mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-23 12:47:48 +00:00
joshsiv-mulga
fba330b86e
cmd/eks-konnectivity-cert keeps flag parsing, the log prefix and the exit; agents/eks/konnectivitycert owns Config and Run. Output, error text, file modes and exit codes are unchanged.
40 lines
1.3 KiB
Go
40 lines
1.3 KiB
Go
// Command eks-konnectivity-cert mints, then reuses, a K3s-CA-signed serving
|
|
// certificate for the on-node konnectivity-server; the implementation is in
|
|
// agents/eks/konnectivitycert.
|
|
//
|
|
// Usage:
|
|
//
|
|
// eks-konnectivity-cert -dir /var/lib/spinifex-eks/konnectivity \
|
|
// -ca-cert /var/lib/rancher/k3s/server/tls/server-ca.crt \
|
|
// -ca-key /var/lib/rancher/k3s/server/tls/server-ca.key \
|
|
// -cn konnectivity-server -sans 10.32.100.4,203.0.113.9,eks-toc.example
|
|
//
|
|
// Writes <dir>/tls.crt and <dir>/tls.key; prints the two paths (tab-separated).
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"flag"
|
|
"log/slog"
|
|
"os"
|
|
|
|
_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
|
|
|
|
"github.com/mulgadc/spinifex/spinifex/agents/eks/konnectivitycert"
|
|
)
|
|
|
|
func main() {
|
|
cfg := konnectivitycert.Config{Out: os.Stdout}
|
|
flag.StringVar(&cfg.Dir, "dir", "", "directory to cache tls.crt/tls.key in")
|
|
flag.StringVar(&cfg.CACert, "ca-cert", "", "PEM path of the signing (K3s server) CA cert")
|
|
flag.StringVar(&cfg.CAKey, "ca-key", "", "PEM path of the signing CA private key")
|
|
flag.StringVar(&cfg.CN, "cn", "konnectivity-server", "certificate common name")
|
|
flag.StringVar(&cfg.SANs, "sans", "", "comma-separated SANs (IP or DNS)")
|
|
flag.Parse()
|
|
|
|
if err := konnectivitycert.Run(context.Background(), cfg); err != nil {
|
|
slog.Error("eks-konnectivity-cert: " + err.Error())
|
|
os.Exit(1)
|
|
}
|
|
}
|