k8s-gen-certs.sh

#!/bin/bash

NAMESPACE=usecaseapp
SERVICE=usecaseapp

cat <<EOF | cfssl genkey - | cfssljson -bare server
{
  "hosts": [
    "${SERVICE}.${NAMESPACE}.svc.cluster.local"
  ],
  "CN": "${SERVICE}.${NAMESPACE}.svc.cluster.local",
  "key": {
    "algo": "ecdsa",
    "size": 256
  }
}
EOF

cat <<EOF | kubectl -n ${NAMESPACE} create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: ${SERVICE}.${NAMESPACE}
spec:
  groups:
  - system:authenticated
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF

kubectl -n ${NAMESPACE} certificate approve ${SERVICE}.${NAMESPACE}
kubectl -n ${NAMESPACE} get csr ${SERVICE}.${NAMESPACE} -o jsonpath='{.status.certificate}' \
    | base64 --decode > server.crt

kubectl -n ${NAMESPACE} create secret generic ${SERVICE}-keys --from-file=cert.pem=server.crt --from-file=key.pem=server-key.pem

exit $?