create-tls.sh

#!/bin/bash
set -euo pipefail

TMP=$(mktemp -d)
trap "rm -r '$TMP'" EXIT

cd "$TMP"
NAMESPACE=custom-metrics
NAME=custom-metrics-apiserver.$NAMESPACE

if kubectl get csr "$NAME"; then
  echo "csr $NAME already exists" >&2
  exit 1
fi

echo "Creating key and CSR files"
cat <<EOF | cfssl genkey - | cfssljson -bare server
{
  "CN": "$NAME.svc.cluster.local",
  "hosts": [
    "$NAME.svc.cluster.local",
    "$NAME.pod.cluster.local"
  ],
  "key": {
    "algo": "ecdsa",
    "size": 256
  }
}
EOF

echo "Creating CSR in kubernetes"
cat <<EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: $NAME
spec:
  groups:
  - system:authenticated
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF

kubectl certificate approve $NAME
kubectl get csr $NAME -o jsonpath='{.status.certificate}' \
  | base64 -d > serving.crt

kubectl -n "$NAMESPACE" create secret generic cm-adapter-serving-certs \
  --from-file=serving.crt \
  --from-file=serving.key=server-key.pem