mirror of https://github.com/k3s-io/k3s
Update/rename certs.sh; add default cert rotation script
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>pull/7105/head
Brad Davidson
Brad Davidson
parent
9360022bbe
commit
ca5746785c
|
|
@ -1,127 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# Example K3s CA certificate generation script.
|
||||
#
|
||||
# This script will generate files sufficient to bootstrap K3s cluster certificate
|
||||
# authorities. By default, the script will create the required files under
|
||||
# /var/lib/rancher/k3s/server/tls, where they will be found and used by K3s during initial
|
||||
# cluster startup. Note that these files MUST be present before K3s is started the first
|
||||
# time; certificate data SHOULD NOT be changed once the cluster has been initialized.
|
||||
#
|
||||
# The output path may be overridden with the DATA_DIR environment variable.
|
||||
#
|
||||
# This script will also auto-generate certificates and keys for both root and intermediate
|
||||
# certificate authorities if none are found.
|
||||
# If you have only an existing root CA, provide:
|
||||
# root-ca.pem
|
||||
# root-ca.key.
|
||||
# If you have an existing root and intermediate CA, provide:
|
||||
# root-ca.pem
|
||||
# intermediate-ca.pem
|
||||
# intermediate-ca.key.
|
||||
|
||||
set -e
|
||||
umask 027
|
||||
|
||||
CONFIG="
|
||||
[v3_ca]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints=CA:true"
|
||||
TIMESTAMP=$(date +%s)
|
||||
PRODUCT="${PRODUCT:-k3s}"
|
||||
DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}"
|
||||
|
||||
if type -t openssl-3 &>/dev/null; then
|
||||
OPENSSL=openssl-3
|
||||
else
|
||||
OPENSSL=openssl
|
||||
fi
|
||||
|
||||
echo "Using $(which ${OPENSSL}): $(${OPENSSL} version)"
|
||||
|
||||
if ! ${OPENSSL} ecparam -help &>/dev/null; then
|
||||
echo "openssl not found or missing Elliptic Curve (ecparam) support."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! ${OPENSSL} req -help 2>&1 | grep -q CAkey; then
|
||||
echo "openssl req missing -CAkey support; please use OpenSSL 3.0.0 or newer"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "${DATA_DIR}/server/tls/etcd"
|
||||
cd "${DATA_DIR}/server/tls"
|
||||
|
||||
# Don't overwrite the service account issuer key; we pass the key into both the controller-manager
|
||||
# and the apiserver instead of passing a cert list into the apiserver, so there's no facility for
|
||||
# rotation and things will get very angry if all the SA keys are invalidated.
|
||||
if [[ -e service.key ]]; then
|
||||
echo "Generating additional Kubernetes service account issuer RSA key"
|
||||
OLD_SERVICE_KEY="$(cat service.key)"
|
||||
else
|
||||
echo "Generating Kubernetes service account issuer RSA key"
|
||||
fi
|
||||
${OPENSSL} genrsa -traditional -out service.key 2048
|
||||
echo "${OLD_SERVICE_KEY}" >> service.key
|
||||
|
||||
# Use existing root CA if present
|
||||
if [[ -e root-ca.pem ]]; then
|
||||
echo "Using existing root certificate"
|
||||
else
|
||||
echo "Generating root certificate authority RSA key and certificate"
|
||||
${OPENSSL} genrsa -out root-ca.key 4096
|
||||
${OPENSSL} req -x509 -new -nodes -key root-ca.key -sha256 -days 7300 -out root-ca.pem -subj "/CN=${PRODUCT}-root-ca@${TIMESTAMP}" -config <(echo "${CONFIG}") -extensions v3_ca
|
||||
fi
|
||||
cat root-ca.pem > root-ca.crt
|
||||
|
||||
# Use existing intermediate CA if present
|
||||
if [[ -e intermediate-ca.pem ]]; then
|
||||
echo "Using existing intermediate certificate"
|
||||
else
|
||||
if [[ ! -e root-ca.key ]]; then
|
||||
echo "Cannot generate intermediate certificate without root certificate private key"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Generating intermediate certificate authority RSA key and certificate"
|
||||
${OPENSSL} genrsa -out intermediate-ca.key 4096
|
||||
${OPENSSL} req -x509 -new -nodes -CAkey root-ca.key -CA root-ca.crt -key intermediate-ca.key -sha256 -days 7300 -out intermediate-ca.pem -subj "/CN=${PRODUCT}-intermediate-ca@${TIMESTAMP}" -config <(echo "${CONFIG}, pathlen:1") -extensions v3_ca
|
||||
fi
|
||||
cat intermediate-ca.pem root-ca.pem > intermediate-ca.crt
|
||||
|
||||
if [[ ! -e intermediate-ca.key ]]; then
|
||||
echo "Cannot generate leaf certificates without intermediate certificate private key"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate new leaf CAs for all the control-plane and etcd components
|
||||
echo "Generating Kubernetes server leaf certificate authority EC key and certificate"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -out client-ca.key
|
||||
${OPENSSL} req -x509 -new -nodes -CAkey intermediate-ca.key -CA intermediate-ca.crt -key client-ca.key -sha256 -days 3650 -out client-ca.pem -subj "/CN=${PRODUCT}-client-ca@${TIMESTAMP}" -config <(echo "${CONFIG}, pathlen:0") -extensions v3_ca
|
||||
cat client-ca.pem intermediate-ca.pem root-ca.pem > client-ca.crt
|
||||
|
||||
echo "Generating Kubernetes client leaf certificate authority EC key and certificate"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -out server-ca.key
|
||||
${OPENSSL} req -x509 -new -nodes -CAkey intermediate-ca.key -CA intermediate-ca.crt -key server-ca.key -sha256 -days 3650 -out server-ca.pem -subj "/CN=${PRODUCT}-server-ca@${TIMESTAMP}" -config <(echo "${CONFIG}, pathlen:0") -extensions v3_ca
|
||||
cat server-ca.pem intermediate-ca.pem root-ca.pem > server-ca.crt
|
||||
|
||||
echo "Generating Kubernetes request-header leaf certificate authority EC key and certificate"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -out request-header-ca.key
|
||||
${OPENSSL} req -x509 -new -nodes -CAkey intermediate-ca.key -CA intermediate-ca.crt -key request-header-ca.key -sha256 -days 3560 -out request-header-ca.pem -subj "/CN=${PRODUCT}-request-header-ca@${TIMESTAMP}" -config <(echo "${CONFIG}, pathlen:0") -extensions v3_ca
|
||||
cat request-header-ca.pem intermediate-ca.pem root-ca.pem > request-header-ca.crt
|
||||
|
||||
echo "Generating etcd peer leaf certificate authority EC key and certificate"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -out etcd/peer-ca.key
|
||||
${OPENSSL} req -x509 -new -nodes -CAkey intermediate-ca.key -CA intermediate-ca.crt -key etcd/peer-ca.key -sha256 -days 3650 -out etcd/peer-ca.pem -subj "/CN=etcd-peer-ca@${TIMESTAMP}" -config <(echo "${CONFIG}, pathlen:0") -extensions v3_ca
|
||||
cat etcd/peer-ca.pem intermediate-ca.pem root-ca.pem > etcd/peer-ca.crt
|
||||
|
||||
echo "Generating etcd server leaf certificate authority EC key and certificate"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -out etcd/server-ca.key
|
||||
${OPENSSL} req -x509 -new -nodes -CAkey intermediate-ca.key -CA intermediate-ca.crt -key etcd/server-ca.key -sha256 -days 3650 -out etcd/server-ca.pem -subj "/CN=etcd-server-ca@${TIMESTAMP}" -config <(echo "${CONFIG}, pathlen:0") -extensions v3_ca
|
||||
cat etcd/server-ca.pem intermediate-ca.pem root-ca.pem > etcd/server-ca.crt
|
||||
|
||||
echo
|
||||
echo "CA certificate generation complete. Required files are now present in: ${DATA_DIR}/server/tls"
|
||||
echo "For security purposes, you should make a secure copy of the following files and remove them from cluster members:"
|
||||
ls ${DATA_DIR}/server/tls/root-ca.* ${DATA_DIR}/server/tls/intermediate-ca.* | xargs -n1 echo -e "\t"
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# Example K3s CA certificate generation script.
|
||||
#
|
||||
# This script will generate files sufficient to bootstrap K3s cluster certificate
|
||||
# authorities. By default, the script will create the required files under
|
||||
# /var/lib/rancher/k3s/server/tls, where they will be found and used by K3s during initial
|
||||
# cluster startup. Note that these files MUST be present before K3s is started the first
|
||||
# time; certificate data SHOULD NOT be changed once the cluster has been initialized.
|
||||
#
|
||||
# The output path may be overridden with the DATA_DIR environment variable.
|
||||
#
|
||||
# This script will also auto-generate certificates and keys for both root and intermediate
|
||||
# certificate authorities if none are found.
|
||||
# If you have only an existing root CA, provide:
|
||||
# root-ca.pem
|
||||
# root-ca.key.
|
||||
# If you have an existing root and intermediate CA, provide:
|
||||
# root-ca.pem
|
||||
# intermediate-ca.pem
|
||||
# intermediate-ca.key.
|
||||
|
||||
set -e
|
||||
umask 027
|
||||
|
||||
TIMESTAMP=$(date +%s)
|
||||
PRODUCT="${PRODUCT:-k3s}"
|
||||
DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}"
|
||||
|
||||
if type -t openssl-3 &>/dev/null; then
|
||||
OPENSSL=openssl-3
|
||||
else
|
||||
OPENSSL=openssl
|
||||
fi
|
||||
|
||||
echo "Using $(type -p ${OPENSSL}): $(${OPENSSL} version)"
|
||||
|
||||
if ! ${OPENSSL} ecparam -name prime256v1 -genkey -noout -out /dev/null &>/dev/null; then
|
||||
echo "openssl not found or missing Elliptic Curve (ecparam) support."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
${OPENSSL} version | grep -qF 'OpenSSL 3' && OPENSSL_GENRSA_FLAGS=-traditional
|
||||
|
||||
mkdir -p "${DATA_DIR}/server/tls/etcd"
|
||||
cd "${DATA_DIR}/server/tls"
|
||||
|
||||
# Set up temporary openssl configuration
|
||||
mkdir -p ".ca/certs"
|
||||
trap "rm -rf .ca" EXIT
|
||||
touch .ca/index
|
||||
openssl rand -hex 8 > .ca/serial
|
||||
cat >.ca/config <<'EOF'
|
||||
[ca]
|
||||
default_ca = ca_default
|
||||
[ca_default]
|
||||
dir = ./.ca
|
||||
database = $dir/index
|
||||
serial = $dir/serial
|
||||
new_certs_dir = $dir/certs
|
||||
default_md = sha256
|
||||
policy = policy_anything
|
||||
[policy_anything]
|
||||
commonName = supplied
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
[req_distinguished_name]
|
||||
[v3_ca]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always
|
||||
basicConstraints = critical, CA:true
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign
|
||||
EOF
|
||||
|
||||
# Don't overwrite the service account issuer key; we pass the key into both the controller-manager
|
||||
# and the apiserver instead of passing a cert list into the apiserver, so there's no facility for
|
||||
# rotation and things will get very angry if all the SA keys are invalidated.
|
||||
if [[ -e service.key ]]; then
|
||||
echo "Generating additional Kubernetes service account issuer RSA key"
|
||||
OLD_SERVICE_KEY="$(cat service.key)"
|
||||
else
|
||||
echo "Generating Kubernetes service account issuer RSA key"
|
||||
fi
|
||||
${OPENSSL} genrsa ${OPENSSL_GENRSA_FLAGS:-} -out service.key 2048
|
||||
echo "${OLD_SERVICE_KEY}" >> service.key
|
||||
|
||||
# Use existing root CA if present
|
||||
if [[ -e root-ca.pem ]]; then
|
||||
echo "Using existing root certificate"
|
||||
else
|
||||
echo "Generating root certificate authority RSA key and certificate"
|
||||
${OPENSSL} genrsa ${OPENSSL_GENRSA_FLAGS:-} -out root-ca.key 4096
|
||||
${OPENSSL} req -x509 -new -nodes -sha256 -days 7300 \
|
||||
-subj "/CN=${PRODUCT}-root-ca@${TIMESTAMP}" \
|
||||
-key root-ca.key \
|
||||
-out root-ca.pem \
|
||||
-config .ca/config \
|
||||
-extensions v3_ca
|
||||
fi
|
||||
cat root-ca.pem > root-ca.crt
|
||||
|
||||
# Use existing intermediate CA if present
|
||||
if [[ -e intermediate-ca.pem ]]; then
|
||||
echo "Using existing intermediate certificate"
|
||||
else
|
||||
if [[ ! -e root-ca.key ]]; then
|
||||
echo "Cannot generate intermediate certificate without root certificate private key"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Generating intermediate certificate authority RSA key and certificate"
|
||||
${OPENSSL} genrsa ${OPENSSL_GENRSA_FLAGS:-} -out intermediate-ca.key 4096
|
||||
${OPENSSL} req -new -nodes \
|
||||
-subj "/CN=${PRODUCT}-intermediate-ca@${TIMESTAMP}" \
|
||||
-key intermediate-ca.key |
|
||||
${OPENSSL} ca -batch -notext -days 3700 \
|
||||
-in /dev/stdin \
|
||||
-out intermediate-ca.pem \
|
||||
-keyfile root-ca.key \
|
||||
-cert root-ca.pem \
|
||||
-config .ca/config \
|
||||
-extensions v3_ca
|
||||
fi
|
||||
cat intermediate-ca.pem root-ca.pem > intermediate-ca.crt
|
||||
|
||||
if [[ ! -e intermediate-ca.key ]]; then
|
||||
echo "Cannot generate leaf certificates without intermediate certificate private key"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate new leaf CAs for all the control-plane and etcd components
|
||||
for TYPE in client server request-header etcd/peer etcd/server; do
|
||||
CERT_NAME="${PRODUCT}-$(echo ${TYPE} | tr / -)-ca"
|
||||
echo "Generating ${CERT_NAME} leaf certificate authority EC key and certificate"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -noout -out ${TYPE}-ca.key
|
||||
${OPENSSL} req -new -nodes \
|
||||
-subj "/CN=${CERT_NAME}@${TIMESTAMP}" \
|
||||
-key ${TYPE}-ca.key |
|
||||
${OPENSSL} ca -batch -notext -days 3700 \
|
||||
-in /dev/stdin \
|
||||
-out ${TYPE}-ca.pem \
|
||||
-keyfile intermediate-ca.key \
|
||||
-cert intermediate-ca.pem \
|
||||
-config .ca/config \
|
||||
-extensions v3_ca
|
||||
cat ${TYPE}-ca.pem \
|
||||
intermediate-ca.pem \
|
||||
root-ca.pem > ${TYPE}-ca.crt
|
||||
done
|
||||
|
||||
echo
|
||||
echo "CA certificate generation complete. Required files are now present in: ${DATA_DIR}/server/tls"
|
||||
echo "For security purposes, you should make a secure copy of the following files and remove them from cluster members:"
|
||||
ls ${DATA_DIR}/server/tls/root-ca.* ${DATA_DIR}/server/tls/intermediate-ca.* | xargs -n1 echo -e "\t"
|
||||
|
||||
if [ "${DATA_DIR}" != "/var/lib/rancher/${PRODUCT}" ]; then
|
||||
echo
|
||||
echo "To update certificates on an existing cluster, you may now run:"
|
||||
echo " k3s certificate rotate-ca --path=${DATA_DIR}/server"
|
||||
fi
|
||||
|
|
@ -0,0 +1,134 @@
|
|||
#!/usr/bin/env bash
|
||||
set -e
|
||||
umask 027
|
||||
|
||||
# Example K3s self-signed CA rotation script.
|
||||
#
|
||||
# This script will generate new self-signed root CA certificates, and cross-sign them with the
|
||||
# current self-signed root CA certificates. It will then generate new leaf CA certificates
|
||||
# signed by the new self-signed/cross-signed root CAs. The resulting cluster CA bundle will
|
||||
# allow existing certificates to be trusted up until the original root CAs expire.
|
||||
#
|
||||
CONFIG="
|
||||
[v3_ca]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints=CA:true"
|
||||
TIMESTAMP=$(date +%s)
|
||||
PRODUCT="${PRODUCT:-k3s}"
|
||||
DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}"
|
||||
TEMP_DIR="${DATA_DIR}/server/rotate-ca"
|
||||
|
||||
if type -t openssl-3 &>/dev/null; then
|
||||
OPENSSL=openssl-3
|
||||
else
|
||||
OPENSSL=openssl
|
||||
fi
|
||||
|
||||
echo "Using $(type -p ${OPENSSL}): $(${OPENSSL} version)"
|
||||
|
||||
if ! ${OPENSSL} ecparam -name prime256v1 -genkey -out /dev/null &>/dev/null; then
|
||||
echo "openssl not found or missing Elliptic Curve (ecparam) support."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
${OPENSSL} version | grep -qF 'OpenSSL 3' && OPENSSL_GENRSA_FLAGS=-traditional
|
||||
|
||||
mkdir -p ${TEMP_DIR}/tls/etcd
|
||||
cd ${TEMP_DIR}/tls
|
||||
|
||||
# Set up temporary openssl configuration
|
||||
mkdir -p ".ca/certs"
|
||||
trap "rm -rf .ca" EXIT
|
||||
touch .ca/index
|
||||
openssl rand -hex 8 > .ca/serial
|
||||
cat >.ca/config <<'EOF'
|
||||
[ca]
|
||||
default_ca = ca_default
|
||||
[ca_default]
|
||||
dir = ./.ca
|
||||
database = $dir/index
|
||||
serial = $dir/serial
|
||||
new_certs_dir = $dir/certs
|
||||
default_md = sha256
|
||||
policy = policy_anything
|
||||
[policy_anything]
|
||||
commonName = supplied
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
[req_distinguished_name]
|
||||
[v3_ca]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always
|
||||
basicConstraints = critical, CA:true
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign
|
||||
EOF
|
||||
|
||||
for TYPE in client server request-header etcd/peer etcd/server; do
|
||||
if [ ! -f ${DATA_DIR}/server/tls/${TYPE}-ca.crt ]; then
|
||||
echo "Current ${TYPE} CA cert does not exist; cannot continue"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$(grep -cF 'END CERTIFICATE' ${DATA_DIR}/server/tls/${TYPE}-ca.crt)" -gt "1" ]; then
|
||||
awk 'BEGIN { RS = "-----END CERTIFICATE-----\n" } NR==2 { print $0 RS }' ${DATA_DIR}/server/tls/${TYPE}-ca.crt > ${TYPE}-root-old.pem
|
||||
awk 'BEGIN { RS = "-----END EC PRIVATE KEY-----\n" } NR==2 { print $0 RS }' ${DATA_DIR}/server/tls/${TYPE}-ca.key > ${TYPE}-root-old.key
|
||||
else
|
||||
cat ${DATA_DIR}/server/tls/${TYPE}-ca.crt > ${TYPE}-root-old.pem
|
||||
cat ${DATA_DIR}/server/tls/${TYPE}-ca.key > ${TYPE}-root-old.key
|
||||
fi
|
||||
|
||||
CERT_NAME="${PRODUCT}-$(echo ${TYPE} | tr / -)-root"
|
||||
echo "Generating ${CERT_NAME} root and cross-signed certificate authority key and certificates"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -noout -out ${TYPE}-root.key
|
||||
${OPENSSL} req -x509 -new -nodes -sha256 -days 7300 \
|
||||
-subj "/CN=${CERT_NAME}@${TIMESTAMP}" \
|
||||
-key ${TYPE}-root.key \
|
||||
-out ${TYPE}-root-ssigned.pem \
|
||||
-config ./.ca/config \
|
||||
-extensions v3_ca
|
||||
${OPENSSL} req -new -nodes \
|
||||
-subj "/CN=${CERT_NAME}@${TIMESTAMP}" \
|
||||
-key ${TYPE}-root.key |
|
||||
${OPENSSL} ca -batch -notext -days 7300 \
|
||||
-in /dev/stdin \
|
||||
-out ${TYPE}-root-xsigned.pem \
|
||||
-keyfile ${TYPE}-root-old.key \
|
||||
-cert ${TYPE}-root-old.pem \
|
||||
-config ./.ca/config \
|
||||
-extensions v3_ca
|
||||
CERT_NAME="${PRODUCT}-$(echo ${TYPE} | tr / -)-ca"
|
||||
echo "Generating ${CERT_NAME} intermediate certificate authority key and certificates"
|
||||
${OPENSSL} ecparam -name prime256v1 -genkey -noout -out ${TYPE}-ca.key
|
||||
${OPENSSL} req -new -nodes \
|
||||
-subj "/CN=${CERT_NAME}@${TIMESTAMP}" \
|
||||
-key ${TYPE}-ca.key |
|
||||
${OPENSSL} ca -batch -notext -days 7300 \
|
||||
-in /dev/stdin \
|
||||
-out ${TYPE}-ca.pem \
|
||||
-keyfile ${TYPE}-root.key \
|
||||
-cert ${TYPE}-root-ssigned.pem \
|
||||
-config ./.ca/config \
|
||||
-extensions v3_ca
|
||||
|
||||
cat ${TYPE}-ca.pem \
|
||||
${TYPE}-root-ssigned.pem \
|
||||
${TYPE}-root-xsigned.pem \
|
||||
${TYPE}-root-old.pem > ${TYPE}-ca.crt
|
||||
cat ${TYPE}-root.key >> ${TYPE}-ca.key
|
||||
done
|
||||
|
||||
${OPENSSL} genrsa ${OPENSSL_GENRSA_FLAGS:-} -out service.key 2048
|
||||
cat ${DATA_DIR}/server/tls/service.key >> service.key
|
||||
|
||||
export SERVER_CA_HASH=$(${OPENSSL} x509 -noout -fingerprint -sha256 -in server-ca.pem | awk -F= '{ gsub(/:/, "", $2); print tolower($2) }')
|
||||
SERVER_TOKEN=$(awk -F:: '{print "K10" ENVIRON["SERVER_CA_HASH"] FS $2}' ${DATA_DIR}/server/token)
|
||||
AGENT_TOKEN=$(awk -F:: '{print "K10" ENVIRON["SERVER_CA_HASH"] FS $2}' ${DATA_DIR}/server/agent-token)
|
||||
|
||||
echo
|
||||
echo "Cross-signed CA certs and keys now available in ${TEMP_DIR}"
|
||||
echo "Updated server token: ${SERVER_TOKEN}"
|
||||
echo "Updated agent token: ${AGENT_TOKEN}"
|
||||
echo
|
||||
echo "To update certificates, you may now run:"
|
||||
echo " k3s certificate rotate-ca --path=${TEMP_DIR}"
|
||||
|
|
@ -28,7 +28,7 @@ cluster-pre-hook() {
|
|||
rancher/mirrored-pause:3.6 \
|
||||
>/dev/null
|
||||
|
||||
DATA_DIR="$TEST_DIR/pause/0/k3s" ./contrib/util/certs.sh
|
||||
DATA_DIR="$TEST_DIR/pause/0/k3s" ./contrib/util/generate-custom-ca-certs.sh
|
||||
docker cp "$TEST_DIR/pause/0/k3s" $name:/var/lib/rancher
|
||||
}
|
||||
export -f cluster-pre-hook
|
||||
|
|
|
|||
Loading…
Reference in New Issue