Use separate signing keys for the cert and the token

Signed-off-by: Dean Roehrich <[email protected]>
NearNodeFlash · Feb 10, 2025 · 7ceb50b · 7ceb50b
1 parent ad5b684
commit 7ceb50b
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 11 deletions.
diff --git a/config/examples/copyoffload-containerprofile.yaml b/config/examples/copyoffload-containerprofile.yaml
@@ -18,19 +18,27 @@ data:
         command:
           - /nnf-copy-offload
           - --cert
-          - /etc/copy-offload-server/tls.crt
+          - /etc/copy-offload-tls/tls.crt
           - --cakey
-          - /etc/copy-offload-server/tls.key
+          - /etc/copy-offload-tls/tls.key
+          - --tokenkey
+          - /etc/copy-offload-token/token.key
           - --addr
           - :$(NNF_CONTAINER_PORTS)
         volumeMounts:
-          - name: copy-offload-server
-            mountPath: /etc/copy-offload-server
+          - name: copy-offload-tls
+            mountPath: /etc/copy-offload-tls
+            readOnly: true
+          - name: copy-offload-token
+            mountPath: /etc/copy-offload-token
             readOnly: true
     volumes:
-      - name: copy-offload-server
+      - name: copy-offload-tls
+        secret:
+          secretName: nnf-dm-copy-offload-server-tls
+      - name: copy-offload-token-token
         secret:
-          secretName: nnf-dm-copy-offload-server
+          secretName: nnf-dm-copy-offload-server-token
     serviceAccount: nnf-dm-copy-offload
     serviceAccountName: nnf-dm-copy-offload
   retryLimit: 2
diff --git a/tools/mk-copy-offload-secrets.sh b/tools/mk-copy-offload-secrets.sh
@@ -23,9 +23,10 @@ set -o pipefail
 SRVR_HOST="$1"
 SRVR_HOST=${SRVR_HOST:=localhost}
 
-SERVER_SECRET=nnf-dm-copy-offload-server
-TOKEN_SECRET=nnf-dm-copy-offload-client
-if kubectl get secret $TOKEN_SECRET $SERVER_SECRET 2> /dev/null; then
+SERVER_TLS_SECRET=nnf-dm-copy-offload-server-tls
+SERVER_TOKEN_SECRET=nnf-dm-copy-offload-server-token
+CLIENT_SECRET=nnf-dm-copy-offload-client
+if kubectl get secret "$SERVER_TLS_SECRET" "$SERVER_TOKEN_SECRET" "$CLIENT_SECRET" 2> /dev/null; then
     echo "The copy-offload secrets already exist in the cluster."
     exit 0
 fi
@@ -35,8 +36,11 @@ CERTDIR=certs
 
 KEY=$CERTDIR/ca/private/ca_key.pem
 SERVER_CERT=$CERTDIR/server/server_cert.pem
+
+TOKEN_KEY=$CERTDIR/ca/private/token_key.pem
 TOKEN=$CERTDIR/client/token
 
-kubectl create secret tls $SERVER_SECRET --cert $SERVER_CERT --key $KEY
+kubectl create secret tls $SERVER_TLS_SECRET --cert $SERVER_CERT --key $KEY
 
-kubectl create secret generic $TOKEN_SECRET --from-file "tls.crt"="$SERVER_CERT" --from-file token="$TOKEN"
+kubectl create secret generic $CLIENT_SECRET --from-file "tls.crt"="$SERVER_CERT" --from-file token="$TOKEN"
+kubectl create secret generic $SERVER_TOKEN_SECRET --from-file "token.key"="$TOKEN_KEY"