<p>Ok, So I am defiantly not a security expert and battling with this for a few days now, </p>

<p>I am using the Coreos <code>kube-aws</code> cloud-formation template maker, and i want to deploy my cluster to production but because of this little comment:</p>

<blockquote>
  <p>PRODUCTION NOTE: the TLS keys and certificates generated by kube-aws should not be used to deploy a production Kubernetes cluster. Each component certificate is only valid for 90 days, while the CA is valid for 365 days. If deploying a production Kubernetes cluster, consider establishing PKI independently of this tool first</p>
</blockquote>

<p>I need to generate my own keys, but I don't seem to understand how to do that, their documentation (IMHO as someone who's not an expert) is seriously outrageous if you are not a familiar with. </p>

<p><strong>So my requirements are like so:</strong></p>

<ol>
<li>I would like to cert/keys to last for X years (long time)</li>
<li>I would like them to be valid for the entire domain *.company.com (I dont care for the internals just for the admin key for kubectl) </li>
<li>I would like to repeat the process 2 times (once for production, and once for QA/Staging) and eventually have 2 sets of credentials</li>
<li>override the default credentials and use <code>kube-aws up --export</code> to get the <code>userdata</code> i need for my cluster</li>
</ol>

<p><strong>My problems are:</strong></p>

<ol>
<li>how to make the admin cert valid for *.company.com</li>
<li>In the documentation they say that you need to create a <code>key-pair</code> for each node in the cluster... WHAT! <code>kube-aws render</code> generates only 1 worker <code>key-pair</code> so whats up with that!</li>
</ol>

<p>Well now for the "fun" part:</p>

<blockquote>
<pre><code>$ openssl genrsa -out ca-key.pem 2048
$ openssl req -x509 -new -nodes -key ca-key.pem -days 10000 -out ca.pem -subj "/CN=kube-ca"
</code></pre>
</blockquote>

<p>I guess that the <code>-days 10000</code> solves my first problem with the expiration. cool</p>

<p><strong>API-SERVER key pair</strong> </p>

<p>openssl.cnf</p>

<blockquote>
<pre><code>  [req]
    req_extensions = v3_req
    distinguished_name = req_distinguished_name
    [req_distinguished_name]
    [ v3_req ]
    basicConstraints = CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    subjectAltName = @alt_names
    [alt_names]
    DNS.1 = kubernetes
    DNS.2 = kubernetes.default
    DNS.3 = kubernetes.default.svc
    DNS.4 = kubernetes.default.svc.cluster.local
    is it
    DNS.5 = mycompany.com
    or
    DNS.5 = *.mycompany.com
    IP.1 = 10.3.0.1
    IP.2 = 10.0.0.50
</code></pre>
</blockquote>

<p>and run the commands</p>

<blockquote>
<pre><code>$ openssl genrsa -out apiserver-key.pem 2048
$ openssl req -new -key apiserver-key.pem -out apiserver.csr -subj "/CN=kube-apiserver" -config openssl.cnf
$ openssl x509 -req -in apiserver.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out apiserver.pem -days 3650 -extensions v3_req -extfile openssl.cnf
</code></pre>
</blockquote>

<p>Fine, besides the <code>subjectAltName</code> which I don't know how to use i could have made a few attempts to see what works its cool.</p>

<p><strong>Worker Keypairs</strong></p>

<p>Here is where I am really stuck, what am I supposed to do with this sentence:</p>

<pre><code>This procedure generates a unique TLS certificate for every Kubernetes worker node in your cluster
</code></pre>

<p>Fine security and all but this is really unrealistic and overkill IMO on an amazon autoscaling group</p>

<p>So in case I don't want to have a key for each node but 1 key for all, how does my <code>worker-openssl.cnf</code> should look????</p>

<blockquote>
<pre><code>[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
IP.1 = $ENV::WORKER_IP &lt;- what am i supposed to do here?
</code></pre>
</blockquote>

<p>after this creating the admin key pair is straight forward.</p>

<p>please help! </p>

<p>I was able to get it to work with this <code>worker-openssl.conf</code> using the <strong>the same certificate</strong> for all workers. Probably not the most secure setup.</p>

<pre><code>[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.*.cluster.internal
</code></pre>
