func (k *Kubernetes) Generate(rootCA *Certificate, defaultCertificate Certificate) error {
	crs := []*certificateRequest{
		k.kubernetesCACR(rootCA, defaultCertificate),
		k.kubernetesFrontProxyCACR(rootCA, defaultCertificate),
	}
	if err := buildAndGenerate(crs...); err != nil {
		return fmt.Errorf("generating kubernetes CA certificates: %w", err)
	}
	if k.KubeAPIServer == nil {
		k.KubeAPIServer = &KubeAPIServer{}
	}
	crs = []*certificateRequest{
		k.kubeAPIServerServerCR(defaultCertificate),
		k.kubeAPIServerKubeletCR(defaultCertificate),
		k.kubeAPIServerFrontProxyClientCR(defaultCertificate),
		k.adminCR(defaultCertificate),
		k.kubeControllerManagerCR(defaultCertificate),
		k.kubeSchedulerCR(defaultCertificate),
		k.serviceAccountCR(defaultCertificate),
	}
	return buildAndGenerate(crs...)
}
Generate generates Kubernetes PKI.
package pki
import (
	"fmt"
)
const (
	KubernetesCACN = "kubernetes-ca"
	KubernetesFrontProxyCACN = "kubernetes-front-proxy-ca"
)
type Kubernetes struct {
	Certificate
	CA *Certificate `json:"ca,omitempty"`
	FrontProxyCA *Certificate `json:"frontProxyCA,omitempty"`
	KubeAPIServer *KubeAPIServer `json:"kubeAPIServer,omitempty"`
	AdminCertificate *Certificate `json:"adminCertificate,omitempty"`
	KubeControllerManagerCertificate *Certificate `json:"kubeControllerManagerCertificate,omitempty"`
	KubeSchedulerCertificate *Certificate `json:"kubeSchedulerCertificate,omitempty"`
	ServiceAccountCertificate *Certificate `json:"serviceAccountCertificate,omitempty"`
}
type KubeAPIServer struct {
	Certificate
	ExternalNames []string `json:"externalNames,omitempty"`
	ServerIPs []string `json:"serverIPs,omitempty"`
	ServerCertificate *Certificate `json:"serverCertificate,omitempty"`
	KubeletCertificate *Certificate `json:"kubeletCertificate,omitempty"`
	FrontProxyClientCertificate *Certificate `json:"frontProxyClientCertificate,omitempty"`
}
func (k *Kubernetes) kubernetesCACR(rootCA *Certificate, defaultCertificate Certificate) *certificateRequest {
	if k.CA == nil {
		k.CA = &Certificate{}
	}
	return &certificateRequest{
		Target: k.CA,
		CA:     rootCA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			caCertificate(KubernetesCACN),
			k.CA,
		},
	}
}
func (k *Kubernetes) kubernetesFrontProxyCACR(rootCA *Certificate, defaultCertificate Certificate) *certificateRequest {
	if k.FrontProxyCA == nil {
		k.FrontProxyCA = &Certificate{}
	}
	return &certificateRequest{
		Target: k.FrontProxyCA,
		CA:     rootCA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			caCertificate(KubernetesFrontProxyCACN),
			k.FrontProxyCA,
		},
	}
}
func (k *Kubernetes) kubeAPIServerServerCR(defaultCertificate Certificate) *certificateRequest {
	if k.KubeAPIServer.ServerCertificate == nil {
		k.KubeAPIServer.ServerCertificate = &Certificate{}
	}
	return &certificateRequest{
		Target: k.KubeAPIServer.ServerCertificate,
		CA:     k.CA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			&k.KubeAPIServer.Certificate,
			defaultKubeAPIServerServerCertificate(k.KubeAPIServer),
			k.KubeAPIServer.ServerCertificate,
		},
	}
}
func (k *Kubernetes) kubeAPIServerKubeletCR(defaultCertificate Certificate) *certificateRequest {
	if k.KubeAPIServer.KubeletCertificate == nil {
		k.KubeAPIServer.KubeletCertificate = &Certificate{}
	}
	return &certificateRequest{
		Target: k.KubeAPIServer.KubeletCertificate,
		CA:     k.CA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			&k.KubeAPIServer.Certificate,
			defaultKubeAPIServerKubeletCertificate(),
			k.KubeAPIServer.KubeletCertificate,
		},
	}
}
func (k *Kubernetes) kubeAPIServerFrontProxyClientCR(defaultCertificate Certificate) *certificateRequest {
	if k.KubeAPIServer.FrontProxyClientCertificate == nil {
		k.KubeAPIServer.FrontProxyClientCertificate = &Certificate{}
	}
	return &certificateRequest{
		Target: k.KubeAPIServer.FrontProxyClientCertificate,
		CA:     k.FrontProxyCA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			&k.KubeAPIServer.Certificate,
			defaultKubeAPIServerFrontProxyClientCertificate(),
			k.KubeAPIServer.FrontProxyClientCertificate,
		},
	}
}
func (k *Kubernetes) adminCR(defaultCertificate Certificate) *certificateRequest {
	if k.AdminCertificate == nil {
		k.AdminCertificate = &Certificate{}
	}
	return &certificateRequest{
		Target: k.AdminCertificate,
		CA:     k.CA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			{
				CommonName:   "kubernetes-admin",
				Organization: "system:masters",
				KeyUsage:     clientUsage(),
			},
			k.AdminCertificate,
		},
	}
}
func (k *Kubernetes) kubeControllerManagerCR(defaultCertificate Certificate) *certificateRequest {
	if k.KubeControllerManagerCertificate == nil {
		k.KubeControllerManagerCertificate = &Certificate{}
	}
	return &certificateRequest{
		Target: k.KubeControllerManagerCertificate,
		CA:     k.CA,
		Certificates: []*Certificate{
			&defaultCertificate,
			&k.Certificate,
			{
				CommonName: "system:kube-controller-manager",
				KeyUsage:   clientUsage(),
			},
			k.KubeControllerManagerCertificate,
		},
	}
}