How to generate valid certificates for instances created from GCE instance templates?

Question

I am generating Google Compute Engine instances from instance templates . The problem is I need to create certificates for each instance, and certificates need to be for each instance's hostname. Now, instance hostnames contain a random part, f.ex. staging-node-ntsr.c.example.internal . How can I generate certificates that correspond to these dynamically generated hostnames?

I use cfssl to generate certificates, my command line looks like this:

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client-server worker.json | cfssljson -bare worker-client

The context is that I need to TLS secure my Kubernetes nodes.

Answer 1

通过在启动时在每个实例上生成证书来解决此问题，因为那时我知道每个实例的各种地址。