forked from poseidon/terraform-render-bootstrap
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathtls-aggregation.tf
108 lines (78 loc) · 3.01 KB
/
tls-aggregation.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
locals {
# Kubernetes Aggregation TLS assets map
aggregation_tls = var.enable_aggregation ? {
"tls/k8s/aggregation-ca.crt" = tls_self_signed_cert.aggregation-ca[0].cert_pem,
"tls/k8s/aggregation-client.crt" = tls_locally_signed_cert.aggregation-client[0].cert_pem,
"tls/k8s/aggregation-client.key" = tls_private_key.aggregation-client[0].private_key_pem,
} : {}
}
# Kubernetes Aggregation CA (i.e. front-proxy-ca)
# Files: tls/{aggregation-ca.crt,aggregation-ca.key}
resource "tls_private_key" "aggregation-ca" {
count = var.enable_aggregation ? 1 : 0
algorithm = "RSA"
rsa_bits = "2048"
}
resource "tls_self_signed_cert" "aggregation-ca" {
count = var.enable_aggregation ? 1 : 0
key_algorithm = tls_private_key.aggregation-ca[0].algorithm
private_key_pem = tls_private_key.aggregation-ca[0].private_key_pem
subject {
common_name = "kubernetes-front-proxy-ca"
}
is_ca_certificate = true
validity_period_hours = 8760
allowed_uses = [
"key_encipherment",
"digital_signature",
"cert_signing",
]
}
resource "local_file" "aggregation-ca-key" {
count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
content = tls_private_key.aggregation-ca[0].private_key_pem
filename = "${var.asset_dir}/tls/aggregation-ca.key"
}
resource "local_file" "aggregation-ca-crt" {
count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
content = tls_self_signed_cert.aggregation-ca[0].cert_pem
filename = "${var.asset_dir}/tls/aggregation-ca.crt"
}
# Kubernetes apiserver (i.e. front-proxy-client)
# Files: tls/{aggregation-client.crt,aggregation-client.key}
resource "tls_private_key" "aggregation-client" {
count = var.enable_aggregation ? 1 : 0
algorithm = "RSA"
rsa_bits = "2048"
}
resource "tls_cert_request" "aggregation-client" {
count = var.enable_aggregation ? 1 : 0
key_algorithm = tls_private_key.aggregation-client[0].algorithm
private_key_pem = tls_private_key.aggregation-client[0].private_key_pem
subject {
common_name = "kube-apiserver"
}
}
resource "tls_locally_signed_cert" "aggregation-client" {
count = var.enable_aggregation ? 1 : 0
cert_request_pem = tls_cert_request.aggregation-client[0].cert_request_pem
ca_key_algorithm = tls_self_signed_cert.aggregation-ca[0].key_algorithm
ca_private_key_pem = tls_private_key.aggregation-ca[0].private_key_pem
ca_cert_pem = tls_self_signed_cert.aggregation-ca[0].cert_pem
validity_period_hours = 8760
allowed_uses = [
"key_encipherment",
"digital_signature",
"client_auth",
]
}
resource "local_file" "aggregation-client-key" {
count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
content = tls_private_key.aggregation-client[0].private_key_pem
filename = "${var.asset_dir}/tls/aggregation-client.key"
}
resource "local_file" "aggregation-client-crt" {
count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
content = tls_locally_signed_cert.aggregation-client[0].cert_pem
filename = "${var.asset_dir}/tls/aggregation-client.crt"
}