certificates

const (
	CAFilename      = "ca-bundle.crt"
	CAConfigMapName = "csr-signer-ca"
)

const (
	CertificatePemType = "CERTIFICATE"
	PrivateKeyPemType  = "RSA PRIVATE KEY"
)

const (
	CaSecretName               = "contrail-ca-certificate"
	SignerCAPrivateKeyFilename = "ca-priv-key.pem"
)

const (
	OpenshiftCSRConfigMapName = "csr-controller-ca"
	OpenshiftCSRConfigMapNS   = "openshift-config-managed"

	K8SCSRConfigMapName = "cluster-info"
	K8SCSRConfigMapNS   = "kube-public"
)

const ExternalCAHostPath = "/etc/contrail/ssl/ca-certs"

const ExternalCertHostPath = "/etc/contrail/ssl/certs"

const ExternalSigner = "External"

const SelfSignedCALegacyUnknown = "kubernetes.io/legacy-unknown"

const SelfSigner = "SelfSignedCA"

Signers

1. K8S: NOTE: for now K8S 1.22+ generates certificate with Ext Usages that are incomatible with Contrail kubernetes.io/kubelet-serving force to have only "TLS Web Server Authentication" kubernetes.io/kube-apiserver-client force to have only TLS Web Client Authentication kubernetes.io/kube-apiserver-client-kubelet force to have only TLS Web Client Authentication forbids alt subj extention The above signers dont allow to get both client and servet auth and force to have one of them. As the result it is not possible to use them for Cassandra (and other cluster services like RabbitMQ) that need to have a certificate either with both usages or w/o usages at all. E.g. Cassandra can use only one certificate for inter-node communications where each node is server and client same time.

2. Own SelfSigned CA: SelfSignedCA Will use provided root Key and CA Cert via contrail-ca-certificate Secret. If not provided - generates own self-signed and create Secret.

3. External certificates External Certificates are expected to be generated by external system, e.g. RedHat IDM. It is excpected that - services certificates and keys are placed on host in /etc/contrail/ssl/certs/ with the follwoing name patterns: for certificates: server-${POD_IP}.crt client-${POD_IP}.crt for private keys: server-key-${POD_IP}.pem client-key-${POD_IP}.pem