Generate kube-apiserver OIDC CA file from OIDC_CA_CERT

Signed-off-by: Ryan Djurovich <git@ryan0x44.com>

Author: ryan0x44

templates/knd/opt/podplane/bin/bootstrap.sh

@@ -93,7 +93,7 @@ NSTANCE_SERVER_REGISTRATION_ADDR=$(quote_env_value "${NSTANCE_SERVER_REGISTRATIO
 NSTANCE_SERVER_AGENT_ADDR=$(quote_env_value "${NSTANCE_SERVER_AGENT_ADDR:-}")
 KUBE_API_ETCD_SERVERS=$(quote_env_value "${KUBE_API_ETCD_SERVERS:-}")
 OIDC_ISSUER=$(quote_env_value "${OIDC_ISSUER:-}")
-OIDC_CA_FILE=$(quote_env_value "${OIDC_CA_FILE:-}")
+OIDC_CA_CERT=$(quote_env_value "${OIDC_CA_CERT:-}")
 KUBE_LOG_LEVEL=$(quote_env_value "${KUBE_LOG_LEVEL:-2}")
 NETSY_BUCKET=$(quote_env_value "${NETSY_BUCKET:-}")
 NETSY_ENDPOINT=$(quote_env_value "${NETSY_ENDPOINT:-}")

templates/knd/opt/podplane/lib/configure/kube.sh

@@ -27,6 +27,13 @@ KUBE_API_PORT="${KUBE_API_PORT:-6443}"
 case "$KUBE_API_PORT" in
   ''|*[!0-9]*) fatal "KUBE_API_PORT must be numeric" ;;
 esac
+OIDC_CA_FILE=""
+if [ -n "${OIDC_CA_CERT:-}" ]; then
+  OIDC_CA_FILE="/opt/crt/oidc-ca.pem"
+  mkdir -p "${PODPLANE_ROOT:-}/opt/crt"
+  printf '%s' "$OIDC_CA_CERT" | base64 -d > "${PODPLANE_ROOT:-}$OIDC_CA_FILE"
+  set_file_permissions 0640 root podplane "$OIDC_CA_FILE"
+fi
 
 # Create kubelet env file
 mkdir -p "${PODPLANE_ROOT:-}/opt/env"