dev-pki

Documentation

Overview

dev-pki bootstraps a fresh CA and a small fixed set of leaf certs (one relay + two agents) for local cluster validation.

THIS IS A DEVELOPMENT-ONLY TOOL. The agent UUIDs are fixed so manifests can pre-bake `--uri` flags; the leaf TTL defaults to 30 days (vs. production's 1 h with rotation). Do not deploy these secrets anywhere that matters.

Run:

go run ./tools/dev-pki -out ./.dev-pki

Output:

.dev-pki/
  ca.crt        — distribute (RootCAs / ClientCAs)
  ca.key        — keep local; needed if you re-issue
  relay-r1.{crt,key}
  agent-provider.{crt,key}
  agent-consumer.{crt,key}
  secrets.yaml  — kubectl apply -f .dev-pki/secrets.yaml