snippet.sh

# Generate the CA
$ cfssl gencert -initca certs/config/ca-csr.json | cfssljson -bare certs/ca

# Generate the certificate for Consul
$ cfssl gencert \
    -ca=certs/ca.pem \
    -ca-key=certs/ca-key.pem \
    -config=certs/config/ca-config.json \
    -profile=default \
    certs/config/consul-csr.json | cfssljson -bare certs/consul

# Generate the certificate for Vault
$ cfssl gencert \
    -ca=certs/ca.pem \
    -ca-key=certs/ca-key.pem \
    -config=certs/config/ca-config.json \
    -profile=default \
    certs/config/vault-csr.json | cfssljson -bare certs/vault
```

# Create an encryption key for the gossip protocol
export GOSSIP_ENCRYPTION_KEY=$(consul keygen)

# Save it as a secret in kubernetes
kubectl create secret generic consul \
  --from-literal="gossip-encryption-key=${GOSSIP_ENCRYPTION_KEY}" \
  --from-file=certs/ca.pem \
  --from-file=certs/consul.pem \
  --from-file=certs/consul-key.pem