dobiadi/minikube-setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add webhook cert auto-rotating

Browse Source
This commit is contained in:
dobiadi
2025-09-23 23:49:51 +02:00
parent 8a9425b150
commit 9dce6c79ea
10 changed files with 199 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
linkerd/init.sh
View File

@@ -7,3 +7,22 @@ step-cli certificate create root.linkerd.cluster.local ca.crt ca.key \
--namespace=linkerd &&
yq e -i '.["linkerd-control-plane"].identityTrustAnchorsPEM=load_str("ca.crt")' values.yaml &&
rm ca.crt ca.key
step-cli certificate create webhook.linkerd.cluster.local webhook_ca.crt webhook_ca.key \
--profile root-ca --no-password --insecure --san webhook.linkerd.cluster.local &&
kubectl create secret tls \
webhook-issuer-tls \
--cert=webhook_ca.crt \
--key=webhook_ca.key \
--namespace=linkerd &&
kubectl create secret tls \
webhook-issuer-tls \
--cert=webhook_ca.crt \
--key=webhook_ca.key \
--namespace=linkerd-viz &&
yq e -i '.["linkerd-control-plane"].policyValidator.caBundle=load_str("webhook_ca.crt")' values.yaml &&
yq e -i '.["linkerd-control-plane"].proxyInjector.caBundle=load_str("webhook_ca.crt")' values.yaml &&
yq e -i '.["linkerd-control-plane"].profileValidator.caBundle=load_str("webhook_ca.crt")' values.yaml &&
yq e -i '.["linkerd-viz"].tap.caBundle=load_str("webhook_ca.crt")' ../linkerd-viz/values.yaml &&
yq e -i '.["linkerd-viz"].tapInjector.caBundle=load_str("webhook_ca.crt")' ../linkerd-viz/values.yaml &&
rm webhook_ca.crt webhook_ca.key