- [Tip] K-PaaS 인증서 갱신
-
- 등록일
- 2020-09-25 16:29:24
<p># bosh 인증서 갱신</p>
<p> </p>
<p>1. ca 로테이션할 nats, blobstore 새로운 ca 추가</p>
<p>* nats,blobstore ca 로테이션 참고 사이트</p>
<p>https://bosh.io/docs/credential-rotation/</p>
<p>- add-new-ca.yml</p>
<p>- add-new-blobstore-ca.yml</p>
<p> </p>
<p><br />
2. creds.yml에 nats,blobstore 제외 모든 ca삭제</p>
<p> </p>
<p><br />
3. deploy.sh에 추가한 ca 로테이션 파일 옵션 추가</p>
<p>$ vi deploy-{IAAS}.sh</p>
<p> </p>
<p>-변경 전-<br />
</p>
<p>#!/bin/bash</p>
<p>bosh create-env bosh.yml \</p>
<p>--state=aws/state.json \</p>
<p>--vars-store=aws/creds.yml \</p>
<p>-o aws/cpi.yml \</p>
<p>-o uaa.yml \</p>
<p>-o credhub.yml \</p>
<p>-o jumpbox-user.yml \</p>
<p>....</p>
<p> </p>
<p>-변경 후-</p>
<p>#!/bin/bash</p>
<p>bosh create-env bosh.yml \</p>
<p>--state=aws/state.json \</p>
<p>--vars-store=aws/creds.yml \</p>
<p>-o aws/cpi.yml \</p>
<p>-o uaa.yml \</p>
<p>-o credhub.yml \</p>
<p>-o jumpbox-user.yml \</p>
<p>-o add-new-ca.yml \</p>
<p>-o add-new-blobstore-ca.yml \</p>
<p>...</p>
<p> </p>
<p>4. 변경된 ca 적용을 위한 배포된 deployment recreate</p>
<p>bosh -e micro-bosh -d {deployment명} recreate</p>
<p>ex) bosh -e micro-bosh -d paasta recreate</p>
<p> </p>
<p>5. ca 로테이션할 old nats, blobstore ca 삭제</p>
<p>- remove-old-ca.yml</p>
<p>- remove-old-blobstore-ca.yml</p>
<p> </p>
<p>6. deploy.sh에 old nats, blobstore ca 삭제를 위한 파일 옵션 추가</p>
<p>$ vi deploy-{IAAS}.sh</p>
<p> </p>
<p>-변경 전-</p>
<p>#!/bin/bash</p>
<p>bosh create-env bosh.yml \</p>
<p>--state=aws/state.json \</p>
<p>--vars-store=aws/creds.yml \</p>
<p>-o aws/cpi.yml \</p>
<p>-o uaa.yml \</p>
<p>-o credhub.yml \</p>
<p>-o jumpbox-user.yml \</p>
<p>-o add-new-ca.yml \</p>
<p>-o add-new-blobstore-ca.yml \</p>
<p>...</p>
<p> </p>
<p>-변경 후-</p>
<p>#!/bin/bash</p>
<p>bosh create-env bosh.yml \</p>
<p>--state=aws/state.json \</p>
<p>--vars-store=aws/creds.yml \</p>
<p>-o aws/cpi.yml \</p>
<p>-o uaa.yml \</p>
<p>-o credhub.yml \</p>
<p>-o jumpbox-user.yml \</p>
<p>-o remove-old-ca.yml \</p>
<p>-o remove-old-blobstore-ca.yml \</p>
<p>...</p>
<p> </p>
<p>7. old nats, blobstore ca 삭제 적용을 위한 deployment recreate</p>
<p>bosh -e micro-bosh -d {deployment명} recreate</p>
<p>ex) bosh -e micro-bosh -d paasta recreate</p>
<p> </p>
<p>8. creds.yml 정리</p>
<p>- update_nats_var_values.yml</p>
<p>- update_blobstore_var_values.yml</p>
<p>$ cp creds.yml creds.yml.bkp</p>
<p>$ bosh -e micro-bosh interpolate creds.yml \</p>
<p>-o update_nats_var_values.yml \</p>
<p>-o update_blobstore_var_values.yml \</p>
<p>--vars-file creds.yml > updated_creds.yml</p>
<p>$ mv updated_creds.yml creds.yml</p>
<p> </p>
<p> </p>
<p><br />
<span style="font-size:20px"><strong># cf 인증서 갱신</strong></span></p>
<p> </p>
<p>1. dns.yml에 설정이 되는 삭제</p>
<p>dns_api_client_tls</p>
<p>dns_api_server_tls</p>
<p>dns_api_tls_ca</p>
<p>dns_healthcheck_client_tls</p>
<p>dns_healthcheck_server_tls</p>
<p>dns_healthcheck_tls_ca</p>
<p>$ credhub delete -n</p>
<p>ex) credhub delete -n dns_api_client_tls</p>
<p> </p>
<p>2. update-runtime-config.sh 재실행</p>
<p> </p>
<p>3. paasta deplyment 재배포<br />
</p>
