generate-etcd-certs

#!/bin/sh

set -e -x

function usage() {
  >&2 echo "    Usage:
    $0 ETCD_PEER_CA_NAME ETCD_PEER_CA_CERT_DIRECTORY DIEGO_CA_NAME DIEGO_CA_CERT_DIRECTORY

    Ex:
    $0 etcdPeerCA ~/workspace/diego-release/diego-certs diegoCA ~/workspace/diego-release/diego-certs/
"
  exit 1
}

peer_ca_name=$1
peer_ca_cert_directory=$2

diego_ca_name=$3
diego_ca_cert_directory=$4

if [ -z "${peer_ca_name}" ]; then
  >&2 echo "Specify a Etcd Peer CA"
  usage
fi

if [ ! -d "${peer_ca_cert_directory}" ]; then
  >&2 echo "Specify location of Etcd Peer CA cert and key"
  usage
fi

if [ -z "${diego_ca_name}" ]; then
  >&2 echo "Specify a Diego CA"
  usage
fi

if [ ! -d "${diego_ca_cert_directory}" ]; then
  >&2 echo "Specify location of Diego CA cert and key"
  usage
fi

# Install certstrap
go get -v github.com/square/certstrap

# Place keys and certificates here
output_path="diego-certs/etcd-certs"
mkdir -p ${output_path}

# Server certificate to share across the etcd cluster
certstrap --depot-path ${diego_ca_cert_directory} request-cert --passphrase '' --common-name etcd.service.cf.internal --domain '*.etcd.service.cf.internal,etcd.service.cf.internal'
certstrap --depot-path ${diego_ca_cert_directory} sign etcd.service.cf.internal --CA $diego_ca_name
mv -f ${diego_ca_cert_directory}/etcd.service.cf.internal.key ${output_path}/server.key
mv -f ${diego_ca_cert_directory}/etcd.service.cf.internal.csr ${output_path}/server.csr
mv -f ${diego_ca_cert_directory}/etcd.service.cf.internal.crt ${output_path}/server.crt

# Client certificate to distribute to jobs that access etcd
certstrap --depot-path ${diego_ca_cert_directory} request-cert --passphrase '' --common-name 'diego etcd client'
certstrap --depot-path ${diego_ca_cert_directory} sign diego_etcd_client --CA $diego_ca_name
mv -f ${diego_ca_cert_directory}/diego_etcd_client.key ${output_path}/client.key
mv -f ${diego_ca_cert_directory}/diego_etcd_client.csr ${output_path}/client.csr
mv -f ${diego_ca_cert_directory}/diego_etcd_client.crt ${output_path}/client.crt

# Client certificate to distribute across etcd peers
certstrap --depot-path ${peer_ca_cert_directory} request-cert --passphrase '' --common-name etcd.service.cf.internal --domain '*.etcd.service.cf.internal,etcd.service.cf.internal'
certstrap --depot-path ${peer_ca_cert_directory} sign etcd.service.cf.internal --CA $peer_ca_name
mv -f ${peer_ca_cert_directory}/etcd.service.cf.internal.key ${output_path}/peer.key
mv -f ${peer_ca_cert_directory}/etcd.service.cf.internal.csr ${output_path}/peer.csr
mv -f ${peer_ca_cert_directory}/etcd.service.cf.internal.crt ${output_path}/peer.crt