Skip to content

Commit 9b9139c

Browse files
rossigeerossigee
committed
Initial version.
0 parents  commit 9b9139c

File tree

18 files changed

+591
-0
lines changed

18 files changed

+591
-0
lines changed

‎.github/workflows/build-publish.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Build and Publish
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v[0-9]+.[0-9]+.[0-9]+' # Trigger on tags with semantic versioning
7+
8+
jobs:
9+
build:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout code
14+
uses: actions/checkout@v2
15+
16+
- name: Set up Go
17+
uses: actions/setup-go@v2
18+
with:
19+
go-version: 1.20 # Use the Go version you need
20+
21+
- name: Build
22+
run: go build -o fetch-k8s-cert
23+
24+
- name: Package for Debian
25+
run: |
26+
mkdir -p debian/fetch-k8s-cert/usr/local/bin
27+
cp fetch-k8s-cert debian/fetch-k8s-cert/usr/local/bin
28+
dpkg-deb --build debian
29+
mv debian.deb fetch-k8s-cert.deb
30+
31+
- name: Create Release
32+
id: create_release
33+
uses: actions/create-release@v1
34+
env:
35+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+
with:
37+
tag_name: ${{ github.ref }}
38+
release_name: Release ${{ github.ref }}
39+
draft: false
40+
prerelease: false
41+
42+
- name: Upload Release Assets
43+
id: upload-release-assets
44+
uses: actions/upload-release-asset@v1
45+
env:
46+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
47+
with:
48+
upload_url: ${{ steps.create_release.outputs.upload_url }}
49+
asset_path: |
50+
fetch-k8s-cert
51+
fetch-k8s-cert.deb
52+
asset_name: |
53+
fetch-k8s-cert
54+
fetch-k8s-cert.deb
55+
asset_content_type: application/octet-stream

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
fetch-k8s-cert
2+
config.yaml

‎LICENSE‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Public domain. Do whatever you like.

‎README.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Fetch K8s Certificate
2+
3+
This program is designed to be run on a regulary schedule to poll a K8S cluster for changes to a given TLS certificate resource. Briefly, this tool reads a YAML configuration file, connects to a Kubernetes API using credentials configured, fetches the contents of a TLS Certificate resource, compares it to a local file, and triggers a reload command if the contents have changed.
4+
5+
The primary use case for this tool is to allow `cert-manager` to manage the lifecycle of the certificates on a Kubernetes cluster, but a non-K8S instance can use this tool to retrieve the latest copy of the TLS keypair from cluster and manage it locally. A local process (for example, 'haproxy') can then use the TLS certificate for client or server authentication.
6+
7+
## Basic usage
8+
9+
Build the binary...
10+
11+
```
12+
go build
13+
```
14+
15+
Create a configuration file in YAML format with the following fields:
16+
17+
```yaml
18+
# URL of the Kubernetes API
19+
k8sAPIURL: https://your.cluster.address:6443
20+
21+
# Base64-encoded authentication token
22+
token: jwt_token_from_service_account
23+
24+
# Kubernetes namespace where the certificate is located
25+
namespace: internal
26+
27+
# Name of the certificate resource
28+
certName: internal-tls
29+
30+
# Path to the local certificate file.
31+
localFilePath: /etc/pki/tls/internal-tls.pem
32+
33+
# Command to trigger a service reload.
34+
reloadCommand: "echo 'The cert changed.'"
35+
36+
# Path to the CA file for the K8S API server
37+
#caCertFilePath: /etc/pki/tls/ca.crt
38+
39+
# Enable to skip TLS verification of the K8S API server
40+
skipTLSVerification: true
41+
```
42+
43+
Run the binary...
44+
45+
```
46+
./fetch-k8s-cert -f config.yaml
47+
```

‎debian/changelog‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
fetch-k8s-cert (1.0-1) unstable; urgency=medium
2+
3+
* Initial release.
4+
5+
-- Ross Golder <[email protected]> Tue, 15 Aug 2023 22:42:30 +0700

‎debian/compat‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
12

‎debian/control‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Source: fetch-k8s-cert
2+
Section: misc
3+
Priority: optional
4+
Maintainer: Ross Golder <[email protected]>
5+
Build-Depends: debhelper (>= 10)
6+
Standards-Version: 3.9.8
7+
Homepage: https://github.com/rossigee/fetch-k8s-cert
8+
9+
Package: fetch-k8s-cert
10+
Architecture: amd64
11+
Depends: ${shlibs:Depends}, ${misc:Depends}
12+
Description: Small tool to mirror a K8S Certificate resource to a local PEM file

‎debian/debhelper-build-stamp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
fetch-k8s-cert

‎debian/fetch-k8s-cert.install‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
fetch-k8s-cert usr/bin/
2+
systemd/fetch-k8s-cert.service usr/lib/systemd/system/
3+
systemd/fetch-k8s-cert.timer usr/lib/systemd/system/
4+
README.md usr/share/doc/fetch-k8s-cert/
5+
LICENSE usr/share/doc/fetch-k8s-cert/

‎debian/fetch-k8s-cert.substvars‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
shlibs:Depends=libc6 (>= 2.34)
2+
misc:Depends=
3+
misc:Pre-Depends=

0 commit comments

Comments
 (0)