mirrors/talos
1
0
Fork 0
mirror of https://github.com/siderolabs/talos.git synced 2025-08-25 16:41:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: generate CA certificates with 1 year expiration

Browse Source 
This changes CA certificate generation from 24 hours to 1 year.

Signed-off-by: Andrew Rynhard <andrew@andrewrynhard.com>
This commit is contained in:
Andrew Rynhard 2019-09-22 10:53:12 -07:00
parent 9ffa064a70
commit fe4fe0849e
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/userdata/generate/generate.go
View File

@ -240,14 +240,22 @@ func NewInput(clustername string, masterIPs []string) (input *Input, err error)
} }
// Generate Kubernetes CA. // Generate Kubernetes CA.
opts := []x509.Option{x509.RSA(true), x509.Organization("talos-k8s")} opts := []x509.Option{
x509.RSA(true),
x509.Organization("talos-k8s"),
x509.NotAfter(time.Now().Add(8760 * time.Hour)),
}
k8sCert, err := x509.NewSelfSignedCertificateAuthority(opts...) k8sCert, err := x509.NewSelfSignedCertificateAuthority(opts...)
if err != nil { if err != nil {
return nil, err return nil, err
} }
// Generate Talos CA. // Generate Talos CA.
opts = []x509.Option{x509.RSA(false), x509.Organization("talos-os")} opts = []x509.Option{
x509.RSA(false),
x509.Organization("talos-os"),
x509.NotAfter(time.Now().Add(8760 * time.Hour)),
}
osCert, err := x509.NewSelfSignedCertificateAuthority(opts...) osCert, err := x509.NewSelfSignedCertificateAuthority(opts...)
if err != nil { if err != nil {
return nil, err return nil, err

13
pkg/userdata/v1alpha1/generate/generate.go
View File

@ -13,6 +13,7 @@ import (
"errors" "errors"
"fmt" "fmt"
"net" "net"
"time"
"github.com/talos-systems/talos/pkg/constants" "github.com/talos-systems/talos/pkg/constants"
"github.com/talos-systems/talos/pkg/crypto/x509" "github.com/talos-systems/talos/pkg/crypto/x509"
@ -252,14 +253,22 @@ func NewInput(clustername string, masterIPs []string) (input *Input, err error)
} }
// Generate Kubernetes CA. // Generate Kubernetes CA.
opts := []x509.Option{x509.RSA(true), x509.Organization("talos-k8s")} opts := []x509.Option{
x509.RSA(true),
x509.Organization("talos-k8s"),
x509.NotAfter(time.Now().Add(8760 * time.Hour)),
}
k8sCert, err := x509.NewSelfSignedCertificateAuthority(opts...) k8sCert, err := x509.NewSelfSignedCertificateAuthority(opts...)
if err != nil { if err != nil {
return nil, err return nil, err
} }
// Generate Talos CA. // Generate Talos CA.
opts = []x509.Option{x509.RSA(false), x509.Organization("talos-os")} opts = []x509.Option{
x509.RSA(false),
x509.Organization("talos-os"),
x509.NotAfter(time.Now().Add(8760 * time.Hour)),
}
osCert, err := x509.NewSelfSignedCertificateAuthority(opts...) osCert, err := x509.NewSelfSignedCertificateAuthority(opts...)
if err != nil { if err != nil {
return nil, err return nil, err