binlog: add tls in pump and drainer

charts/tidb-cluster/templates/_helpers.tpl

@@ -118,10 +118,20 @@ config-file: |-
 {{/*
 Encapsulate pump configmap data for consistent digest calculation
 */}}
+{{- define "pump.tlsSecretName" -}}
+{{ .Values.clusterName }}-pump
+{{- end -}}
+
 {{- define "pump-configmap.data" -}}
 pump-config: |-
  {{- if .Values.binlog.pump.config }}
 {{ .Values.binlog.pump.config | indent 2 }}
+ {{- if .Values.enableTLSCluster }}
+ [security]
+ ssl-ca = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+ ssl-cert = "/var/lib/pump-tls/cert"
+ ssl-key = "/var/lib/pump-tls/key"
+ {{- end -}}
  {{- else -}}
 {{ tuple "config/_pump-config.tpl" . | include "helm-toolkit.utils.template" | indent 2 }}
  {{- end -}}

charts/tidb-cluster/templates/config/_pump-config.tpl

@@ -19,14 +19,6 @@ heartbeat-interval = {{ .Values.binlog.pump.heartbeatInterval | default 2 }}
 # a comma separated list of PD endpoints
 pd-urls = "{{ template "cluster.scheme" . }}://{{ template "cluster.name" . }}-pd:2379"
 
-#[security]
-# Path of file that contains list of trusted SSL CAs for connection with cluster components.
-# ssl-ca = "/path/to/ca.pem"
-# Path of file that contains X509 certificate in PEM format for connection with cluster components.
-# ssl-cert = "/path/to/drainer.pem"
-# Path of file that contains X509 key in PEM format for connection with cluster components.
-# ssl-key = "/path/to/drainer-key.pem"
-#
 [storage]
 # Set to `true` (default) for best reliability, which prevents data loss when there is a power failure.
 sync-log = {{ .Values.binlog.pump.syncLog | default true }}
@@ -43,3 +35,13 @@ sync-log = {{ .Values.binlog.pump.syncLog | default true }}
 # write-buffer = 67108864
 # write-L0-pause-trigger = 24
 # write-L0-slowdown-trigger = 17
+{{ if .Values.enableTLSCluster }}
+[security]
+# Path of file that contains list of trusted SSL CAs for connection with cluster components.
+ssl-ca = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+# Path of file that contains X509 certificate in PEM format for connection with cluster components.
+ssl-cert = "/var/lib/pump-tls/cert"
+# Path of file that contains X509 key in PEM format for connection with cluster components.
+ssl-key = "/var/lib/pump-tls/key"
+{{- end -}}
+

charts/tidb-cluster/templates/pump-statefulset.yaml

@@ -55,6 +55,11 @@ spec:
  mountPath: /data
  - name: config
  mountPath: /etc/pump
+ {{- if .Values.enableTLSCluster }}
+ - name: pump-tls
+ mountPath: /var/lib/pump-tls
+ readOnly: true
+ {{- end }}
  resources:
 {{ toYaml .Values.binlog.pump.resources | indent 10 }}
  {{- if and (ne .Values.timezone "UTC") (ne .Values.timezone "") }}
@@ -73,6 +78,11 @@ spec:
  items:
  - key: pump-config
  path: pump.toml
+ {{- if .Values.enableTLSCluster }}
+ - name: pump-tls
+ secret:
+ secretName: {{ include "pump.tlsSecretName" . }}
+ {{- end }}
  volumeClaimTemplates:
  - metadata:
  name: data

charts/tidb-cluster/values.yaml

@@ -56,7 +56,7 @@ discovery:
 enableConfigMapRollout: true
 
 # Whether enable TLS connections between server nodes.
-# When enabled, PD/TiDB/TiKV will use TLS encrypted connections to transfer data between each node,
+# When enabled, PD/TiDB/TiKV/PUMP will use TLS encrypted connections to transfer data between each node,
 # certificates will be generated automatically (if not already present).
 enableTLSCluster: false
 

charts/tidb-drainer/templates/_helpers.tpl

@@ -2,6 +2,10 @@
 {{ .Values.clusterName }}-{{ .Release.Name }}-drainer
 {{- end -}}
 
+{{- define "drainer.tlsSecretName" -}}
+{{ .Values.clusterName }}-drainer
+{{- end -}}
+
 {{/*
 Encapsulate config data for consistent digest calculation
 */}}
@@ -10,12 +14,22 @@ config-file: |-
  {{- if .Values.config }}
 {{ .Values.config | indent 2 }}
  {{- end -}}
+ {{- if .Values.enableTLSCluster }}
+ [security]
+ ssl-ca = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+ ssl-cert = "/var/lib/drainer-tls/cert"
+ ssl-key = "/var/lib/drainer-tls/key"
+ {{- end -}}
 {{- end -}}
 
 {{- define "drainer-configmap.name" -}}
 {{ include "drainer.name" . }}-{{ include "drainer-configmap.data" . | sha256sum | trunc 8 }}
 {{- end -}}
 
+{{- define "cluster.scheme" -}}
+{{ if .Values.enableTLSCluster }}https{{ else }}http{{ end }}
+{{- end -}}
+
 {{- define "helm-toolkit.utils.template" -}}
 {{- $name := index . 0 -}}
 {{- $context := index . 1 -}}

charts/tidb-drainer/templates/drainer-statefulset.yaml

@@ -46,6 +46,11 @@ spec:
  mountPath: /data
  - name: config
  mountPath: /etc/drainer
+ {{- if .Values.enableTLSCluster }}
+ - name: drainer-tls
+ mountPath: /var/lib/drainer-tls
+ readOnly: true
+ {{- end }}
  {{- if and (ne .Values.timezone "UTC") (ne .Values.timezone "") }}
  env:
  - name: TZ
@@ -60,6 +65,11 @@ spec:
  items:
  - key: config-file
  path: drainer.toml
+ {{- if .Values.enableTLSCluster }}
+ - name: drainer-tls
+ secret:
+ secretName: {{ include "drainer.tlsSecretName" . }}
+ {{- end }}
  {{- with .Values.nodeSelector }}
  nodeSelector:
 {{ toYaml . | indent 8 }}

charts/tidb-drainer/templates/scripts/_start_drainer.sh.tpl

@@ -26,7 +26,7 @@ done
 
 /drainer \
 -L={{ .Values.logLevel | default "info" }} \
--pd-urls=http://{{ .Values.clusterName }}-pd:2379 \
+-pd-urls={{ include "cluster.scheme" . }}://{{ .Values.clusterName }}-pd:2379 \
 -addr=`echo ${HOSTNAME}`.{{ include "drainer.name" . }}:8249 \
 -config=/etc/drainer/drainer.toml \
 -disable-detect={{ .Values.disableDetect | default false }} \

charts/tidb-drainer/values.yaml

@@ -24,6 +24,11 @@ disableDetect: false
 # if drainer donesn't have checkpoint, use initial commitTS to initial checkpoint
 initialCommitTs: 0
 
+# Whether enable TLS connections between server nodes.
+# When enabled, DRAINER will use TLS encrypted connections to transfer data with PUMP node,
+# certificates will be generated by script "hack/create-cert.sh" manually
+enableTLSCluster: false
+
 # Refer to https://github.com/pingcap/tidb-binlog/blob/master/cmd/drainer/drainer.toml
 config: |
  detect-interval = 10

go.mod

@@ -7,6 +7,7 @@ module github.com/pingcap/tidb-operator
 go 1.13
 
 require (
+ github.com/Azure/go-autorest/autorest/mocks v0.3.0 // indirect
  github.com/BurntSushi/toml v0.3.1
  github.com/MakeNowJust/heredoc v0.0.0-20171113091838-e9091a26100e // indirect
  github.com/Microsoft/go-winio v0.4.12 // indirect
@@ -35,6 +36,7 @@ require (
  github.com/gophercloud/gophercloud v0.3.0 // indirect
  github.com/gregjones/httpcache v0.0.0-20190212212710-3befbb6ad0cc // indirect
  github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4 // indirect
+ github.com/grpc-ecosystem/grpc-gateway v1.13.0 // indirect
  github.com/imdario/mergo v0.3.7 // indirect
  github.com/juju/errors v0.0.0-20180806074554-22422dad46e1
  github.com/juju/loggo v0.0.0-20180524022052-584905176618 // indirect

go.sum

@@ -32,6 +32,8 @@ github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjW
 github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
 github.com/Azure/go-autorest/autorest/mocks v0.2.0 h1:Ww5g4zThfD/6cLb4z6xxgeyDa7QDkizMkJKe0ysZXp0=
 github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/mocks v0.3.0 h1:qJumjCaCudz+OcqE9/XtEPfvtOjOmKaui4EOpFI6zZc=
+github.com/Azure/go-autorest/autorest/mocks v0.3.0/go.mod h1:a8FDP3DYzQ4RYfVAxAN3SVSiiO77gL2j2ronKKP0syM=
 github.com/Azure/go-autorest/autorest/to v0.2.0/go.mod h1:GunWKJp1AEqgMaGLV+iocmRAJWqST1wQYhyyjXJ3SJc=
 github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQvokg3NZAlQTalVMtOIAs1aGK7G6u8=
 github.com/Azure/go-autorest/logger v0.1.0 h1:ruG4BSDXONFRrZZJ2GUXDiUyVpayPmb1GnWeHDdaNKY=
@@ -68,6 +70,7 @@ github.com/Rican7/retry v0.1.0/go.mod h1:FgOROf8P5bebcC1DS0PdOQiqGUridaZvikzUmkF
 github.com/ajg/form v0.0.0-20160822230020-523a5da1a92f/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
 github.com/ant31/crd-validation v0.0.0-20180702145049-30f8a35d0ac2 h1:CDDf61yprxfS7bmBPyhH8pxaobD2VbO3d7laAxJbZos=
 github.com/ant31/crd-validation v0.0.0-20180702145049-30f8a35d0ac2/go.mod h1:X0noFIik9YqfhGYBLEHg8LJKEwy7QIitLQuFMpKLcPk=
+github.com/antihax/optional v0.0.0-20180407024304-ca021399b1a6/go.mod h1:V8iCPQYkqmusNa815XgQio277wI47sdRh1dUOLdyC6Q=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
@@ -459,6 +462,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.3.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpg
 github.com/grpc-ecosystem/grpc-gateway v1.8.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.2 h1:S+ef0492XaIknb8LMjcwgW2i3cNTzDYMmDrOThOJNWc=
 github.com/grpc-ecosystem/grpc-gateway v1.9.2/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/grpc-ecosystem/grpc-gateway v1.13.0 h1:sBDQoHXrOlfPobnKw69FIKa1wg9qsLLvvQ/Y19WtFgI=
+github.com/grpc-ecosystem/grpc-gateway v1.13.0/go.mod h1:8XEsbTttt/W+VvjtQhLACqCisSPWTxCZ7sBRjU6iH9c=
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/golang-lru v0.0.0-20180201235237-0fb14efe8c47/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
@@ -680,6 +685,7 @@ github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446/go.mod h1:uY
 github.com/robfig/cron v1.1.0 h1:jk4/Hud3TTdcrJgUOBgsqrZBarcxl6ADIjSC2iniwLY=
 github.com/robfig/cron v1.1.0/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-charset v0.0.0-20180617210344-2471d30d28b4/go.mod h1:qgYeAmZ5ZIpBWTGllZSQnw97Dj+woV0toclVaRGI8pc=
 github.com/rogpeppe/go-internal v1.0.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.0.1-alpha.3/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@@ -863,6 +869,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297 h1:k7pJ2yAPLPgbskkFdhRCsA77k2fySZ1zf2zCjvQCiIM=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191002035440-2ec189313ef0 h1:2mqDk8w/o6UmeUCu5Qiq2y7iMf6anbx+YA8d1JFoFrs=
+golang.org/x/net v0.0.0-20191002035440-2ec189313ef0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -985,13 +993,17 @@ google.golang.org/genproto v0.0.0-20190508193815-b515fa19cec8/go.mod h1:VzzqZJRn
 google.golang.org/genproto v0.0.0-20190530194941-fb225487d101/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
 google.golang.org/genproto v0.0.0-20190620144150-6af8c5fc6601 h1:9VBRTdmgQxbs6HE0sUnMrSWNePppAJU07NYvX5dIB04=
 google.golang.org/genproto v0.0.0-20190620144150-6af8c5fc6601/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
+google.golang.org/genproto v0.0.0-20190927181202-20e1ac93f88c h1:hrpEMCZ2O7DR5gC1n2AJGVhrwiEjOi35+jxtIuZpTMo=
+google.golang.org/genproto v0.0.0-20190927181202-20e1ac93f88c/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
 google.golang.org/grpc v0.0.0-20180607172857-7a6a684ca69e/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0 h1:AzbTB6ux+okLTzP8Ru1Xs41C303zdcfEht7MQnYJt5A=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.24.0 h1:vb/1TCsVn3DcJlQ0Gs1yB1pKI6Do2/QNwxdKqmc/b0s=
+google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1026,6 +1038,7 @@ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bl
 gopkg.in/yaml.v2 v2.0.0/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gotest.tools v2.1.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=

hack/create-cert.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+usage() {
+ cat <<EOF
+create-cert.sh
+create certification for pump and drainer conponent
+
+ --namespace The namespace of the component
+ --component The name of the component (e.g. pump, drainer)
+ --cluster The TiDB cluster name of the component for
+EOF
+ exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+ case ${1} in
+ --namespace)
+ namespace="$2"
+ shift
+ ;;
+ --component)
+ component="$2"
+ shift
+ ;;
+ --cluster)
+ cluster="$2"
+ shift
+ ;;
+ *)
+ usage
+ ;;
+ esac
+ shift
+done
+
+if [ -z ${namespace} ]; then
+ usage
+fi
+
+if [ -z ${component} ]; then
+ usage
+fi
+
+if [ -z ${cluster} ]; then
+ usage
+fi
+
+service=${cluster}-${component}
+secret=${cluster}-${component}
+
+if [ ! -x "$(command -v openssl)" ]; then
+ echo "openssl not found"
+ exit 1
+fi
+
+csrName=${service}.${namespace}
+tmpdir=$(mktemp -d)
+
+echo ${tmpdir}
+
+cat <<EOF >> ${tmpdir}/csr.conf
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+[req_distinguished_name]
+[ v3_req ]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = ${service}
+DNS.2 = ${service}.${namespace}
+DNS.3 = ${service}.${namespace}.svc
+DNS.4 = *.${service}
+DNS.5 = *.${service}.${namespace}
+DNS.5 = *.${service}.${namespace}.svc
+IP.1 = 127.0.0.1
+EOF
+
+openssl genrsa -out ${tmpdir}/server-key.pem 2048
+openssl req -new -key ${tmpdir}/server-key.pem -subj "/CN=${service}.${namespace}.svc" -out ${tmpdir}/server.csr -config ${tmpdir}/csr.conf
+
+ # clean-up any previously created CSR for our service. Ignore errors if not present.
+kubectl delete csr ${csrName} 2>/dev/null || true
+
+ # create server cert/key CSR and send to k8s API
+cat <<EOF | kubectl create -f -
+apiVersion: certificates.k8s.io/v1beta1
+kind: CertificateSigningRequest
+metadata:
+ name: ${csrName}
+spec:
+ groups:
+ - system:authenticated
+ request: $(cat ${tmpdir}/server.csr | base64 | tr -d '\n')
+ usages:
+ - digital signature
+ - key encipherment
+ - server auth
+ - client auth
+EOF
+
+ # verify CSR has been created
+while true; do
+ kubectl get csr ${csrName}
+ if [ "$?" -eq 0 ]; then
+ break
+ fi
+done
+
+ # approve and fetch the signed certificate
+kubectl certificate approve ${csrName}
+# verify certificate has been signed
+for x in $(seq 10); do
+ serverCert=$(kubectl get csr ${csrName} -o jsonpath='{.status.certificate}')
+ if [[ ${serverCert} != '' ]]; then
+ break
+ fi
+ sleep 1
+done
+if [[ ${serverCert} == '' ]]; then
+ echo "ERROR: After approving csr ${csrName}, the signed certificate did not appear on the resource. Giving up after 10 attempts." >&2
+ exit 1
+fi
+
+ echo ${serverCert} | openssl base64 -d -A -out ${tmpdir}/server-cert.pem
+
+ # create the secret with CA cert and server cert/key
+kubectl create secret generic ${secret} \
+ --from-file=key=${tmpdir}/server-key.pem \
+ --from-file=cert=${tmpdir}/server-cert.pem \
+ --dry-run -o yaml |
+ kubectl -n ${namespace} apply -f -