102 lines
3.7 KiB
Makefile
102 lines
3.7 KiB
Makefile
#------------------------------------------------------------------------
|
|
# variables: root CA
|
|
ROOTCA_DAYS ?= 3650
|
|
ROOTCA_KEYSZ ?= 4096
|
|
ROOTCA_ORG ?= Istio
|
|
ROOTCA_CN ?= Root CA
|
|
KUBECONFIG ?= $(HOME)/.kube/config
|
|
ISTIO_NAMESPACE ?= istio-system
|
|
# Additional variables are defined in root-ca.conf target below.
|
|
|
|
#------------------------------------------------------------------------
|
|
# variables: intermediate CA
|
|
INTERMEDIATE_DAYS ?= 3650
|
|
INTERMEDIATE_KEYSZ ?= 4096
|
|
INTERMEDIATE_ORG ?= Istio
|
|
INTERMEDIATE_CN ?= Intermediate CA
|
|
INTERMEDIATE_SAN_DNS ?= istiod.istio-system.svc
|
|
# Additional variables are defined in %/intermediate.conf target below.
|
|
|
|
#------------------------------------------------------------------------
|
|
# variables: workload certs: eg VM
|
|
WORKLOAD_DAYS ?= 1
|
|
SERVICE_ACCOUNT ?= default
|
|
WORKLOAD_CN ?= Workload
|
|
|
|
#------------------------------------------------------------------------
|
|
# variables: files to clean
|
|
FILES_TO_CLEAN+=k8s-root-cert.pem \
|
|
k8s-root-cert.srl \
|
|
k8s-root-key.pem root-ca.conf root-cert.csr root-cert.pem root-cert.srl root-key.pem
|
|
#------------------------------------------------------------------------
|
|
# clean
|
|
.PHONY: clean
|
|
|
|
clean: ## Cleans all the intermediate files and folders previously generated.
|
|
@rm -f $(FILES_TO_CLEAN)
|
|
|
|
root-ca.conf:
|
|
@echo "[ req ]" > $@
|
|
@echo "encrypt_key = no" >> $@
|
|
@echo "prompt = no" >> $@
|
|
@echo "utf8 = yes" >> $@
|
|
@echo "default_md = sha256" >> $@
|
|
@echo "default_bits = $(ROOTCA_KEYSZ)" >> $@
|
|
@echo "req_extensions = req_ext" >> $@
|
|
@echo "x509_extensions = req_ext" >> $@
|
|
@echo "distinguished_name = req_dn" >> $@
|
|
@echo "[ req_ext ]" >> $@
|
|
@echo "subjectKeyIdentifier = hash" >> $@
|
|
@echo "basicConstraints = critical, CA:true" >> $@
|
|
@echo "keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign" >> $@
|
|
@echo "[ req_dn ]" >> $@
|
|
@echo "O = $(ROOTCA_ORG)" >> $@
|
|
@echo "CN = $(ROOTCA_CN)" >> $@
|
|
|
|
%/intermediate.conf: L=$(dir $@)
|
|
%/intermediate.conf:
|
|
@echo "[ req ]" > $@
|
|
@echo "encrypt_key = no" >> $@
|
|
@echo "prompt = no" >> $@
|
|
@echo "utf8 = yes" >> $@
|
|
@echo "default_md = sha256" >> $@
|
|
@echo "default_bits = $(INTERMEDIATE_KEYSZ)" >> $@
|
|
@echo "req_extensions = req_ext" >> $@
|
|
@echo "x509_extensions = req_ext" >> $@
|
|
@echo "distinguished_name = req_dn" >> $@
|
|
@echo "[ req_ext ]" >> $@
|
|
@echo "subjectKeyIdentifier = hash" >> $@
|
|
@echo "basicConstraints = critical, CA:true, pathlen:0" >> $@
|
|
@echo "keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign" >> $@
|
|
@echo "subjectAltName=@san" >> $@
|
|
@echo "[ san ]" >> $@
|
|
@echo "DNS.1 = $(INTERMEDIATE_SAN_DNS)" >> $@
|
|
@echo "[ req_dn ]" >> $@
|
|
@echo "O = $(INTERMEDIATE_ORG)" >> $@
|
|
@echo "CN = $(INTERMEDIATE_CN)" >> $@
|
|
@echo "L = $(L:/=)" >> $@
|
|
|
|
%/workload.conf: L=$(dir $@)
|
|
%/workload.conf:
|
|
@echo "[ req ]" > $@
|
|
@echo "encrypt_key = no" >> $@
|
|
@echo "prompt = no" >> $@
|
|
@echo "utf8 = yes" >> $@
|
|
@echo "default_md = sha256" >> $@
|
|
@echo "default_bits = $(INTERMEDIATE_KEYSZ)" >> $@
|
|
@echo "req_extensions = req_ext" >> $@
|
|
@echo "x509_extensions = req_ext" >> $@
|
|
@echo "distinguished_name = req_dn" >> $@
|
|
@echo "[ req_ext ]" >> $@
|
|
@echo "subjectKeyIdentifier = hash" >> $@
|
|
@echo "basicConstraints = critical, CA:false" >> $@
|
|
@echo "keyUsage = digitalSignature, keyEncipherment" >> $@
|
|
@echo "extendedKeyUsage = serverAuth, clientAuth" >> $@
|
|
@echo "subjectAltName=@san" >> $@
|
|
@echo "[ san ]" >> $@
|
|
@echo "URI.1 = spiffe://cluster.local/ns/$(L)sa/$(SERVICE_ACCOUNT)" >> $@
|
|
@echo "[ req_dn ]" >> $@
|
|
@echo "O = $(INTERMEDIATE_ORG)" >> $@
|
|
@echo "CN = $(WORKLOAD_CN)" >> $@
|
|
@echo "L = $(L:/=)" >> $@
|