cfssl

README

CFSSL Configuration Function

Creates a Job to generate a CA, private keys and certificates signed by said CA. The Job then creates a Secret containing the generated assets. All this is configured via CFSSL JSON configs.

CFSSL JSON Naming

The Job uses the following naming scheme for CFSSL JSON configs:

• config.json (required) is passed to cfssl gencert -config and holds profiles.
• ca_csr.json (required) is used to configure the CA cert/key.
• INSTANCE_PROFILE_csr.json are CSR configs.
  • INSTANCE is a unique name for a cert/key pair.
  • PROFILE is the profile to use that was specified in config.json

Kubernetes Secret

The resulting Secret that is created contains all generated CSRs/certs/keys. The default name of the Secret is derived from the function config metadata as: {{ .Name }}-{{ .Namespace }}.

This name is configurable via the secret_name key in the ConfigMap.

Getting Started

Set up a workspace and define a function configuration. The JSON data will be used to create a CA and simple client/server TLS assets.

DEMO=$(mktemp -d)
mkdir $DEMO/functions

cat <<EOF >$DEMO/functions/configmap_my-certs.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-certs
  namespace: example
  annotations:
    config.kubernetes.io/function: |
      container:
        image: gcr.io/config-functions/cfssl:v0.0.1
data:
  config.json: |-
    {
        "signing": {
            "default": {
                "expiry": "168h"
            },
            "profiles": {
                "server": {
                    "expiry": "8760h",
                    "usages": [
                        "signing",
                        "key encipherment",
                        "server auth"
                    ]
                },
                "client": {
                    "expiry": "8760h",
                    "usages": [
                        "signing",
                        "key encipherment",
                        "client auth"
                    ]
                }
            }
        }
    }

  ca_csr.json: |-
    {
        "CN": "My CA",
        "key": {
            "algo": "ecdsa",
            "size": 256
        },
        "names": [
            {
                "C": "US",
                "ST": "CA",
                "L": "San Francisco"
            }
        ]
    }

  0_server_csr.json: |-
    {
        "CN": "db0",
        "hosts": [
            "example.net",
            "db.example.net",
            "db-0.example.net"
        ],
        "key": {
            "algo": "ecdsa",
            "size": 256
        },
        "names": [
            {
                "C": "US",
                "ST": "CA",
                "L": "San Francisco"
            }
        ]
    }

  0_client_csr.json: |-
    {
        "CN": "client",
        "key": {
            "algo": "ecdsa",
            "size": 256
        },
        "names": [
            {
                "C": "US",
                "ST": "CA",
                "L": "San Francisco"
            }
        ]
    }
EOF

Generate Resources.

config run $DEMO

Generated Resources

The function generates the following resources.

EXPECTED='.
├── [Resource]  ConfigMap example/my-certs
├── [Resource]  Job example/my-certs
├── [Resource]  Role example/my-certs
├── [Resource]  RoleBinding example/my-certs
└── [Resource]  ServiceAccount example/my-certs'

TEST="$(config tree $DEMO --graph-structure=owners)"
[ "$TEST" = "$EXPECTED" ]

Secret Keys

In this example a my-certs-example Secret would be created after the Job completes. The data available would be:

• 0-client-key.pem
• 0-client.csr
• 0-client.pem
• 0-server-key.pem
• 0-server.csr
• 0-server.pem
• ca-key.pem
• ca.csr
• ca.pem

Cleanup the demo workspace.

rm -rf $DEMO

Documentation

Index

• Constants
• type ConfigFunction
  • func (f *ConfigFunction) Filter(in []*yaml.RNode) ([]*yaml.RNode, error)
• type Options
  • func (d *Options) UnmarshalYAML(node *yaml.Node) error

Constants

const DefaultAppNameAnnotationValue = "cfssl"

Types

type ConfigFunction

type ConfigFunction struct {
	cfunc.ConfigFunction `yaml:",inline"`

	// Data contains various options specific to this config function.
	Data Options
}

ConfigFunction implements kio.Filter and holds information used in Resource templates.

func (*ConfigFunction) Filter

func (f *ConfigFunction) Filter(in []*yaml.RNode) ([]*yaml.RNode, error)

Filter generates Resources.

type Options

type Options struct {
	// SecretName is the name of the Secret used to hold generated certs
	// and keys. Defaults to the metadata.name of the function config.
	SecretName string `yaml:"secret_name"`
}

Options holds settings used in the config function.

func (*Options) UnmarshalYAML

func (d *Options) UnmarshalYAML(node *yaml.Node) error