From 6f9271ff9c7ebf94f5fb1533c5bf2b2f418089b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Cluseau?= <mikael.cluseau@gmail.com>
Date: Fri, 17 Jul 2026 11:13:48 +0200
Subject: [PATCH] kube: sign with all active certificates

---
 cmd/dkl-local-server/ws-clusters.go | 46 ++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 10 deletions(-)

diff --git a/cmd/dkl-local-server/ws-clusters.go b/cmd/dkl-local-server/ws-clusters.go
index 9891307..a79793e 100644
--- a/cmd/dkl-local-server/ws-clusters.go
+++ b/cmd/dkl-local-server/ws-clusters.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"log"
@@ -12,7 +13,9 @@ import (
 
 	"github.com/cloudflare/cfssl/config"
 	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/helpers"
 	"github.com/cloudflare/cfssl/signer"
+	"github.com/cloudflare/cfssl/signer/local"
 	restful "github.com/emicklei/go-restful"
 
 	"novit.tech/direktil/local-server/pkg/mime"
@@ -221,15 +224,23 @@ func wsClusterKubeCASign(req *restful.Request, resp *restful.Response) {
 		return
 	}
 
-	caSigner, err := ca.Signer(&config.Signing{
+	caKey, err := ca.ParseKey()
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	caCerts, err := helpers.ParseCertificatesPEM(ca.Cert)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	signingProfile := &config.Signing{
 		Default: &config.SigningProfile{
 			Usage:  []string{"client auth"},
 			Expiry: notAfter.Sub(now),
 		},
-	})
-	if err != nil {
-		wsError(resp, err)
-		return
 	}
 
 	csr := signer.SignRequest{
@@ -242,13 +253,28 @@ func wsClusterKubeCASign(req *restful.Request, resp *restful.Response) {
 		NotAfter:  notAfter,
 	}
 
-	cert, err := caSigner.Sign(csr)
-	if err != nil {
-		wsError(resp, err)
-		return
+	var certPEMs [][]byte
+	for _, caCert := range caCerts {
+		if caCert.NotAfter.Before(now) {
+			continue
+		}
+
+		caSigner, err := local.NewSigner(caKey, caCert, signer.DefaultSigAlgo(caKey), signingProfile)
+		if err != nil {
+			wsError(resp, err)
+			return
+		}
+
+		cert, err := caSigner.Sign(csr)
+		if err != nil {
+			wsError(resp, err)
+			return
+		}
+
+		certPEMs = append(certPEMs, cert)
 	}
 
-	resp.Write(cert)
+	resp.Write(bytes.Join(certPEMs, nil))
 }
 
 func parseCertDurationRange(d string, now time.Time) (notBefore, notAfter time.Time, err error) {