kube: sign with all active certificates

cmd/dkl-local-server/ws-clusters.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"log"
@@ -12,7 +13,9 @@ import (
 
 	"github.com/cloudflare/cfssl/config"
 	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/helpers"
 	"github.com/cloudflare/cfssl/signer"
+	"github.com/cloudflare/cfssl/signer/local"
 	restful "github.com/emicklei/go-restful"
 
 	"novit.tech/direktil/local-server/pkg/mime"
@@ -221,15 +224,23 @@ func wsClusterKubeCASign(req *restful.Request, resp *restful.Response) {
 		return
 	}
 
-	caSigner, err := ca.Signer(&config.Signing{
+	caKey, err := ca.ParseKey()
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	caCerts, err := helpers.ParseCertificatesPEM(ca.Cert)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	signingProfile := &config.Signing{
 		Default: &config.SigningProfile{
 			Usage:  []string{"client auth"},
 			Expiry: notAfter.Sub(now),
 		},
-	})
-	if err != nil {
-		wsError(resp, err)
-		return
 	}
 
 	csr := signer.SignRequest{
@@ -242,13 +253,28 @@ func wsClusterKubeCASign(req *restful.Request, resp *restful.Response) {
 		NotAfter:  notAfter,
 	}
 
+	var certPEMs [][]byte
+	for _, caCert := range caCerts {
+		if caCert.NotAfter.Before(now) {
+			continue
+		}
+
+		caSigner, err := local.NewSigner(caKey, caCert, signer.DefaultSigAlgo(caKey), signingProfile)
+		if err != nil {
+			wsError(resp, err)
+			return
+		}
+
 		cert, err := caSigner.Sign(csr)
 		if err != nil {
 			wsError(resp, err)
 			return
 		}
 
-	resp.Write(cert)
+		certPEMs = append(certPEMs, cert)
+	}
+
+	resp.Write(bytes.Join(certPEMs, nil))
 }
 
 func parseCertDurationRange(d string, now time.Time) (notBefore, notAfter time.Time, err error) {