Extract OpenShift CA Certificates from Install Generated Kubeconfig

readme.md

After installing OpenShift you'll find a number of certificate authorities which are used to issue ingress, api certs. Even in a test environment you will want to configure your clients to trust them. This script will extract certs from the kubeconfig into files containing a single cert so you can more easily do so.

ext-kubeconfig-cacerts.sh

#!/bin/sh
cat $KUBECONFIG \
    | yq e '.clusters[0].cluster."certificate-authority-data"' \
    | base64 -d > kubeconfig-ca-data.pem
    
split -p "-----BEGIN CERTIFICATE-----" kubeconfig-ca-data.pem cert-

for c in cert-??; do
    subject=`openssl x509 -in $c -noout  -subject | sed 's/^.*CN[[:space:]]*=[[:space:]]*\(.*\)/\1/'`
    echo $subject
    mv $c "${subject}.pem"
done