Make certificates persistent

cmd/hepto/config.go

@@ -35,12 +35,14 @@ func (c *Config) Complete() error {
 	c.Container.Logger = c.Logger
 	c.Cluster.Logger = c.Logger
 	c.Cluster.ZapLogger = logger
+	c.Cluster.CertsPath = "/certs"
 	// Setup paths and container settings
 	c.Container.Data = path.Join(c.DataDir, c.Cluster.Name, c.Node.Name)
 	err = os.MkdirAll(c.Container.Data, 0o700)
 	if err != nil {
 		return err
 	}
+	c.Container.Mounts[c.Cluster.CertsPath] = path.Join(c.Container.Data, "certs")
 	c.Container.Name = c.Node.Name
 	c.Container.Capabilities = additionalCapabilities
 	c.Container.Devices = additionalDevices

pkg/cluster/certs.go

@@ -2,6 +2,7 @@ package cluster
 
 import (
 	"os"
+	"path"
 
 	"forge.tedomum.net/acides/hepto/hepto/pkg/pki"
 )
@@ -9,12 +10,12 @@ import (
 func (c *Cluster) initCerts() {
 	// Prepare the cluster PKI
 	if c.node.Role == Master {
-		ca, err := pki.NewClusterCA("/pki")
+		ca, err := pki.NewClusterCA(path.Join(c.settings.CertsPath, "pki"))
 		if err != nil {
 			c.settings.Logger.Error(err, "could not initialize pki")
 			os.Exit(1)
 		}
-		masterCerts, err := pki.NewMasterCerts("/master", c.networking.NodeAddress.IP)
+		masterCerts, err := pki.NewMasterCerts(path.Join(c.settings.CertsPath, "master"), c.networking.NodeAddress.IP)
 		if err != nil {
 			c.settings.Logger.Error(err, "could not initialize master certs")
 			os.Exit(1)
@@ -23,7 +24,7 @@ func (c *Cluster) initCerts() {
 		c.masterCerts = masterCerts
 		c.pki.SignMasterCerts(c.masterCerts)
 	} else {
-		ca, err := pki.EmptyClusterCA("/pki")
+		ca, err := pki.EmptyClusterCA(path.Join(c.settings.CertsPath, "pki"))
 		if err != nil {
 			c.settings.Logger.Error(err, "could not initialize pki")
 			os.Exit(1)
@@ -32,7 +33,7 @@ func (c *Cluster) initCerts() {
 	}
 	c.ml.State.PKI = c.pki
 	// Initialize node certificates
-	certs, err := pki.NewNodeCerts("/certs", c.node.Name)
+	certs, err := pki.NewNodeCerts(path.Join(c.settings.CertsPath, "node"), c.node.Name)
 	if err != nil {
 		c.settings.Logger.Error(err, "could not initialize node certs")
 		os.Exit(1)

pkg/cluster/config.go

@@ -13,6 +13,8 @@ type ClusterSettings struct {
 	Logger logr.Logger
 	// Concrete zap logger for etcd
 	ZapLogger *zap.Logger
+	// Path to certificate storage
+	CertsPath string
 	// Cluster name, should be locally unique
 	Name string
 	// Cluster key, must be shared across nodes