luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

backport of commit 8250fba0e6967a6f058d4f0960a9e748441e4d7c (#22454) 

Co-authored-by: Artur Faizullin <arthur.fayzullin@gmail.com>
This commit is contained in:
hc-github-team-secure-vault-core 2023-08-18 16:48:30 -04:00 committed by GitHub
parent 6f2d433394
commit d9a3586dea
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
website/content/docs/platform/k8s/helm/examples/standalone-tls.mdx
View File

@ -64,21 +64,22 @@ e is 65537 (0x10001)
extendedKeyUsage = serverAuth extendedKeyUsage = serverAuth
subjectAltName = @alt_names subjectAltName = @alt_names
[alt_names] [alt_names]
DNS.1 = ${SERVICE} DNS.1 = *.${SERVICE}
DNS.2 = ${SERVICE}.${NAMESPACE} DNS.2 = *.${SERVICE}.${NAMESPACE}
DNS.3 = ${SERVICE}.${NAMESPACE}.svc DNS.3 = *.${SERVICE}.${NAMESPACE}.svc
DNS.4 = ${SERVICE}.${NAMESPACE}.svc.cluster.local DNS.4 = *.${SERVICE}.${NAMESPACE}.svc.cluster.local
IP.1 = 127.0.0.1 IP.1 = 127.0.0.1
EOF EOF
``` ```
2. Create a CSR. 2. Create a CSR.
```shell-session ```bash
$ openssl req -new -key ${TMPDIR}/vault.key \ openssl req -new \
-subj "/O=system:nodes/CN=system:node:${SERVICE}.${NAMESPACE}.svc" \ -key ${TMPDIR}/vault.key \
-out ${TMPDIR}/server.csr \ -subj "/CN=system:node:${SERVICE}.${NAMESPACE}.svc;/O=system:nodes" \
-config ${TMPDIR}/csr.conf -out ${TMPDIR}/server.csr \
-config ${TMPDIR}/csr.conf
``` ```
3. Create the certificate 3. Create the certificate
@ -94,9 +95,10 @@ e is 65537 (0x10001)
metadata: metadata:
name: ${CSR_NAME} name: ${CSR_NAME}
spec: spec:
signerName: kubernetes.io/kubelet-serving
groups: groups:
- system:authenticated - system:authenticated
request: $(cat ${TMPDIR}/server.csr | base64 | tr -d '\r\n') request: $(base64 ${TMPDIR}/server.csr | tr -d '\n')
signerName: kubernetes.io/kubelet-serving signerName: kubernetes.io/kubelet-serving
usages: usages:
- digital signature - digital signature
@ -148,8 +150,10 @@ e is 65537 (0x10001)
3. Retrieve Kubernetes CA. 3. Retrieve Kubernetes CA.
```shell-session ```bash
$ kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}' | base64 -d > ${TMPDIR}/vault.ca kubectl get secret \
-o jsonpath="{.items[?(@.type==\"kubernetes.io/service-account-token\")].data['ca\.crt']}" \
| base64 --decode > ${TMPDIR}/vault.ca
``` ```
4. Create the namespace. 4. Create the namespace.