fix: multiple-cluster-mode add ca certs required by diego-cell

aqan213 commented 4 years ago

Import CA certs of control plane to generate the certs required by diego-cell.

Description

Add the CA certs instead of the certs that imported in the credentials in values yaml file. Those certs can be removed and ca certs can generate those ones.

credentials_list=(
credhub_tls.ca
diego_bbs_client.ca
diego_bbs_client.certificate
diego_bbs_client.private_key
diego_instance_identity_ca.ca
diego_instance_identity_ca.certificate
diego_instance_identity_ca.private_key
diego_rep_agent_v2.ca
diego_rep_agent_v2.certificate
diego_rep_agent_v2.private_key
diego_rep_client.ca
diego_rep_client.certificate
diego_rep_client.private_key
forwarder_agent_metrics_tls.ca
forwarder_agent_metrics_tls.certificate
forwarder_agent_metrics_tls.private_key
gorouter_backend_tls.ca
loggr_udp_forwarder_tls.ca
loggr_udp_forwarder_tls.certificate
loggr_udp_forwarder_tls.private_key
loggregator_agent_metrics_tls.ca
loggregator_agent_metrics_tls.certificate
loggregator_agent_metrics_tls.private_key
loggregator_tls_agent.ca
loggregator_tls_agent.certificate
loggregator_tls_agent.private_key
ssh_proxy_backends_tls.ca
uaa_ssl.ca
cf_app_sd_client_tls.ca
cf_app_sd_client_tls.certificate
cf_app_sd_client_tls.private_key
nats_client_cert.ca
nats_client_cert.certificate
nats_client_cert.private_key
network_policy_client.ca
network_policy_client.certificate
network_policy_client.private_key
silk_daemon.ca
silk_daemon.certificate
silk_daemon.private_key
)

Motivation and Context

Add the CA certs can reduce the certs those we need to manage.

How Has This Been Tested?

Tested in IBM multi clusters with kubecf 2.6.1.

Screenshots (if appropriate):

Types of changes

[x] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

[ ] My code has security implications.
[x] My code follows the code style of this project.
[ ] My change requires a change to the documentation.
[ ] I have updated the documentation accordingly.

viovanov commented 3 years ago

Hi @aqan213 - this is failing linting - can you please take a look? https://concourse.suse.dev/teams/main/pipelines/kubecf/jobs/lint-pr/builds/386

aqan213 commented 3 years ago

@viovanov The lint error was fixed. Thanks,

cloudfoundry-incubator / kubecf

fix: multiple-cluster-mode add ca certs required by diego-cell #1570