1

I have created a kubernetes cluster on aws using kops.

Unless I am wrong, the ca.crt and ca.key files are in the following locations as indicated by this very helpful answer:

   - s3://<BUCKET_NAME>/<CLUSTER_NAME>/pki/private/ca/*.key
   - s3://<BUCKET_NAME>/<CLUSTER_NAME>/pki/issued/ca/*.crt

However, I coulnd't help noticing that in my ~/.kube/config file (which was created automatically by kops), I have an entry named:

certificate-authority-data

whose contents are different than both of the above files.

What is in any case the CA key/crt pairs we should use when issuing client certificates?

Why there are (seemingly) more than one CAs ?

pkaramol
  • 16,451
  • 43
  • 149
  • 324

2 Answers2

0

Ok this is weird ... (perhaps for an inexperienced on such issues like me ...)

When I perform:

echo -n <contents_of_the_certificate-authority-data_entry_of_my_kubeconfig_file> | base64 --decode

...I get my ca.crt file ...

Isn't the ca.crt already base64 encoded?

pkaramol
  • 16,451
  • 43
  • 149
  • 324
  • 1
    The CA file is probably PEM-encoded. You are then base64-encoding that. Not sure why k8s decided to have the file base64-encoded, probably because it's easy and deterministic to encode/decode it, and the base64-encoded thing becomes a one-line thing, so no one has to struggle with getting multi-line PEM-encoded strings into YAML – Amit Kumar Gupta Jan 10 '18 at 17:34
0

The certificate-authority-data present on your Kubernetes config file is nothing else that your certificate encoded in base64 (It's a lot more practical to have a continuous text string for a configuration file than without the base64 encoding).

Your .crt file is encoded in RSA, not base64. RSA is a secure cryptosystem based on public and private keys (your .crt and .key respectively). Base64, is, at best, useful for formatting or transmitting already encrypted data.

Tux
  • 2,039
  • 8
  • 22
  • The .crt file is not encoded in RSA. It contains (public) key data used for RSA encryption, the encoding/format of the .crt file is likely PEM. – Amit Kumar Gupta Jan 12 '18 at 01:18