| 10 | +export PATH=$PATH:${4:-"/tmp"} |
| 11 | + |
| 12 | +function check_kubectl_cli() { |
| 13 | + if ! command -v kubectl &>/dev/null; then |
| 14 | + echo "Error: kubectl is not installed. Exiting." |
| 15 | + exit 1 |
| 16 | + fi |
| 17 | +} |
| 18 | + |
| 19 | +check_kubectl_cli |
| 20 | + |
| 21 | +echo "Waiting for Service ClusterIP..." |
| 22 | +cluster_ip=$( |
| 23 | + kubectl wait \ |
| 24 | + --for jsonpath='{.spec.clusterIP}' \ |
| 25 | + --namespace "${NAMESPACE}" \ |
| 26 | + --output jsonpath='{.spec.clusterIP}' \ |
| 27 | + --timeout 5m \ |
| 28 | + svc/"${SERVICE}" |
| 29 | +) |
| 30 | + |
| 31 | +echo "Cluster IP detected: ${cluster_ip}" |
| 32 | + |
| 33 | +function sign_certificate() { |
| 34 | + echo "Generating private key..." |
| 35 | + SERVER_KEY="$(openssl genrsa 4096)" |
| 36 | + |
| 37 | + echo "Generating CSR..." |
| 38 | + SERVER_CSR="$( |
| 39 | + openssl req -new \ |
| 40 | + -key <(printf '%s\n' "${SERVER_KEY}") \ |
| 41 | + -config <( |
| 42 | + cat <<EOF |
| 43 | +[ req ] |
| 44 | +default_bits = 2048 |
| 45 | +prompt = no |
| 46 | +default_md = sha256 |
| 47 | +req_extensions = req_ext |
| 48 | +distinguished_name = dn |
| 49 | +
|
| 50 | +[ dn ] |
| 51 | +CN = system:node:${SERVICE}.${NAMESPACE}.svc |
| 52 | +O = system:nodes |
| 53 | +
|
| 54 | +[ req_ext ] |
| 55 | +subjectAltName = @alt_names |
| 56 | +
|
| 57 | +[ alt_names ] |
| 58 | +DNS.1 = ${SERVICE}.${NAMESPACE}.svc.cluster.local |
| 59 | +DNS.2 = ${SERVICE}.${NAMESPACE}.svc |
| 60 | +IP.1 = ${cluster_ip} |
| 61 | +EOF |
| 62 | + ) |
| 63 | + )" |
| 64 | + |
| 65 | + echo "Submitting Kubernetes CSR..." |
| 66 | + kubectl apply -f - <<EOF |
| 67 | +apiVersion: certificates.k8s.io/v1 |
| 68 | +kind: CertificateSigningRequest |
| 69 | +metadata: |
| 70 | + name: ${CSR_NAME} |
| 71 | +spec: |
| 72 | + request: $(printf '%s' "${SERVER_CSR}" | base64 | tr -d '\n') |
| 73 | + signerName: kubernetes.io/kubelet-serving |
| 74 | + usages: |
| 75 | + - digital signature |
| 76 | + - key encipherment |
| 77 | + - server auth |
| 78 | +EOF |
| 79 | + |
| 80 | + echo "Approving CSR..." |
| 81 | + kubectl certificate approve "${CSR_NAME}" |
| 82 | + |
| 83 | + echo "Waiting for signed certificate..." |
| 84 | + kubectl wait \ |
| 85 | + --for jsonpath='{.status.certificate}' \ |
| 86 | + --timeout 5m \ |
| 87 | + csr/"${CSR_NAME}" |
| 88 | + |
| 89 | + SERVER_CERT="$( |
| 90 | + kubectl get csr/"${CSR_NAME}" \ |
| 91 | + -o jsonpath='{.status.certificate}' | base64 --decode |
| 92 | + )" |
| 93 | +} |
| 94 | + |
| 95 | +sign_certificate |
| 96 | + |
| 97 | +echo "Creating or replacing TLS secret..." |
| 98 | +kubectl delete secret "${SECRET_NAME}" \ |
| 99 | + --namespace "${NAMESPACE}" \ |
| 100 | + --ignore-not-found |
| 101 | + |
| 102 | +kubectl create secret tls "${SECRET_NAME}" \ |
| 103 | + --namespace "${NAMESPACE}" \ |
| 104 | + --cert <(printf '%s\n' "${SERVER_CERT}") \ |
| 105 | + --key <(printf '%s\n' "${SERVER_KEY}") |
| 106 | + |
| 107 | +echo "Restarting deployment..." |
| 108 | +kubectl rollout restart \ |
| 109 | + --namespace "${NAMESPACE}" \ |
| 110 | + deploy/"${DEPLOYMENT}" |
| 111 | + |
| 112 | +echo "Waiting for rollout to complete..." |
| 113 | +kubectl rollout status \ |
| 114 | + --timeout 1m \ |
| 115 | + --namespace "${NAMESPACE}" \ |
| 116 | + deploy/"${DEPLOYMENT}" |
0 commit comments