Christian Hercules cxhercules

How to create a self-signed SSL Certificate with SubjectAltName(SAN)

After Chrome 58, self-signed certificate without SAN is not valid anymore.

Step 1: Generate a Private Key

openssl genrsa -des3 -out example.com.key 2048

Step 2: Generate a CSR (Certificate Signing Request)

You need to use a tpl trick to interpolate the value, since helm variable in values are not processed, you have to update your deployment, for example:

In your values.yaml:

  tag: "{{ .Chart.AppVersion }}"

In your deployment:

 image: "{{ .Values.api.image.repository }}:{{ tpl .Values.api.image.tag . }}"

Read from vault without saving secret value

vault read -field=value "secret/gcp-creds/${SERVICE_ACCOUNT_PROJECT_ID}/${SERVICE_ACCOUNT_NAME}.json" \
  | gcloud auth activate-service-account "${SERVICE_ACCOUNT_EMAIL}" --key-file -

	# Drain and delete the nodes (for each node you have)
	kubectl drain kubenode1 --delete-local-data --force --ignore-daemonsets
	kubectl delete node kubenode1

	# Reset the deployment
	sudo kubeadm reset

	# On each node

	## Reset the nodes and weave

	#!/bin/bash

	apt-get update
	apt-get install -y git wget

	# Install Docker
	apt-get install \
	apt-transport-https \
	ca-certificates \
	curl \

	VBoxManage controlvm minikube natpf1 k8s-apiserver,tcp,127.0.0.1,8443,,8443
	kubectl config set-cluster minikube-vpn --server=https://127.0.0.1:8443 --insecure-skip-tls-verify
	kubectl config set-context minikube-vpn --cluster=minikube-vpn --user=minikube
	kubectl config use-context minikube-vpn
	VBoxManage controlvm minikube natpf1 k8s-dashboard,tcp,127.0.0.1,30000,,30000

	VBoxManage controlvm minikube natpf1 docker,tcp,127.0.0.1,2376,,2376

	minikube docker-env\|sed 's/192.168.99.101/127.0.0.1/'

	#!/bin/bash

	cat secrets-alone.yml \|awk -F: '{ printf "export %s=",$1; system ("echo "$2"\|base64 -d "); system("echo")}'


	openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -pubkey \| openssl rsa -pubin -outform DER 2>/dev/null \| sha256sum \| cut -d' ' -f1

	Reference:
	https://github.com/kubernetes/kubeadm/issues/659#issuecomment-392822587