Setup TLS certificates for the Control-API

This guide provides an example how to setup TLS certificates for the Control-API API server and admission webhook server. This ensures encrypted and trusted communication between the Kubernetes API server and the aggregate API server provided by the Control-API.

Requirements

  • kubectl

  • openssl

  • vault

  • yq

  1. Compile the cluster

    commodore catalog compile ${CLUSTER_ID}"

  2. Prepare certificate files

    # Adjust the lifetime as necessary
lifetime=3650
# Adjust API server servicename if the namespace differs
servicename=control-api-apiserver.appuio-control-api.svc
openssl req -x509 -newkey rsa:4096 -nodes -keyout apiserver.key -out apiserver.crt -days ${lifetime} -subj "/CN=$servicename" -addext "subjectAltName = DNS:$servicename"

# Adjust admission webhook servicename if the namespace differs
servicename=webhook-service.appuio-control-api.svc
openssl req -x509 -newkey rsa:4096 -nodes -keyout webhook.key -out webhook.crt -days ${lifetime} -subj "/CN=$servicename" -addext "subjectAltName = DNS:$servicename"

  3. Store keys in Vault

    instance=control-api
parent="clusters/kv/${TENANT_ID}/${CLUSTER_ID}"

# Use the 'patch' subcommand to add to existing secret
vault kv patch "${parent}/${instance}" apiserver-key=@apiserver.key
vault kv patch "${parent}/${instance}" webhook-key=@webhook.key

  4. Add certificates to cluster config

    apicert=$(cat apiserver.crt)
yq eval -i ".parameters.control_api.apiserver.tls.serverCert = \"${apicert}\"" \
  inventory/classes/${TENANT_ID}/${CLUSTER_ID}.yml
webhookcert=$(cat webhook.crt)
yq eval -i ".parameters.control_api.controller.webhookTls.certificate = \"${webhookcert}\"" \
  inventory/classes/${TENANT_ID}/${CLUSTER_ID}.yml
yq eval -i '.parameters.control_api.controller.webhookTls.caCertificate = "${control_api:controller:webhookTls:certificate}"' \
  inventory/classes/${TENANT_ID}/${CLUSTER_ID}.yml

  5. Commit and push configuration change

    cd inventory/classes/${TENANT_ID}
git add ${CLUSTER_ID}.yml
git commit -m "Configure Control API APIService and admission webhook certificates"
git push origin master
popd

  6. Remove temporary files

    rm apiserver.{key,crt} webhook.{key,crt}