github.com/openshift/installer@v1.4.17/pkg/asset/tls/adminkubeconfig.go (about)

     1  package tls
     2  
     3  import (
     4  	"context"
     5  	"crypto/x509"
     6  	"crypto/x509/pkix"
     7  
     8  	"github.com/openshift/installer/pkg/asset"
     9  )
    10  
    11  // AdminKubeConfigSignerCertKey is a key/cert pair that signs the admin kubeconfig client certs.
    12  type AdminKubeConfigSignerCertKey struct {
    13  	SelfSignedCertKey
    14  }
    15  
    16  var _ asset.WritableAsset = (*AdminKubeConfigSignerCertKey)(nil)
    17  
    18  // Dependencies returns the dependency of the root-ca, which is empty.
    19  func (c *AdminKubeConfigSignerCertKey) Dependencies() []asset.Asset {
    20  	return []asset.Asset{}
    21  }
    22  
    23  // Generate generates the root-ca key and cert pair.
    24  func (c *AdminKubeConfigSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
    25  	cfg := &CertCfg{
    26  		Subject:   pkix.Name{CommonName: "admin-kubeconfig-signer", OrganizationalUnit: []string{"openshift"}},
    27  		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
    28  		Validity:  ValidityTenYears,
    29  		IsCA:      true,
    30  	}
    31  
    32  	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer")
    33  }
    34  
    35  // Load reads the asset files from disk.
    36  func (c *AdminKubeConfigSignerCertKey) Load(f asset.FileFetcher) (bool, error) {
    37  	return c.loadCertKey(f, "admin-kubeconfig-signer")
    38  }
    39  
    40  // Name returns the human-friendly name of the asset.
    41  func (c *AdminKubeConfigSignerCertKey) Name() string {
    42  	return "Certificate (admin-kubeconfig-signer)"
    43  }
    44  
    45  // AdminKubeConfigCABundle is the asset the generates the admin-kubeconfig-ca-bundle,
    46  // which contains all the individual client CAs.
    47  type AdminKubeConfigCABundle struct {
    48  	CertBundle
    49  }
    50  
    51  var _ asset.Asset = (*AdminKubeConfigCABundle)(nil)
    52  
    53  // Dependencies returns the dependency of the cert bundle.
    54  func (a *AdminKubeConfigCABundle) Dependencies() []asset.Asset {
    55  	return []asset.Asset{
    56  		&AdminKubeConfigSignerCertKey{},
    57  	}
    58  }
    59  
    60  // Generate generates the cert bundle based on its dependencies.
    61  func (a *AdminKubeConfigCABundle) Generate(ctx context.Context, deps asset.Parents) error {
    62  	var certs []CertInterface
    63  	for _, asset := range a.Dependencies() {
    64  		deps.Get(asset)
    65  		certs = append(certs, asset.(CertInterface))
    66  	}
    67  	return a.CertBundle.Generate(ctx, "admin-kubeconfig-ca-bundle", certs...)
    68  }
    69  
    70  // Name returns the human-friendly name of the asset.
    71  func (a *AdminKubeConfigCABundle) Name() string {
    72  	return "Certificate (admin-kubeconfig-ca-bundle)"
    73  }
    74  
    75  // AdminKubeConfigClientCertKey is the asset that generates the key/cert pair for admin client to apiserver.
    76  type AdminKubeConfigClientCertKey struct {
    77  	SignedCertKey
    78  }
    79  
    80  var _ asset.WritableAsset = (*AdminKubeConfigClientCertKey)(nil)
    81  
    82  // Dependencies returns the dependency of the the cert/key pair, which includes
    83  // the parent CA, and install config if it depends on the install config for
    84  // DNS names, etc.
    85  func (a *AdminKubeConfigClientCertKey) Dependencies() []asset.Asset {
    86  	return []asset.Asset{
    87  		&AdminKubeConfigSignerCertKey{},
    88  	}
    89  }
    90  
    91  // Generate generates the cert/key pair based on its dependencies.
    92  func (a *AdminKubeConfigClientCertKey) Generate(ctx context.Context, dependencies asset.Parents) error {
    93  	ca := &AdminKubeConfigSignerCertKey{}
    94  	dependencies.Get(ca)
    95  
    96  	cfg := &CertCfg{
    97  		Subject:      pkix.Name{CommonName: "system:admin", Organization: []string{"system:masters"}},
    98  		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
    99  		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
   100  		Validity:     ValidityTenYears,
   101  	}
   102  
   103  	return a.SignedCertKey.Generate(ctx, cfg, ca, "admin-kubeconfig-client", DoNotAppendParent)
   104  }
   105  
   106  // Load reads the asset files from disk.
   107  func (a *AdminKubeConfigClientCertKey) Load(f asset.FileFetcher) (bool, error) {
   108  	return a.loadCertKey(f, "admin-kubeconfig-client")
   109  }
   110  
   111  // Name returns the human-friendly name of the asset.
   112  func (a *AdminKubeConfigClientCertKey) Name() string {
   113  	return "Certificate (admin-kubeconfig-client)"
   114  }