Dustin C. Hatch
29afcae52e
The `fetchcert` tool is a short shell script that fetches an X.509 certificate and corresponding private key from a Kubernetes Secret, using the Kubernetes API. I originally wrote it for the Frigate server so it could fetch the _pyrocufflink.blue_ wildcard certificate, which is managed by _cert-manager_. Since then, I have adapted it to be more generic, so it will be useful to fetch the _loki.pyrocufflink.blue_ certificate for Grafana Loki. Although the script is rather simple, it does have several required configuration parameters. It needs to know the URL of the Kubernetes API server and have the certificate for the CA that signs the server certificate, as well as an authorization token. It also needs to know the namespace and name of the Secret from which it will fetch the certificate and private key. Finally, needs to know the paths to the files where the fetched data will be written. Generally, after certificates are updated, some action needs to be performed in order to make use of them. This typically involves restarting or reloading a daemon. Since the `fetchcert` tool runs in a container, it can't directly perform those actions, so it simply indicates via a special exit code that the certificate has been updated and some further action may be needed. The `/etc/fetchcert/postupdate.sh` script is executed by _systemd_ after `fetchcert` finishes. If the `EXIT_STATUS` environment variable (which is set by _systemd_ to the return code of the main service process) matches the expected code, the configured post-update actions will be executed.
23 lines
711 B
Plaintext
23 lines
711 B
Plaintext
[Unit]
|
|
Description=Fetch HTTPS certificate from Kubernetes Secret API
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Container]
|
|
Image=git.pyrocufflink.net/containerimages/fetchcert
|
|
Exec={{ fetchcert.namespace }} {{ fetchcert.secret }} /etc/fetchcert/certs/{{ fetchcert.key }} /etc/fetchcert/certs/{{ fetchcert.cert }}
|
|
ReadOnly=yes
|
|
ReadOnlyTmpfs=yes
|
|
Volume=/etc/fetchcert:/etc/fetchcert:ro
|
|
Volume=/etc/fetchcert/certs:/etc/fetchcert/certs:rw,z
|
|
Environment=KUBERNETES_URL={{ fetchcert.kubernetes_url }}
|
|
AddCapability=CAP_CHOWN
|
|
DropCapability=all
|
|
NoNewPrivileges=yes
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
SuccessExitStatus=20
|
|
ExecStartPre=/bin/mkdir -p /etc/fetchcert/certs
|
|
ExecStopPost=-/etc/fetchcert/postupdate.sh
|