Vendor cfssl and cfssljson

vendor/github.com/cloudflare/cfssl/cli/BUILD

@@ -0,0 +1,53 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "cli.go",
+        "config.go",
+    ],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli",
+    importpath = "github.com/cloudflare/cfssl/cli",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/config:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/signer/universal:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/bundle:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/certinfo:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/crl:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/gencert:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/gencrl:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/gencsr:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/genkey:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/info:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/ocspdump:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/ocsprefresh:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/ocspserve:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/ocspsign:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/printdefault:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/revoke:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/scan:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/selfsign:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/serve:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/sign:all-srcs",
+        "//vendor/github.com/cloudflare/cfssl/cli/version:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/bundle/BUILD

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["bundle.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/bundle",
+    importpath = "github.com/cloudflare/cfssl/cli/bundle",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/bundler:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ubiquity:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/bundle/bundle.go

@@ -0,0 +1,88 @@
+// Package bundle implements the bundle command.
+package bundle
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/cloudflare/cfssl/bundler"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/ubiquity"
+)
+
+// Usage text of 'cfssl bundle'
+var bundlerUsageText = `cfssl bundle -- create a certificate bundle that contains the client cert
+
+Usage of bundle:
+	- Bundle local certificate files
+        cfssl bundle -cert file [-ca-bundle file] [-int-bundle file] [-int-dir dir] [-metadata file] [-key keyfile] [-flavor optimal|ubiquitous|force] [-password password]
+	- Bundle certificate from remote server.
+        cfssl bundle -domain domain_name [-ip ip_address] [-ca-bundle file] [-int-bundle file] [-int-dir dir] [-metadata file]
+
+Flags:
+`
+
+// flags used by 'cfssl bundle'
+var bundlerFlags = []string{"cert", "key", "ca-bundle", "int-bundle", "flavor", "int-dir", "metadata", "domain", "ip", "password"}
+
+// bundlerMain is the main CLI of bundler functionality.
+func bundlerMain(args []string, c cli.Config) (err error) {
+	bundler.IntermediateStash = c.IntDir
+	ubiquity.LoadPlatforms(c.Metadata)
+	flavor := bundler.BundleFlavor(c.Flavor)
+	var b *bundler.Bundler
+	// If it is a force bundle, don't require ca bundle and intermediate bundle
+	// Otherwise, initialize a bundler with CA bundle and intermediate bundle.
+	if flavor == bundler.Force {
+		b = &bundler.Bundler{}
+	} else {
+		b, err = bundler.NewBundler(c.CABundleFile, c.IntBundleFile)
+		if err != nil {
+			return
+		}
+	}
+
+	var bundle *bundler.Bundle
+	if c.CertFile != "" {
+		if c.CertFile == "-" {
+			var certPEM, keyPEM []byte
+			certPEM, err = cli.ReadStdin(c.CertFile)
+			if err != nil {
+				return
+			}
+			if c.KeyFile != "" {
+				keyPEM, err = cli.ReadStdin(c.KeyFile)
+				if err != nil {
+					return
+				}
+			}
+			bundle, err = b.BundleFromPEMorDER(certPEM, keyPEM, flavor, "")
+			if err != nil {
+				return
+			}
+		} else {
+			// Bundle the client cert
+			bundle, err = b.BundleFromFile(c.CertFile, c.KeyFile, flavor, c.Password)
+			if err != nil {
+				return
+			}
+		}
+	} else if c.Domain != "" {
+		bundle, err = b.BundleFromRemote(c.Domain, c.IP, flavor)
+		if err != nil {
+			return
+		}
+	} else {
+		return errors.New("Must specify bundle target through -cert or -domain")
+	}
+
+	marshaled, err := bundle.MarshalJSON()
+	if err != nil {
+		return
+	}
+	fmt.Printf("%s", marshaled)
+	return
+}
+
+// Command assembles the definition of Command 'bundle'
+var Command = &cli.Command{UsageText: bundlerUsageText, Flags: bundlerFlags, Main: bundlerMain}

vendor/github.com/cloudflare/cfssl/cli/certinfo/BUILD

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["certinfo.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/certinfo",
+    importpath = "github.com/cloudflare/cfssl/cli/certinfo",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/certinfo:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/certinfo/certinfo.go

@@ -0,0 +1,89 @@
+// Package certinfo implements the certinfo command
+package certinfo
+
+import (
+	"crypto/x509"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/cloudflare/cfssl/certinfo"
+	"github.com/cloudflare/cfssl/cli"
+)
+
+// Usage text of 'cfssl certinfo'
+var dataUsageText = `cfssl certinfo -- output certinfo about the given cert
+
+Usage of certinfo:
+	- Data from local certificate files
+        cfssl certinfo -cert file
+	- Data from local CSR file
+        cfssl certinfo -csr file
+	- Data from certificate from remote server.
+        cfssl certinfo -domain domain_name
+
+Flags:
+`
+
+// flags used by 'cfssl certinfo'
+var certinfoFlags = []string{"cert", "csr", "domain"}
+
+// certinfoMain is the main CLI of certinfo functionality
+func certinfoMain(args []string, c cli.Config) (err error) {
+	var cert *certinfo.Certificate
+	var csr *x509.CertificateRequest
+
+	if c.CertFile != "" {
+		if c.CertFile == "-" {
+			var certPEM []byte
+			if certPEM, err = cli.ReadStdin(c.CertFile); err != nil {
+				return
+			}
+
+			if cert, err = certinfo.ParseCertificatePEM(certPEM); err != nil {
+				return
+			}
+		} else {
+			if cert, err = certinfo.ParseCertificateFile(c.CertFile); err != nil {
+				return
+			}
+		}
+	} else if c.CSRFile != "" {
+		if c.CSRFile == "-" {
+			var csrPEM []byte
+			if csrPEM, err = cli.ReadStdin(c.CSRFile); err != nil {
+				return
+			}
+			if csr, err = certinfo.ParseCSRPEM(csrPEM); err != nil {
+				return
+			}
+		} else {
+			if csr, err = certinfo.ParseCSRFile(c.CSRFile); err != nil {
+				return
+			}
+		}
+	} else if c.Domain != "" {
+		if cert, err = certinfo.ParseCertificateDomain(c.Domain); err != nil {
+			return
+		}
+	} else {
+		return errors.New("Must specify certinfo target through -cert, -csr, or -domain")
+	}
+
+	var b []byte
+	if cert != nil {
+		b, err = json.MarshalIndent(cert, "", "  ")
+	} else if csr != nil {
+		b, err = json.MarshalIndent(csr, "", "  ")
+	}
+
+	if err != nil {
+		return
+	}
+
+	fmt.Println(string(b))
+	return
+}
+
+// Command assembles the definition of Command 'certinfo'
+var Command = &cli.Command{UsageText: dataUsageText, Flags: certinfoFlags, Main: certinfoMain}

vendor/github.com/cloudflare/cfssl/cli/cli.go

@@ -0,0 +1,199 @@
+// Package cli provides the template for adding new cfssl commands
+package cli
+
+/*
+cfssl is the command line tool to issue/sign/bundle client certificate. It's
+also a tool to start a HTTP server to handle web requests for signing, bundling
+and verification.
+
+Usage:
+	cfssl command [-flags] arguments
+
+The commands are defined in the cli subpackages and include
+
+	bundle	 create a certificate bundle
+	sign	 signs a certificate signing request (CSR)
+	serve	 starts a HTTP server handling sign and bundle requests
+	version	 prints the current cfssl version
+	genkey   generates a key and an associated CSR
+	gencert  generates a key and a signed certificate
+	gencsr   generates a certificate request
+	selfsign generates a self-signed certificate
+	ocspsign signs an OCSP response
+
+Use "cfssl [command] -help" to find out more about a command.
+*/
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/cloudflare/cfssl/config"
+)
+
+// Command holds the implementation details of a cfssl command.
+type Command struct {
+	// The Usage Text
+	UsageText string
+	// Flags to look up in the global table
+	Flags []string
+	// Main runs the command, args are the arguments after flags
+	Main func(args []string, c Config) error
+}
+
+var cmdName string
+
+// usage is the cfssl usage heading. It will be appended with names of defined commands in cmds
+// to form the final usage message of cfssl.
+const usage = `Usage:
+Available commands:
+`
+
+// printDefaultValue is a helper function to print out a user friendly
+// usage message of a flag. It's useful since we want to write customized
+// usage message on selected subsets of the global flag set. It is
+// borrowed from standard library source code. Since flag value type is
+// not exported, default string flag values are printed without
+// quotes. The only exception is the empty string, which is printed as "".
+func printDefaultValue(f *flag.Flag) {
+	format := "  -%s=%s: %s\n"
+	if f.DefValue == "" {
+		format = "  -%s=%q: %s\n"
+	}
+	fmt.Fprintf(os.Stderr, format, f.Name, f.DefValue, f.Usage)
+}
+
+// PopFirstArgument returns the first element and the rest of a string
+// slice and return error if failed to do so. It is a helper function
+// to parse non-flag arguments previously used in cfssl commands.
+func PopFirstArgument(args []string) (string, []string, error) {
+	if len(args) < 1 {
+		return "", nil, errors.New("not enough arguments are supplied --- please refer to the usage")
+	}
+	return args[0], args[1:], nil
+}
+
+// Start is the entrance point of cfssl command line tools.
+func Start(cmds map[string]*Command) error {
+	// cfsslFlagSet is the flag sets for cfssl.
+	var cfsslFlagSet = flag.NewFlagSet("cfssl", flag.ExitOnError)
+	var c Config
+
+	registerFlags(&c, cfsslFlagSet)
+	// Initial parse of command line arguments. By convention, only -h/-help is supported.
+	if flag.Usage == nil {
+		flag.Usage = func() {
+			fmt.Fprintf(os.Stderr, usage)
+			for name := range cmds {
+				fmt.Fprintf(os.Stderr, "\t%s\n", name)
+			}
+			fmt.Fprintf(os.Stderr, "Top-level flags:\n")
+			flag.PrintDefaults()
+		}
+	}
+
+	flag.Parse()
+
+	if flag.NArg() < 1 {
+		fmt.Fprintf(os.Stderr, "No command is given.\n")
+		flag.Usage()
+		return errors.New("no command was given")
+	}
+
+	// Clip out the command name and args for the command
+	cmdName = flag.Arg(0)
+	args := flag.Args()[1:]
+	cmd, found := cmds[cmdName]
+	if !found {
+		fmt.Fprintf(os.Stderr, "Command %s is not defined.\n", cmdName)
+		flag.Usage()
+		return errors.New("undefined command")
+	}
+	// always have flag 'loglevel' for each command
+	cmd.Flags = append(cmd.Flags, "loglevel")
+	// The usage of each individual command is re-written to mention
+	// flags defined and referenced only in that command.
+	cfsslFlagSet.Usage = func() {
+		fmt.Fprintf(os.Stderr, "\t%s", cmd.UsageText)
+		for _, name := range cmd.Flags {
+			if f := cfsslFlagSet.Lookup(name); f != nil {
+				printDefaultValue(f)
+			}
+		}
+	}
+
+	// Parse all flags and take the rest as argument lists for the command
+	cfsslFlagSet.Parse(args)
+	args = cfsslFlagSet.Args()
+
+	var err error
+	if c.ConfigFile != "" {
+		c.CFG, err = config.LoadFile(c.ConfigFile)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to load config file: %v", err)
+			return errors.New("failed to load config file")
+		}
+	}
+
+	if err := cmd.Main(args, c); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		return err
+	}
+
+	return nil
+}
+
+// ReadStdin reads from stdin if the file is "-"
+func ReadStdin(filename string) ([]byte, error) {
+	if filename == "-" {
+		return ioutil.ReadAll(os.Stdin)
+	}
+	return ioutil.ReadFile(filename)
+}
+
+// PrintCert outputs a cert, key and csr to stdout
+func PrintCert(key, csrBytes, cert []byte) {
+	out := map[string]string{}
+	if cert != nil {
+		out["cert"] = string(cert)
+	}
+
+	if key != nil {
+		out["key"] = string(key)
+	}
+
+	if csrBytes != nil {
+		out["csr"] = string(csrBytes)
+	}
+
+	jsonOut, err := json.Marshal(out)
+	if err != nil {
+		return
+	}
+	fmt.Printf("%s\n", jsonOut)
+}
+
+// PrintOCSPResponse outputs an OCSP response to stdout
+// ocspResponse is base64 encoded
+func PrintOCSPResponse(resp []byte) {
+	b64Resp := base64.StdEncoding.EncodeToString(resp)
+
+	out := map[string]string{"ocspResponse": b64Resp}
+	jsonOut, err := json.Marshal(out)
+	if err != nil {
+		return
+	}
+	fmt.Printf("%s\n", jsonOut)
+}
+
+// PrintCRL outputs the CRL to stdout
+func PrintCRL(certList []byte) {
+	b64Resp := base64.StdEncoding.EncodeToString(certList)
+
+	fmt.Printf("%s\n", b64Resp)
+}

vendor/github.com/cloudflare/cfssl/cli/config.go

@@ -0,0 +1,143 @@
+package cli
+
+import (
+	"flag"
+	"time"
+
+	"github.com/cloudflare/cfssl/config"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/signer/universal"
+)
+
+// Config is a type to hold flag values used by cfssl commands.
+type Config struct {
+	Hostname          string
+	CertFile          string
+	CSRFile           string
+	CAFile            string
+	CAKeyFile         string
+	TLSCertFile       string
+	TLSKeyFile        string
+	MutualTLSCAFile   string
+	MutualTLSCNRegex  string
+	TLSRemoteCAs      string
+	MutualTLSCertFile string
+	MutualTLSKeyFile  string
+	KeyFile           string
+	IntermediatesFile string
+	CABundleFile      string
+	IntBundleFile     string
+	Address           string
+	Port              int
+	Password          string
+	ConfigFile        string
+	CFG               *config.Config
+	Profile           string
+	IsCA              bool
+	RenewCA           bool
+	IntDir            string
+	Flavor            string
+	Metadata          string
+	Domain            string
+	IP                string
+	Remote            string
+	Label             string
+	AuthKey           string
+	ResponderFile     string
+	ResponderKeyFile  string
+	Status            string
+	Reason            string
+	RevokedAt         string
+	Interval          time.Duration
+	List              bool
+	Family            string
+	Timeout           time.Duration
+	Scanner           string
+	CSVFile           string
+	NumWorkers        int
+	MaxHosts          int
+	Responses         string
+	Path              string
+	CRL               string
+	Usage             string
+	PGPPrivate        string
+	PGPName           string
+	Serial            string
+	CNOverride        string
+	AKI               string
+	DBConfigFile      string
+	CRLExpiration     time.Duration
+}
+
+// registerFlags defines all cfssl command flags and associates their values with variables.
+func registerFlags(c *Config, f *flag.FlagSet) {
+	f.StringVar(&c.Hostname, "hostname", "", "Hostname for the cert, could be a comma-separated hostname list")
+	f.StringVar(&c.CertFile, "cert", "", "Client certificate that contains the public key")
+	f.StringVar(&c.CSRFile, "csr", "", "Certificate signature request file for new public key")
+	f.StringVar(&c.CAFile, "ca", "", "CA used to sign the new certificate -- accepts '[file:]fname' or 'env:varname'")
+	f.StringVar(&c.CAKeyFile, "ca-key", "", "CA private key -- accepts '[file:]fname' or 'env:varname'")
+	f.StringVar(&c.TLSCertFile, "tls-cert", "", "Other endpoint CA to set up TLS protocol")
+	f.StringVar(&c.TLSKeyFile, "tls-key", "", "Other endpoint CA private key")
+	f.StringVar(&c.MutualTLSCAFile, "mutual-tls-ca", "", "Mutual TLS - require clients be signed by this CA ")
+	f.StringVar(&c.MutualTLSCNRegex, "mutual-tls-cn", "", "Mutual TLS - regex for whitelist of allowed client CNs")
+	f.StringVar(&c.TLSRemoteCAs, "tls-remote-ca", "", "CAs to trust for remote TLS requests")
+	f.StringVar(&c.MutualTLSCertFile, "mutual-tls-client-cert", "", "Mutual TLS - client certificate to call remote instance requiring client certs")
+	f.StringVar(&c.MutualTLSKeyFile, "mutual-tls-client-key", "", "Mutual TLS - client key to call remote instance requiring client certs")
+	f.StringVar(&c.KeyFile, "key", "", "private key for the certificate")
+	f.StringVar(&c.IntermediatesFile, "intermediates", "", "intermediate certs")
+	f.StringVar(&c.CABundleFile, "ca-bundle", "", "path to root certificate store")
+	f.StringVar(&c.IntBundleFile, "int-bundle", "", "path to intermediate certificate store")
+	f.StringVar(&c.Address, "address", "127.0.0.1", "Address to bind")
+	f.IntVar(&c.Port, "port", 8888, "Port to bind")
+	f.StringVar(&c.ConfigFile, "config", "", "path to configuration file")
+	f.StringVar(&c.Profile, "profile", "", "signing profile to use")
+	f.BoolVar(&c.IsCA, "initca", false, "initialise new CA")
+	f.BoolVar(&c.RenewCA, "renewca", false, "re-generate a CA certificate from existing CA certificate/key")
+	f.StringVar(&c.IntDir, "int-dir", "", "specify intermediates directory")
+	f.StringVar(&c.Flavor, "flavor", "ubiquitous", "Bundle Flavor: ubiquitous, optimal and force.")
+	f.StringVar(&c.Metadata, "metadata", "", "Metadata file for root certificate presence. The content of the file is a json dictionary (k,v): each key k is SHA-1 digest of a root certificate while value v is a list of key store filenames.")
+	f.StringVar(&c.Domain, "domain", "", "remote server domain name")
+	f.StringVar(&c.IP, "ip", "", "remote server ip")
+	f.StringVar(&c.Remote, "remote", "", "remote CFSSL server")
+	f.StringVar(&c.Label, "label", "", "key label to use in remote CFSSL server")
+	f.StringVar(&c.AuthKey, "authkey", "", "key to authenticate requests to remote CFSSL server")
+	f.StringVar(&c.ResponderFile, "responder", "", "Certificate for OCSP responder")
+	f.StringVar(&c.ResponderKeyFile, "responder-key", "", "private key for OCSP responder certificate")
+	f.StringVar(&c.Status, "status", "good", "Status of the certificate: good, revoked, unknown")
+	f.StringVar(&c.Reason, "reason", "0", "Reason code for revocation")
+	f.StringVar(&c.RevokedAt, "revoked-at", "now", "Date of revocation (YYYY-MM-DD)")
+	f.DurationVar(&c.Interval, "interval", 4*helpers.OneDay, "Interval between OCSP updates (default: 96h)")
+	f.BoolVar(&c.List, "list", false, "list possible scanners")
+	f.StringVar(&c.Family, "family", "", "scanner family regular expression")
+	f.StringVar(&c.Scanner, "scanner", "", "scanner regular expression")
+	f.DurationVar(&c.Timeout, "timeout", 5*time.Minute, "duration (ns, us, ms, s, m, h) to scan each host before timing out")
+	f.StringVar(&c.CSVFile, "csv", "", "file containing CSV of hosts")
+	f.IntVar(&c.NumWorkers, "num-workers", 10, "number of workers to use for scan")
+	f.IntVar(&c.MaxHosts, "max-hosts", 100, "maximum number of hosts to scan")
+	f.StringVar(&c.Responses, "responses", "", "file to load OCSP responses from")
+	f.StringVar(&c.Path, "path", "/", "Path on which the server will listen")
+	f.StringVar(&c.CRL, "crl", "", "CRL URL Override")
+	f.StringVar(&c.Password, "password", "0", "Password for accessing PKCS #12 data passed to bundler")
+	f.StringVar(&c.Usage, "usage", "", "usage of private key")
+	f.StringVar(&c.PGPPrivate, "pgp-private", "", "file to load a PGP Private key decryption")
+	f.StringVar(&c.PGPName, "pgp-name", "", "PGP public key name, can be a comma-sepearted  key name list")
+	f.StringVar(&c.Serial, "serial", "", "certificate serial number")
+	f.StringVar(&c.CNOverride, "cn", "", "certificate common name (CN)")
+	f.StringVar(&c.AKI, "aki", "", "certificate issuer (authority) key identifier")
+	f.StringVar(&c.DBConfigFile, "db-config", "", "certificate db configuration file")
+	f.DurationVar(&c.CRLExpiration, "expiry", 7*helpers.OneDay, "time from now after which the CRL will expire (default: one week)")
+	f.IntVar(&log.Level, "loglevel", log.LevelInfo, "Log level (0 = DEBUG, 5 = FATAL)")
+}
+
+// RootFromConfig returns a universal signer Root structure that can
+// be used to produce a signer.
+func RootFromConfig(c *Config) universal.Root {
+	return universal.Root{
+		Config: map[string]string{
+			"cert-file": c.CAFile,
+			"key-file":  c.CAKeyFile,
+		},
+		ForceRemote: c.Remote != "",
+	}
+}

vendor/github.com/cloudflare/cfssl/cli/crl/BUILD

@@ -0,0 +1,33 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["crl.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/crl",
+    importpath = "github.com/cloudflare/cfssl/cli/crl",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/certdb/dbconf:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/sql:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/crl:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/errors:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/jmoiron/sqlx:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/crl/crl.go

@@ -0,0 +1,105 @@
+//Package crl implements the crl command
+package crl
+
+import (
+	"os"
+
+	"github.com/cloudflare/cfssl/certdb/dbconf"
+	certsql "github.com/cloudflare/cfssl/certdb/sql"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/crl"
+	cferr "github.com/cloudflare/cfssl/errors"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/log"
+
+	"github.com/jmoiron/sqlx"
+)
+
+var crlUsageText = `cfssl crl -- generate a new Certificate Revocation List from Database
+
+Usage of crl:
+        cfssl crl
+
+Flags:
+`
+var crlFlags = []string{"db-config", "ca", "ca-key", "expiry"}
+
+func generateCRL(c cli.Config) (crlBytes []byte, err error) {
+	if c.CAFile == "" {
+		log.Error("need CA certificate (provide one with -ca)")
+		return
+	}
+
+	if c.CAKeyFile == "" {
+		log.Error("need CA key (provide one with -ca-key)")
+		return
+	}
+
+	var db *sqlx.DB
+	if c.DBConfigFile != "" {
+		db, err = dbconf.DBFromConfig(c.DBConfigFile)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		log.Error("no Database specified!")
+		return nil, err
+	}
+
+	dbAccessor := certsql.NewAccessor(db)
+
+	log.Debug("loading CA: ", c.CAFile)
+	ca, err := helpers.ReadBytes(c.CAFile)
+	if err != nil {
+		return nil, err
+	}
+	log.Debug("loading CA key: ", c.CAKeyFile)
+	cakey, err := helpers.ReadBytes(c.CAKeyFile)
+	if err != nil {
+		return nil, cferr.Wrap(cferr.CertificateError, cferr.ReadFailed, err)
+	}
+
+	// Parse the PEM encoded certificate
+	issuerCert, err := helpers.ParseCertificatePEM(ca)
+	if err != nil {
+		return nil, err
+	}
+
+	strPassword := os.Getenv("CFSSL_CA_PK_PASSWORD")
+	password := []byte(strPassword)
+	if strPassword == "" {
+		password = nil
+	}
+
+	// Parse the key given
+	key, err := helpers.ParsePrivateKeyPEMWithPassword(cakey, password)
+	if err != nil {
+		log.Debug("malformed private key %v", err)
+		return nil, err
+	}
+
+	certs, err := dbAccessor.GetRevokedAndUnexpiredCertificates()
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := crl.NewCRLFromDB(certs, issuerCert, key, c.CRLExpiration)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+func crlMain(args []string, c cli.Config) (err error) {
+	req, err := generateCRL(c)
+	if err != nil {
+		return err
+	}
+
+	cli.PrintCRL(req)
+	return
+}
+
+// Command assembles the definition of Command 'crl'
+var Command = &cli.Command{UsageText: crlUsageText, Flags: crlFlags, Main: crlMain}

vendor/github.com/cloudflare/cfssl/cli/gencert/BUILD

@@ -0,0 +1,33 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["gencert.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/gencert",
+    importpath = "github.com/cloudflare/cfssl/cli/gencert",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/api/generator:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli/genkey:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli/sign:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/csr:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/initca:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/signer:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/gencert/gencert.go

@@ -0,0 +1,165 @@
+// Package gencert implements the gencert command.
+package gencert
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/cloudflare/cfssl/api/generator"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/cli/genkey"
+	"github.com/cloudflare/cfssl/cli/sign"
+	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/initca"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/signer"
+)
+
+var gencertUsageText = `cfssl gencert -- generate a new key and signed certificate
+
+Usage of gencert:
+    Generate a new key and cert from CSR:
+        cfssl gencert -initca CSRJSON
+        cfssl gencert -ca cert -ca-key key [-config config] [-profile profile] [-hostname hostname] CSRJSON
+        cfssl gencert -remote remote_host [-config config] [-profile profile] [-label label] [-hostname hostname] CSRJSON
+
+    Re-generate a CA cert with the CA key and CSR:
+        cfssl gencert -initca -ca-key key CSRJSON
+
+    Re-generate a CA cert with the CA key and certificate:
+        cfssl gencert -renewca -ca cert -ca-key key
+
+Arguments:
+        CSRJSON:    JSON file containing the request, use '-' for reading JSON from stdin
+
+Flags:
+`
+
+var gencertFlags = []string{"initca", "remote", "ca", "ca-key", "config", "cn", "hostname", "profile", "label"}
+
+func gencertMain(args []string, c cli.Config) error {
+	if c.RenewCA {
+		log.Infof("re-generate a CA certificate from CA cert and key")
+		cert, err := initca.RenewFromPEM(c.CAFile, c.CAKeyFile)
+		if err != nil {
+			log.Errorf("%v\n", err)
+			return err
+		}
+		cli.PrintCert(nil, nil, cert)
+		return nil
+	}
+
+	csrJSONFile, args, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return err
+	}
+
+	if len(args) > 0 {
+		return errors.New("only one argument is accepted, please check with usage")
+	}
+
+	csrJSONFileBytes, err := cli.ReadStdin(csrJSONFile)
+	if err != nil {
+		return err
+	}
+
+	req := csr.CertificateRequest{
+		KeyRequest: csr.NewBasicKeyRequest(),
+	}
+	err = json.Unmarshal(csrJSONFileBytes, &req)
+	if err != nil {
+		return err
+	}
+	if c.CNOverride != "" {
+		req.CN = c.CNOverride
+	}
+	switch {
+	case c.IsCA:
+		var key, csrPEM, cert []byte
+		if c.CAKeyFile != "" {
+			log.Infof("re-generate a CA certificate from CSR and CA key")
+			cert, csrPEM, err = initca.NewFromPEM(&req, c.CAKeyFile)
+			if err != nil {
+				log.Errorf("%v\n", err)
+				return err
+			}
+		} else {
+			log.Infof("generating a new CA key and certificate from CSR")
+			cert, csrPEM, key, err = initca.New(&req)
+			if err != nil {
+				return err
+			}
+
+		}
+		cli.PrintCert(key, csrPEM, cert)
+
+	default:
+		if req.CA != nil {
+			err = errors.New("ca section only permitted in initca")
+			return err
+		}
+
+		if c.Hostname != "" {
+			req.Hosts = signer.SplitHosts(c.Hostname)
+		}
+		// Remote can be forced on the command line or in the config
+		if c.Remote == "" && c.CFG == nil {
+			if c.CAFile == "" {
+				log.Error("need a CA certificate (provide one with -ca)")
+				return nil
+			}
+
+			if c.CAKeyFile == "" {
+				log.Error("need a CA key (provide one with -ca-key)")
+				return nil
+			}
+		}
+
+		var key, csrBytes []byte
+		g := &csr.Generator{Validator: genkey.Validator}
+		csrBytes, key, err = g.ProcessRequest(&req)
+		if err != nil {
+			key = nil
+			return err
+		}
+
+		s, err := sign.SignerFromConfig(c)
+		if err != nil {
+			return err
+		}
+
+		var cert []byte
+		signReq := signer.SignRequest{
+			Request: string(csrBytes),
+			Hosts:   signer.SplitHosts(c.Hostname),
+			Profile: c.Profile,
+			Label:   c.Label,
+		}
+
+		if c.CRL != "" {
+			signReq.CRLOverride = c.CRL
+		}
+		cert, err = s.Sign(signReq)
+		if err != nil {
+			return err
+		}
+
+		// This follows the Baseline Requirements for the Issuance and
+		// Management of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser
+		// Forum (https://cabforum.org). Specifically, section 10.2.3 ("Information
+		// Requirements"), states:
+		//
+		// "Applicant information MUST include, but not be limited to, at least one
+		// Fully-Qualified Domain Name or IP address to be included in the Certificate’s
+		// SubjectAltName extension."
+		if len(signReq.Hosts) == 0 && len(req.Hosts) == 0 {
+			log.Warning(generator.CSRNoHostMessage)
+		}
+
+		cli.PrintCert(key, csrBytes, cert)
+	}
+	return nil
+}
+
+// Command assembles the definition of Command 'gencert'
+var Command = &cli.Command{UsageText: gencertUsageText, Flags: gencertFlags, Main: gencertMain}

vendor/github.com/cloudflare/cfssl/cli/gencrl/BUILD

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["gencrl.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/gencrl",
+    importpath = "github.com/cloudflare/cfssl/cli/gencrl",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/crl:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/gencrl/gencrl.go

@@ -0,0 +1,82 @@
+//Package gencrl implements the gencrl command
+package gencrl
+
+import (
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/crl"
+	"strings"
+)
+
+var gencrlUsageText = `cfssl gencrl -- generate a new Certificate Revocation List
+
+Usage of gencrl:
+        cfssl gencrl INPUTFILE CERT KEY TIME
+
+Arguments:
+        INPUTFILE:               Text file with one serial number per line, use '-' for reading text from stdin
+        CERT:                    The certificate that is signing this CRL, use '-' for reading text from stdin
+        KEY:                     The private key of the certificate that is signing the CRL, use '-' for reading text from stdin
+        TIME (OPTIONAL):         The desired expiration from now, in seconds
+
+Flags:
+`
+var gencrlFlags = []string{}
+
+func gencrlMain(args []string, c cli.Config) (err error) {
+	serialList, args, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return
+	}
+
+	serialListBytes, err := cli.ReadStdin(serialList)
+	if err != nil {
+		return
+	}
+
+	certFile, args, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return
+	}
+
+	certFileBytes, err := cli.ReadStdin(certFile)
+	if err != nil {
+		return
+	}
+
+	keyFile, args, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return
+	}
+
+	keyBytes, err := cli.ReadStdin(keyFile)
+	if err != nil {
+		return
+	}
+
+	// Default value if no expiry time is given
+	timeString := string("0")
+
+	if len(args) > 0 {
+		timeArg, _, err := cli.PopFirstArgument(args)
+		if err != nil {
+			return err
+		}
+
+		timeString = string(timeArg)
+
+		// This is used to get rid of newlines
+		timeString = strings.TrimSpace(timeString)
+
+	}
+
+	req, err := crl.NewCRLFromFile(serialListBytes, certFileBytes, keyBytes, timeString)
+	if err != nil {
+		return
+	}
+
+	cli.PrintCRL(req)
+	return nil
+}
+
+// Command assembles the definition of Command 'gencrl'
+var Command = &cli.Command{UsageText: gencrlUsageText, Flags: gencrlFlags, Main: gencrlMain}

vendor/github.com/cloudflare/cfssl/cli/gencsr/BUILD

@@ -0,0 +1,29 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["gencsr.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/gencsr",
+    importpath = "github.com/cloudflare/cfssl/cli/gencsr",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/csr:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/signer:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/gencsr/gencsr.go

@@ -0,0 +1,99 @@
+// Package gencsr implements the gencsr command.
+package gencsr
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/signer"
+)
+
+var gencsrUsageText = `cfssl gencsr -- generate a csr from a private key with existing CSR json specification or certificate
+
+Usage of genkey:
+        cfssl gencsr -key private_key_file [-host hostname_override] CSRJSON
+        cfssl gencsr -key private_key_file [-host hostname_override] -cert certificate_file
+
+Arguments:
+        CSRJSON:    JSON file containing the request, use '-' for reading JSON from stdin
+
+Flags:
+`
+
+var gencsrFlags = []string{"key", "cert"}
+
+func gencsrMain(args []string, c cli.Config) (err error) {
+	if c.KeyFile == "" {
+		return errors.New("private key file is required through '-key', please check with usage")
+	}
+
+	keyBytes, err := helpers.ReadBytes(c.KeyFile)
+	if err != nil {
+		return err
+	}
+
+	key, err := helpers.ParsePrivateKeyPEM(keyBytes)
+	if err != nil {
+		return err
+	}
+
+	// prepare a stub CertificateRequest
+	req := &csr.CertificateRequest{
+		KeyRequest: csr.NewBasicKeyRequest(),
+	}
+
+	if c.CertFile != "" {
+		if len(args) > 0 {
+			return errors.New("no argument is accepted with '-cert', please check with usage")
+		}
+
+		certBytes, err := helpers.ReadBytes(c.CertFile)
+		if err != nil {
+			return err
+		}
+
+		cert, err := helpers.ParseCertificatePEM(certBytes)
+		if err != nil {
+			return err
+		}
+
+		req = csr.ExtractCertificateRequest(cert)
+	} else {
+		csrFile, args, err := cli.PopFirstArgument(args)
+		if err != nil {
+			return err
+		}
+
+		if len(args) > 0 {
+			return errors.New("only one argument is accepted, please check with usage")
+		}
+
+		csrFileBytes, err := cli.ReadStdin(csrFile)
+		if err != nil {
+			return err
+		}
+
+		err = json.Unmarshal(csrFileBytes, req)
+		if err != nil {
+			return err
+		}
+	}
+
+	if c.Hostname != "" {
+		req.Hosts = signer.SplitHosts(c.Hostname)
+	}
+
+	csrBytes, err := csr.Generate(key, req)
+	if err != nil {
+		return err
+	}
+
+	cli.PrintCert(keyBytes, csrBytes, nil)
+	return nil
+}
+
+// Command assembles the definition of Command 'gencsr'
+var Command = &cli.Command{UsageText: gencsrUsageText, Flags: gencsrFlags, Main: gencsrMain}

vendor/github.com/cloudflare/cfssl/cli/genkey/BUILD

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["genkey.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/genkey",
+    importpath = "github.com/cloudflare/cfssl/cli/genkey",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/csr:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/initca:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/genkey/genkey.go

@@ -0,0 +1,82 @@
+// Package genkey implements the genkey command.
+package genkey
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/initca"
+)
+
+var genkeyUsageText = `cfssl genkey -- generate a new key and CSR
+
+Usage of genkey:
+        cfssl genkey CSRJSON
+
+Arguments:
+        CSRJSON:    JSON file containing the request, use '-' for reading JSON from stdin
+
+Flags:
+`
+
+var genkeyFlags = []string{"initca", "config"}
+
+func genkeyMain(args []string, c cli.Config) (err error) {
+	csrFile, args, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return
+	}
+	if len(args) > 0 {
+		return errors.New("only one argument is accepted, please check with usage")
+	}
+
+	csrFileBytes, err := cli.ReadStdin(csrFile)
+	if err != nil {
+		return
+	}
+
+	req := csr.CertificateRequest{
+		KeyRequest: csr.NewBasicKeyRequest(),
+	}
+	err = json.Unmarshal(csrFileBytes, &req)
+	if err != nil {
+		return
+	}
+
+	if c.IsCA {
+		var key, csrPEM, cert []byte
+		cert, csrPEM, key, err = initca.New(&req)
+		if err != nil {
+			return
+		}
+
+		cli.PrintCert(key, csrPEM, cert)
+	} else {
+		if req.CA != nil {
+			err = errors.New("ca section only permitted in initca")
+			return
+		}
+
+		var key, csrPEM []byte
+		g := &csr.Generator{Validator: Validator}
+		csrPEM, key, err = g.ProcessRequest(&req)
+		if err != nil {
+			key = nil
+			return
+		}
+
+		cli.PrintCert(key, csrPEM, nil)
+	}
+	return nil
+}
+
+// Validator does nothing and will never return an error. It exists because creating a
+// csr.Generator requires a Validator.
+func Validator(req *csr.CertificateRequest) error {
+	return nil
+}
+
+// Command assembles the definition of Command 'genkey'
+var Command = &cli.Command{UsageText: genkeyUsageText, Flags: genkeyFlags, Main: genkeyMain}

vendor/github.com/cloudflare/cfssl/cli/info/BUILD

@@ -0,0 +1,31 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["info.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/info",
+    importpath = "github.com/cloudflare/cfssl/cli/info",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/api/client:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli/sign:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/errors:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/info:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/info/info.go

@@ -0,0 +1,110 @@
+// Package info implements the info command.
+package info
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/cloudflare/cfssl/api/client"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/cli/sign"
+	"github.com/cloudflare/cfssl/errors"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/info"
+
+	goerr "errors"
+)
+
+var infoUsageTxt = `cfssl info -- get info about a remote signer
+
+Usage:
+
+Get info about a remote signer:
+cfssl info -remote remote_host [-label label] [-profile profile] [-label label] 
+
+Flags:
+`
+
+var infoFlags = []string{"remote", "label", "profile", "config"}
+
+func getInfoFromRemote(c cli.Config) (resp *info.Resp, err error) {
+	req := new(info.Req)
+	req.Label = c.Label
+	req.Profile = c.Profile
+
+	cert, err := helpers.LoadClientCertificate(c.MutualTLSCertFile, c.MutualTLSKeyFile)
+	if err != nil {
+		return
+	}
+	remoteCAs, err := helpers.LoadPEMCertPool(c.TLSRemoteCAs)
+	if err != nil {
+		return
+	}
+	serv := client.NewServerTLS(c.Remote, helpers.CreateTLSConfig(remoteCAs, cert))
+	reqJSON, _ := json.Marshal(req)
+	resp, err = serv.Info(reqJSON)
+	if err != nil {
+		return
+	}
+
+	_, err = helpers.ParseCertificatePEM([]byte(resp.Certificate))
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func getInfoFromConfig(c cli.Config) (resp *info.Resp, err error) {
+	s, err := sign.SignerFromConfig(c)
+	if err != nil {
+		return
+	}
+
+	req := new(info.Req)
+	req.Label = c.Label
+	req.Profile = c.Profile
+
+	resp, err = s.Info(*req)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func infoMain(args []string, c cli.Config) (err error) {
+	if len(args) > 0 {
+		return goerr.New("argument is provided but not defined; please refer to the usage by flag -h.")
+	}
+
+	var resp *info.Resp
+
+	if c.Remote != "" {
+		resp, err = getInfoFromRemote(c)
+		if err != nil {
+			return
+		}
+	} else if c.CFG != nil {
+		resp, err = getInfoFromConfig(c)
+		if err != nil {
+			return
+		}
+	} else {
+		return goerr.New("Either -remote or -config must be given. Refer to cfssl info -h for usage.")
+	}
+
+	respJSON, err := json.Marshal(resp)
+	if err != nil {
+		return errors.NewBadRequest(err)
+	}
+	fmt.Print(string(respJSON))
+	return nil
+}
+
+// Command assembles the definition of Command 'info'
+var Command = &cli.Command{
+	UsageText: infoUsageTxt,
+	Flags:     infoFlags,
+	Main:      infoMain,
+}

vendor/github.com/cloudflare/cfssl/cli/ocspdump/BUILD

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["ocspdump.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/ocspdump",
+    importpath = "github.com/cloudflare/cfssl/cli/ocspdump",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/certdb/dbconf:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/sql:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/ocspdump/ocspdump.go

@@ -0,0 +1,50 @@
+// Package ocspdump implements the ocspdump command.
+package ocspdump
+
+import (
+	"encoding/base64"
+	"errors"
+	"fmt"
+
+	"github.com/cloudflare/cfssl/certdb/dbconf"
+	"github.com/cloudflare/cfssl/certdb/sql"
+	"github.com/cloudflare/cfssl/cli"
+)
+
+// Usage text of 'cfssl ocspdump'
+var ocspdumpUsageText = `cfssl ocspdump -- generates a series of concatenated OCSP responses
+for use with ocspserve from all OCSP responses in the cert db
+
+Usage of ocspdump:
+        cfssl ocspdump -db-config db-config
+
+Flags:
+`
+
+// Flags of 'cfssl ocspdump'
+var ocspdumpFlags = []string{"db-config"}
+
+// ocspdumpMain is the main CLI of OCSP dump functionality.
+func ocspdumpMain(args []string, c cli.Config) error {
+	if c.DBConfigFile == "" {
+		return errors.New("need DB config file (provide with -db-config)")
+	}
+
+	db, err := dbconf.DBFromConfig(c.DBConfigFile)
+	if err != nil {
+		return err
+	}
+
+	dbAccessor := sql.NewAccessor(db)
+	records, err := dbAccessor.GetUnexpiredOCSPs()
+	if err != nil {
+		return err
+	}
+	for _, certRecord := range records {
+		fmt.Printf("%s\n", base64.StdEncoding.EncodeToString([]byte(certRecord.Body)))
+	}
+	return nil
+}
+
+// Command assembles the definition of Command 'ocspdump'
+var Command = &cli.Command{UsageText: ocspdumpUsageText, Flags: ocspdumpFlags, Main: ocspdumpMain}

vendor/github.com/cloudflare/cfssl/cli/ocsprefresh/BUILD

@@ -0,0 +1,31 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["ocsprefresh.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/ocsprefresh",
+    importpath = "github.com/cloudflare/cfssl/cli/ocsprefresh",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/certdb/dbconf:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/sql:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ocsp:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/ocsprefresh/ocsprefresh.go

@@ -0,0 +1,112 @@
+// Package ocsprefresh implements the ocsprefresh command.
+package ocsprefresh
+
+import (
+	"encoding/hex"
+	"errors"
+	"time"
+
+	"github.com/cloudflare/cfssl/certdb/dbconf"
+	"github.com/cloudflare/cfssl/certdb/sql"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/ocsp"
+)
+
+// Usage text of 'cfssl ocsprefresh'
+var ocsprefreshUsageText = `cfssl ocsprefresh -- refreshes the ocsp_responses table
+with new OCSP responses for all known unexpired certificates
+
+Usage of ocsprefresh:
+        cfssl ocsprefresh -db-config db-config -ca cert -responder cert -responder-key key [-interval 96h]
+
+Flags:
+`
+
+// Flags of 'cfssl ocsprefresh'
+var ocsprefreshFlags = []string{"ca", "responder", "responder-key", "db-config", "interval"}
+
+// ocsprefreshMain is the main CLI of OCSP refresh functionality.
+func ocsprefreshMain(args []string, c cli.Config) error {
+	if c.DBConfigFile == "" {
+		return errors.New("need DB config file (provide with -db-config)")
+	}
+
+	if c.ResponderFile == "" {
+		return errors.New("need responder certificate (provide with -responder)")
+	}
+
+	if c.ResponderKeyFile == "" {
+		return errors.New("need responder key (provide with -responder-key)")
+	}
+
+	if c.CAFile == "" {
+		return errors.New("need CA certificate (provide with -ca)")
+	}
+
+	s, err := SignerFromConfig(c)
+	if err != nil {
+		log.Critical("Unable to create OCSP signer: ", err)
+		return err
+	}
+
+	db, err := dbconf.DBFromConfig(c.DBConfigFile)
+	if err != nil {
+		return err
+	}
+
+	dbAccessor := sql.NewAccessor(db)
+	certs, err := dbAccessor.GetUnexpiredCertificates()
+	if err != nil {
+		return err
+	}
+
+	// Set an expiry timestamp for all certificates refreshed in this batch
+	ocspExpiry := time.Now().Add(c.Interval)
+	for _, certRecord := range certs {
+		cert, err := helpers.ParseCertificatePEM([]byte(certRecord.PEM))
+		if err != nil {
+			log.Critical("Unable to parse certificate: ", err)
+			return err
+		}
+
+		req := ocsp.SignRequest{
+			Certificate: cert,
+			Status:      certRecord.Status,
+		}
+
+		if certRecord.Status == "revoked" {
+			req.Reason = int(certRecord.Reason)
+			req.RevokedAt = certRecord.RevokedAt
+		}
+
+		resp, err := s.Sign(req)
+		if err != nil {
+			log.Critical("Unable to sign OCSP response: ", err)
+			return err
+		}
+
+		err = dbAccessor.UpsertOCSP(cert.SerialNumber.String(), hex.EncodeToString(cert.AuthorityKeyId), string(resp), ocspExpiry)
+		if err != nil {
+			log.Critical("Unable to save OCSP response: ", err)
+			return err
+		}
+	}
+
+	return nil
+}
+
+// SignerFromConfig creates a signer from a cli.Config as a helper for cli and serve
+func SignerFromConfig(c cli.Config) (ocsp.Signer, error) {
+	//if this is called from serve then we need to use the specific responder key file
+	//fallback to key for backwards-compatibility
+	k := c.ResponderKeyFile
+	if k == "" {
+		k = c.KeyFile
+	}
+	return ocsp.NewSignerFromFile(c.CAFile, c.ResponderFile, k, time.Duration(c.Interval))
+}
+
+// Command assembles the definition of Command 'ocsprefresh'
+var Command = &cli.Command{UsageText: ocsprefreshUsageText, Flags: ocsprefreshFlags, Main: ocsprefreshMain}

vendor/github.com/cloudflare/cfssl/cli/ocspserve/BUILD

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["ocspserve.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/ocspserve",
+    importpath = "github.com/cloudflare/cfssl/cli/ocspserve",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ocsp:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/ocspserve/ocspserve.go

@@ -0,0 +1,62 @@
+// Package ocspserve implements the ocspserve function.
+package ocspserve
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/ocsp"
+)
+
+// Usage text of 'cfssl serve'
+var ocspServerUsageText = `cfssl ocspserve -- set up an HTTP server that handles OCSP requests from either a file or directly from a database (see RFC 5019)
+
+  Usage of ocspserve:
+          cfssl ocspserve [-address address] [-port port] [-responses file] [-db-config db-config]
+
+  Flags:
+  `
+
+// Flags used by 'cfssl serve'
+var ocspServerFlags = []string{"address", "port", "responses", "db-config"}
+
+// ocspServerMain is the command line entry point to the OCSP responder.
+// It sets up a new HTTP server that responds to OCSP requests.
+func ocspServerMain(args []string, c cli.Config) error {
+	var src ocsp.Source
+	// serve doesn't support arguments.
+	if len(args) > 0 {
+		return errors.New("argument is provided but not defined; please refer to the usage by flag -h")
+	}
+
+	if c.Responses != "" {
+		s, err := ocsp.NewSourceFromFile(c.Responses)
+		if err != nil {
+			return errors.New("unable to read response file")
+		}
+		src = s
+	} else if c.DBConfigFile != "" {
+		s, err := ocsp.NewSourceFromDB(c.DBConfigFile)
+		if err != nil {
+			return errors.New("unable to read configuration file")
+		}
+		src = s
+	} else {
+		return errors.New(
+			"no response file or db-config provided, please set the one of these using either -responses or -db-config flags",
+		)
+	}
+
+	log.Info("Registering OCSP responder handler")
+	http.Handle(c.Path, ocsp.NewResponder(src))
+
+	addr := fmt.Sprintf("%s:%d", c.Address, c.Port)
+	log.Info("Now listening on ", addr)
+	return http.ListenAndServe(addr, nil)
+}
+
+// Command assembles the definition of Command 'ocspserve'
+var Command = &cli.Command{UsageText: ocspServerUsageText, Flags: ocspServerFlags, Main: ocspServerMain}

vendor/github.com/cloudflare/cfssl/cli/ocspsign/BUILD

@@ -0,0 +1,29 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["ocspsign.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/ocspsign",
+    importpath = "github.com/cloudflare/cfssl/cli/ocspsign",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ocsp:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/ocspsign/ocspsign.go

@@ -0,0 +1,93 @@
+// Package ocspsign implements the ocspsign command.
+package ocspsign
+
+import (
+	"io/ioutil"
+	"time"
+
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/ocsp"
+)
+
+// Usage text of 'cfssl ocspsign'
+var ocspSignerUsageText = `cfssl ocspsign -- signs an OCSP response for a given CA, cert, and status.
+Returns a base64-encoded OCSP response.
+
+Usage of ocspsign:
+        cfssl ocspsign -ca cert -responder cert -responder-key key -cert cert [-status status] [-reason code] [-revoked-at YYYY-MM-DD] [-interval 96h]
+
+Flags:
+`
+
+// Flags of 'cfssl ocspsign'
+var ocspSignerFlags = []string{"ca", "responder", "responder-key", "reason", "status", "revoked-at", "interval"}
+
+// ocspSignerMain is the main CLI of OCSP signer functionality.
+func ocspSignerMain(args []string, c cli.Config) (err error) {
+	// Read the cert to be revoked from file
+	certBytes, err := ioutil.ReadFile(c.CertFile)
+	if err != nil {
+		log.Critical("Unable to read certificate: ", err)
+		return
+	}
+	cert, err := helpers.ParseCertificatePEM(certBytes)
+	if err != nil {
+		log.Critical("Unable to parse certificate: ", err)
+		return
+	}
+
+	req := ocsp.SignRequest{
+		Certificate: cert,
+		Status:      c.Status,
+	}
+
+	if c.Status == "revoked" {
+		var reasonCode int
+		reasonCode, err = ocsp.ReasonStringToCode(c.Reason)
+		if err != nil {
+			log.Critical("Invalid reason code: ", err)
+			return
+		}
+
+		req.Reason = reasonCode
+		req.RevokedAt = time.Now()
+		if c.RevokedAt != "now" {
+			req.RevokedAt, err = time.Parse("2006-01-02", c.RevokedAt)
+			if err != nil {
+				log.Critical("Malformed revocation time: ", c.RevokedAt)
+				return
+			}
+		}
+	}
+
+	s, err := SignerFromConfig(c)
+	if err != nil {
+		log.Critical("Unable to create OCSP signer: ", err)
+		return
+	}
+
+	resp, err := s.Sign(req)
+	if err != nil {
+		log.Critical("Unable to sign OCSP response: ", err)
+		return
+	}
+
+	cli.PrintOCSPResponse(resp)
+	return
+}
+
+// SignerFromConfig creates a signer from a cli.Config as a helper for cli and serve
+func SignerFromConfig(c cli.Config) (ocsp.Signer, error) {
+	//if this is called from serve then we need to use the specific responder key file
+	//fallback to key for backwards-compatibility
+	k := c.ResponderKeyFile
+	if k == "" {
+		k = c.KeyFile
+	}
+	return ocsp.NewSignerFromFile(c.CAFile, c.ResponderFile, k, time.Duration(c.Interval))
+}
+
+// Command assembles the definition of Command 'ocspsign'
+var Command = &cli.Command{UsageText: ocspSignerUsageText, Flags: ocspSignerFlags, Main: ocspSignerMain}

vendor/github.com/cloudflare/cfssl/cli/printdefault/BUILD

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "defaults.go",
+        "printdefault.go",
+    ],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/printdefault",
+    importpath = "github.com/cloudflare/cfssl/cli/printdefault",
+    visibility = ["//visibility:public"],
+    deps = ["//vendor/github.com/cloudflare/cfssl/cli:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/printdefault/defaults.go

@@ -0,0 +1,49 @@
+package printdefaults
+
+var defaults = map[string]string{
+	"config": `{
+    "signing": {
+        "default": {
+            "expiry": "168h"
+        },
+        "profiles": {
+            "www": {
+                "expiry": "8760h",
+                "usages": [
+                    "signing",
+                    "key encipherment",
+                    "server auth"
+                ]
+            },
+            "client": {
+                "expiry": "8760h",
+                "usages": [
+                    "signing",
+                    "key encipherment",
+                    "client auth"
+                ]
+            }
+        }
+    }
+}
+`,
+	"csr": `{
+    "CN": "example.net",
+    "hosts": [
+        "example.net",
+        "www.example.net"
+    ],
+    "key": {
+        "algo": "ecdsa",
+        "size": 256
+    },
+    "names": [
+        {
+            "C": "US",
+            "ST": "CA",
+            "L": "San Francisco"
+        }
+    ]
+}
+`,
+}

vendor/github.com/cloudflare/cfssl/cli/printdefault/printdefault.go

@@ -0,0 +1,48 @@
+package printdefaults
+
+import (
+	"fmt"
+
+	"github.com/cloudflare/cfssl/cli"
+)
+
+var printDefaultsUsage = `cfssl print-defaults -- print default configurations that can be used as a template
+
+Usage of print-defaults:
+        cfssl print-defaults TYPE
+
+If "list" is used as the TYPE, the list of supported types will be printed.
+`
+
+func printAvailable() {
+	fmt.Println("Default configurations are available for:")
+	for name := range defaults {
+		fmt.Println("\t" + name)
+	}
+}
+
+func printDefaults(args []string, c cli.Config) (err error) {
+	arg, _, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return
+	}
+
+	if arg == "list" {
+		printAvailable()
+	} else {
+		if config, ok := defaults[arg]; !ok {
+			printAvailable()
+		} else {
+			fmt.Println(config)
+		}
+	}
+
+	return
+}
+
+// Command assembles the definition of Command 'print-defaults'
+var Command = &cli.Command{
+	UsageText: printDefaultsUsage,
+	Flags:     []string{},
+	Main:      printDefaults,
+}

vendor/github.com/cloudflare/cfssl/cli/revoke/BUILD

@@ -0,0 +1,30 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["revoke.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/revoke",
+    importpath = "github.com/cloudflare/cfssl/cli/revoke",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/certdb/dbconf:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/sql:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ocsp:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/revoke/revoke.go

@@ -0,0 +1,66 @@
+// Package revoke implements the revoke command.
+package revoke
+
+import (
+	"errors"
+
+	"github.com/cloudflare/cfssl/certdb/dbconf"
+	"github.com/cloudflare/cfssl/certdb/sql"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/ocsp"
+)
+
+var revokeUsageTxt = `cfssl revoke -- revoke a certificate in the certificate store
+
+Usage:
+
+Revoke a certificate:
+	   cfssl revoke -db-config config_file -serial serial -aki authority_key_id [-reason reason]
+
+Reason can be an integer code or a string in ReasonFlags in RFC 5280
+
+Flags:
+`
+
+var revokeFlags = []string{"serial", "reason"}
+
+func revokeMain(args []string, c cli.Config) error {
+	if len(args) > 0 {
+		return errors.New("argument is provided but not defined; please refer to the usage by flag -h")
+	}
+
+	if len(c.Serial) == 0 {
+		return errors.New("serial number is required but not provided")
+	}
+
+	if len(c.AKI) == 0 {
+		return errors.New("authority key id is required but not provided")
+	}
+
+	if c.DBConfigFile == "" {
+		return errors.New("need DB config file (provide with -db-config)")
+	}
+
+	db, err := dbconf.DBFromConfig(c.DBConfigFile)
+	if err != nil {
+		return err
+	}
+
+	dbAccessor := sql.NewAccessor(db)
+
+	reasonCode, err := ocsp.ReasonStringToCode(c.Reason)
+	if err != nil {
+		log.Error("Invalid reason code: ", err)
+		return err
+	}
+
+	return dbAccessor.RevokeCertificate(c.Serial, c.AKI, reasonCode)
+}
+
+// Command assembles the definition of Command 'revoke'
+var Command = &cli.Command{
+	UsageText: revokeUsageTxt,
+	Flags:     revokeFlags,
+	Main:      revokeMain,
+}

vendor/github.com/cloudflare/cfssl/cli/scan/BUILD

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["scan.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/scan",
+    importpath = "github.com/cloudflare/cfssl/cli/scan",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/scan:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/scan/scan.go

@@ -0,0 +1,123 @@
+package scan
+
+import (
+	"encoding/csv"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"sync"
+
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/scan"
+)
+
+var scanUsageText = `cfssl scan -- scan a host for issues
+Usage of scan:
+        cfssl scan [-family regexp] [-scanner regexp] [-timeout duration] [-ip IPAddr] [-num-workers num] [-max-hosts num] [-csv hosts.csv] HOST+
+        cfssl scan -list
+
+Arguments:
+        HOST:    Host(s) to scan (including port)
+Flags:
+`
+var scanFlags = []string{"list", "family", "scanner", "timeout", "ip", "ca-bundle", "num-workers", "csv", "max-hosts"}
+
+func printJSON(v interface{}) {
+	b, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		fmt.Println(err)
+	}
+	fmt.Printf("%s\n\n", b)
+}
+
+type context struct {
+	sync.WaitGroup
+	c     cli.Config
+	hosts chan string
+}
+
+func newContext(c cli.Config, numWorkers int) *context {
+	ctx := &context{
+		c:     c,
+		hosts: make(chan string, numWorkers),
+	}
+	ctx.Add(numWorkers)
+	for i := 0; i < numWorkers; i++ {
+		go ctx.runWorker()
+	}
+	return ctx
+}
+
+func (ctx *context) runWorker() {
+	for host := range ctx.hosts {
+		fmt.Printf("Scanning %s...\n", host)
+		results, err := scan.Default.RunScans(host, ctx.c.IP, ctx.c.Family, ctx.c.Scanner, ctx.c.Timeout)
+		fmt.Printf("=== %s ===\n", host)
+		if err != nil {
+			log.Error(err)
+		} else {
+			printJSON(results)
+		}
+	}
+	ctx.Done()
+}
+
+func parseCSV(hosts []string, csvFile string, maxHosts int) ([]string, error) {
+	f, err := os.Open(csvFile)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	r := csv.NewReader(f)
+	for err == nil && len(hosts) < maxHosts {
+		var record []string
+		record, err = r.Read()
+		hosts = append(hosts, record[len(record)-1])
+	}
+	if err == io.EOF {
+		err = nil
+	}
+
+	return hosts, err
+}
+
+func scanMain(args []string, c cli.Config) (err error) {
+	if c.List {
+		printJSON(scan.Default)
+	} else {
+		if err = scan.LoadRootCAs(c.CABundleFile); err != nil {
+			return
+		}
+
+		if len(args) >= c.MaxHosts {
+			log.Warningf("Only scanning max-hosts=%d out of %d args given", c.MaxHosts, len(args))
+			args = args[:c.MaxHosts]
+		} else if c.CSVFile != "" {
+			args, err = parseCSV(args, c.CSVFile, c.MaxHosts)
+			if err != nil {
+				return
+			}
+		}
+
+		ctx := newContext(c, c.NumWorkers)
+		// Execute for each HOST argument given
+		for len(args) > 0 {
+			var host string
+			host, args, err = cli.PopFirstArgument(args)
+			if err != nil {
+				return
+			}
+
+			ctx.hosts <- host
+		}
+		close(ctx.hosts)
+		ctx.Wait()
+	}
+	return
+}
+
+// Command assembles the definition of Command 'scan'
+var Command = &cli.Command{UsageText: scanUsageText, Flags: scanFlags, Main: scanMain}

vendor/github.com/cloudflare/cfssl/cli/selfsign/BUILD

@@ -0,0 +1,31 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["selfsign.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/selfsign",
+    importpath = "github.com/cloudflare/cfssl/cli/selfsign",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli/genkey:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/config:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/csr:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/selfsign:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/selfsign/selfsign.go

@@ -0,0 +1,120 @@
+// Package selfsign implements the selfsign command.
+package selfsign
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/cli/genkey"
+	"github.com/cloudflare/cfssl/config"
+	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/selfsign"
+)
+
+var selfSignUsageText = `cfssl selfsign -- generate a new self-signed key and signed certificate
+
+Usage of gencert:
+        cfssl selfsign HOSTNAME CSRJSON
+
+WARNING: this should ONLY be used for testing. This should never be
+used in production.
+
+WARNING: self-signed certificates are insecure; they do not provide
+the authentication required for secure systems. Use these at your own
+risk.
+
+Arguments:
+        HOSTNAME:   Hostname for the cert
+        CSRJSON:    JSON file containing the request, use '-' for reading JSON from stdin
+
+Flags:
+`
+
+var selfSignFlags = []string{"config"}
+
+func selfSignMain(args []string, c cli.Config) (err error) {
+	if c.Hostname == "" && !c.IsCA {
+		c.Hostname, args, err = cli.PopFirstArgument(args)
+		if err != nil {
+			return
+		}
+	}
+
+	csrFile, args, err := cli.PopFirstArgument(args)
+	if err != nil {
+		return
+	}
+
+	if len(args) > 0 {
+		return errors.New("too many arguments are provided, please check with usage")
+	}
+
+	csrFileBytes, err := cli.ReadStdin(csrFile)
+	if err != nil {
+		return
+	}
+
+	var req = csr.New()
+	err = json.Unmarshal(csrFileBytes, req)
+	if err != nil {
+		return
+	}
+
+	var key, csrPEM []byte
+	g := &csr.Generator{Validator: genkey.Validator}
+	csrPEM, key, err = g.ProcessRequest(req)
+	if err != nil {
+		key = nil
+		return
+	}
+
+	priv, err := helpers.ParsePrivateKeyPEM(key)
+	if err != nil {
+		key = nil
+		return
+	}
+
+	var profile *config.SigningProfile
+
+	// If there is a config, use its signing policy. Otherwise, leave policy == nil
+	// and NewSigner will use DefaultConfig().
+	if c.CFG != nil {
+		if c.Profile != "" && c.CFG.Signing.Profiles != nil {
+			profile = c.CFG.Signing.Profiles[c.Profile]
+		}
+	}
+
+	if profile == nil {
+		profile = config.DefaultConfig()
+		profile.Expiry = 2190 * time.Hour
+	}
+
+	cert, err := selfsign.Sign(priv, csrPEM, profile)
+	if err != nil {
+		key = nil
+		priv = nil
+		return
+	}
+
+	fmt.Fprintf(os.Stderr, `*** WARNING ***
+
+Self-signed certificates are dangerous. Use this self-signed
+certificate at your own risk.
+
+It is strongly recommended that these certificates NOT be used
+in production.
+
+*** WARNING ***
+
+`)
+	cli.PrintCert(key, csrPEM, cert)
+	return
+}
+
+// Command assembles the definition of Command 'selfsign'
+var Command = &cli.Command{UsageText: selfSignUsageText, Flags: selfSignFlags, Main: selfSignMain}

vendor/github.com/cloudflare/cfssl/cli/serve/BUILD

@@ -0,0 +1,50 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["serve.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/serve",
+    importpath = "github.com/cloudflare/cfssl/cli/serve",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/GeertJohan/go.rice:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/bundle:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/certinfo:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/crl:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/gencrl:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/generator:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/info:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/initca:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/ocsp:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/revoke:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/scan:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/api/signhandler:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/bundler:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/dbconf:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/sql:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli/ocspsign:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli/sign:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/helpers:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ocsp:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/signer:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/ubiquity:go_default_library",
+        "//vendor/github.com/jmoiron/sqlx:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/serve/README.md

@@ -0,0 +1,13 @@
+## Compiling and serving static files using esc
+
+```
+go install github.com/mjibson/esc
+
+# Compile changes to static files 
+cd $GOPATH/src/github.com/cloudflare/cfssl
+esc -pkg serve -prefix cli/serve/static cli/serve/static > cli/serve/static.go
+
+# Build and run CFSSL
+go build ./cmd/cfssl/...
+./cfssl serve
+```

vendor/github.com/cloudflare/cfssl/cli/serve/serve.go

@@ -0,0 +1,365 @@
+// Package serve implements the serve command for CFSSL's API.
+package serve
+
+import (
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+
+	rice "github.com/GeertJohan/go.rice"
+	"github.com/cloudflare/cfssl/api"
+	"github.com/cloudflare/cfssl/api/bundle"
+	"github.com/cloudflare/cfssl/api/certinfo"
+	"github.com/cloudflare/cfssl/api/crl"
+	"github.com/cloudflare/cfssl/api/gencrl"
+	"github.com/cloudflare/cfssl/api/generator"
+	"github.com/cloudflare/cfssl/api/info"
+	"github.com/cloudflare/cfssl/api/initca"
+	apiocsp "github.com/cloudflare/cfssl/api/ocsp"
+	"github.com/cloudflare/cfssl/api/revoke"
+	"github.com/cloudflare/cfssl/api/scan"
+	"github.com/cloudflare/cfssl/api/signhandler"
+	"github.com/cloudflare/cfssl/bundler"
+	"github.com/cloudflare/cfssl/certdb/dbconf"
+	certsql "github.com/cloudflare/cfssl/certdb/sql"
+	"github.com/cloudflare/cfssl/cli"
+	ocspsign "github.com/cloudflare/cfssl/cli/ocspsign"
+	"github.com/cloudflare/cfssl/cli/sign"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/ocsp"
+	"github.com/cloudflare/cfssl/signer"
+	"github.com/cloudflare/cfssl/ubiquity"
+
+	"github.com/jmoiron/sqlx"
+)
+
+// Usage text of 'cfssl serve'
+var serverUsageText = `cfssl serve -- set up a HTTP server handles CF SSL requests
+
+Usage of serve:
+        cfssl serve [-address address] [-ca cert] [-ca-bundle bundle] \
+                    [-ca-key key] [-int-bundle bundle] [-int-dir dir] [-port port] \
+                    [-metadata file] [-remote remote_host] [-config config] \
+                    [-responder cert] [-responder-key key] [-tls-cert cert] [-tls-key key] \
+                    [-mutual-tls-ca ca] [-mutual-tls-cn regex] \
+                    [-tls-remote-ca ca] [-mutual-tls-client-cert cert] [-mutual-tls-client-key key] \
+                    [-db-config db-config]
+
+Flags:
+`
+
+// Flags used by 'cfssl serve'
+var serverFlags = []string{"address", "port", "ca", "ca-key", "ca-bundle", "int-bundle", "int-dir", "metadata",
+	"remote", "config", "responder", "responder-key", "tls-key", "tls-cert", "mutual-tls-ca", "mutual-tls-cn",
+	"tls-remote-ca", "mutual-tls-client-cert", "mutual-tls-client-key", "db-config"}
+
+var (
+	conf       cli.Config
+	s          signer.Signer
+	ocspSigner ocsp.Signer
+	db         *sqlx.DB
+)
+
+// V1APIPrefix is the prefix of all CFSSL V1 API Endpoints.
+var V1APIPrefix = "/api/v1/cfssl/"
+
+// v1APIPath prepends the V1 API prefix to endpoints not beginning with "/"
+func v1APIPath(path string) string {
+	if !strings.HasPrefix(path, "/") {
+		path = V1APIPrefix + path
+	}
+	return (&url.URL{Path: path}).String()
+}
+
+// httpBox implements http.FileSystem which allows the use of Box with a http.FileServer.
+// Atempting to Open an API endpoint will result in an error.
+type httpBox struct {
+	*rice.Box
+	redirects map[string]string
+}
+
+func (hb *httpBox) findStaticBox() (err error) {
+	hb.Box, err = rice.FindBox("static")
+	return
+}
+
+// Open returns a File for non-API enpoints using the http.File interface.
+func (hb *httpBox) Open(name string) (http.File, error) {
+	if strings.HasPrefix(name, V1APIPrefix) {
+		return nil, os.ErrNotExist
+	}
+
+	if location, ok := hb.redirects[name]; ok {
+		return hb.Box.Open(location)
+	}
+
+	return hb.Box.Open(name)
+}
+
+// staticBox is the box containing all static assets.
+var staticBox = &httpBox{
+	redirects: map[string]string{
+		"/scan":   "/index.html",
+		"/bundle": "/index.html",
+	},
+}
+
+var errBadSigner = errors.New("signer not initialized")
+var errNoCertDBConfigured = errors.New("cert db not configured (missing -db-config)")
+
+var endpoints = map[string]func() (http.Handler, error){
+	"sign": func() (http.Handler, error) {
+		if s == nil {
+			return nil, errBadSigner
+		}
+
+		h, err := signhandler.NewHandlerFromSigner(s)
+		if err != nil {
+			return nil, err
+		}
+
+		if conf.CABundleFile != "" && conf.IntBundleFile != "" {
+			sh := h.Handler.(*signhandler.Handler)
+			if err := sh.SetBundler(conf.CABundleFile, conf.IntBundleFile); err != nil {
+				return nil, err
+			}
+		}
+
+		return h, nil
+	},
+
+	"authsign": func() (http.Handler, error) {
+		if s == nil {
+			return nil, errBadSigner
+		}
+
+		h, err := signhandler.NewAuthHandlerFromSigner(s)
+		if err != nil {
+			return nil, err
+		}
+
+		if conf.CABundleFile != "" && conf.IntBundleFile != "" {
+			sh := h.(*api.HTTPHandler).Handler.(*signhandler.AuthHandler)
+			if err := sh.SetBundler(conf.CABundleFile, conf.IntBundleFile); err != nil {
+				return nil, err
+			}
+		}
+
+		return h, nil
+	},
+
+	"info": func() (http.Handler, error) {
+		if s == nil {
+			return nil, errBadSigner
+		}
+		return info.NewHandler(s)
+	},
+
+	"crl": func() (http.Handler, error) {
+		if s == nil {
+			return nil, errBadSigner
+		}
+
+		if db == nil {
+			return nil, errNoCertDBConfigured
+		}
+
+		return crl.NewHandler(certsql.NewAccessor(db), conf.CAFile, conf.CAKeyFile)
+	},
+
+	"gencrl": func() (http.Handler, error) {
+		if s == nil {
+			return nil, errBadSigner
+		}
+		return gencrl.NewHandler(), nil
+	},
+
+	"newcert": func() (http.Handler, error) {
+		if s == nil {
+			return nil, errBadSigner
+		}
+		h := generator.NewCertGeneratorHandlerFromSigner(generator.CSRValidate, s)
+		if conf.CABundleFile != "" && conf.IntBundleFile != "" {
+			cg := h.(api.HTTPHandler).Handler.(*generator.CertGeneratorHandler)
+			if err := cg.SetBundler(conf.CABundleFile, conf.IntBundleFile); err != nil {
+				return nil, err
+			}
+		}
+		return h, nil
+	},
+
+	"bundle": func() (http.Handler, error) {
+		return bundle.NewHandler(conf.CABundleFile, conf.IntBundleFile)
+	},
+
+	"newkey": func() (http.Handler, error) {
+		return generator.NewHandler(generator.CSRValidate)
+	},
+
+	"init_ca": func() (http.Handler, error) {
+		return initca.NewHandler(), nil
+	},
+
+	"scan": func() (http.Handler, error) {
+		return scan.NewHandler(conf.CABundleFile)
+	},
+
+	"scaninfo": func() (http.Handler, error) {
+		return scan.NewInfoHandler(), nil
+	},
+
+	"certinfo": func() (http.Handler, error) {
+		return certinfo.NewHandler(), nil
+	},
+
+	"ocspsign": func() (http.Handler, error) {
+		if ocspSigner == nil {
+			return nil, errBadSigner
+		}
+		return apiocsp.NewHandler(ocspSigner), nil
+	},
+
+	"revoke": func() (http.Handler, error) {
+		if db == nil {
+			return nil, errNoCertDBConfigured
+		}
+		return revoke.NewHandler(certsql.NewAccessor(db)), nil
+	},
+
+	"/": func() (http.Handler, error) {
+		if err := staticBox.findStaticBox(); err != nil {
+			return nil, err
+		}
+
+		return http.FileServer(staticBox), nil
+	},
+}
+
+// registerHandlers instantiates various handlers and associate them to corresponding endpoints.
+func registerHandlers() {
+	for path, getHandler := range endpoints {
+		log.Debugf("getHandler for %s", path)
+		if handler, err := getHandler(); err != nil {
+			log.Warningf("endpoint '%s' is disabled: %v", path, err)
+		} else {
+			if path, handler, err = wrapHandler(path, handler, err); err != nil {
+				log.Warningf("endpoint '%s' is disabled by wrapper: %v", path, err)
+			} else {
+				log.Infof("endpoint '%s' is enabled", path)
+				http.Handle(path, handler)
+			}
+		}
+	}
+	log.Info("Handler set up complete.")
+}
+
+// serverMain is the command line entry point to the API server. It sets up a
+// new HTTP server to handle sign, bundle, and validate requests.
+func serverMain(args []string, c cli.Config) error {
+	conf = c
+	// serve doesn't support arguments.
+	if len(args) > 0 {
+		return errors.New("argument is provided but not defined; please refer to the usage by flag -h")
+	}
+
+	bundler.IntermediateStash = conf.IntDir
+	var err error
+
+	if err = ubiquity.LoadPlatforms(conf.Metadata); err != nil {
+		return err
+	}
+
+	if c.DBConfigFile != "" {
+		db, err = dbconf.DBFromConfig(c.DBConfigFile)
+		if err != nil {
+			return err
+		}
+	}
+
+	log.Info("Initializing signer")
+
+	if s, err = sign.SignerFromConfigAndDB(c, db); err != nil {
+		log.Warningf("couldn't initialize signer: %v", err)
+	}
+
+	if ocspSigner, err = ocspsign.SignerFromConfig(c); err != nil {
+		log.Warningf("couldn't initialize ocsp signer: %v", err)
+	}
+
+	registerHandlers()
+
+	addr := net.JoinHostPort(conf.Address, strconv.Itoa(conf.Port))
+
+	if conf.TLSCertFile == "" || conf.TLSKeyFile == "" {
+		log.Info("Now listening on ", addr)
+		return http.ListenAndServe(addr, nil)
+	}
+	if conf.MutualTLSCAFile != "" {
+		clientPool, err := helpers.LoadPEMCertPool(conf.MutualTLSCAFile)
+		if err != nil {
+			return fmt.Errorf("failed to load mutual TLS CA file: %s", err)
+		}
+
+		server := http.Server{
+			Addr: addr,
+			TLSConfig: &tls.Config{
+				ClientAuth: tls.RequireAndVerifyClientCert,
+				ClientCAs:  clientPool,
+			},
+		}
+
+		if conf.MutualTLSCNRegex != "" {
+			log.Debugf(`Requiring CN matches regex "%s" for client connections`, conf.MutualTLSCNRegex)
+			re, err := regexp.Compile(conf.MutualTLSCNRegex)
+			if err != nil {
+				return fmt.Errorf("malformed CN regex: %s", err)
+			}
+			server.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r != nil && r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
+					if re.MatchString(r.TLS.PeerCertificates[0].Subject.CommonName) {
+						http.DefaultServeMux.ServeHTTP(w, r)
+						return
+					}
+					log.Warningf(`Rejected client cert CN "%s" does not match regex %s`,
+						r.TLS.PeerCertificates[0].Subject.CommonName, conf.MutualTLSCNRegex)
+				}
+				http.Error(w, "Invalid CN", http.StatusForbidden)
+			})
+		}
+		log.Info("Now listening with mutual TLS on https://", addr)
+		return server.ListenAndServeTLS(conf.TLSCertFile, conf.TLSKeyFile)
+	}
+	log.Info("Now listening on https://", addr)
+	return http.ListenAndServeTLS(addr, conf.TLSCertFile, conf.TLSKeyFile, nil)
+
+}
+
+// Command assembles the definition of Command 'serve'
+var Command = &cli.Command{UsageText: serverUsageText, Flags: serverFlags, Main: serverMain}
+
+var wrapHandler = defaultWrapHandler
+
+// The default wrapper simply returns the normal handler and prefixes the path appropriately
+func defaultWrapHandler(path string, handler http.Handler, err error) (string, http.Handler, error) {
+	return v1APIPath(path), handler, err
+}
+
+// SetWrapHandler sets the wrap handler which is called for all endpoints
+// A custom wrap handler may be provided in order to add arbitrary server-side pre or post processing
+// of server-side HTTP handling of requests.
+func SetWrapHandler(wh func(path string, handler http.Handler, err error) (string, http.Handler, error)) {
+	wrapHandler = wh
+}
+
+// SetEndpoint can be used to add additional routes/endpoints to the HTTP server, or to override an existing route/endpoint
+func SetEndpoint(path string, getHandler func() (http.Handler, error)) {
+	endpoints[path] = getHandler
+}

vendor/github.com/cloudflare/cfssl/cli/sign/BUILD

@@ -0,0 +1,33 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["sign.go"],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/sign",
+    importpath = "github.com/cloudflare/cfssl/cli/sign",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/cloudflare/cfssl/certdb/dbconf:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/certdb/sql:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/cli:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/config:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/log:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/signer:go_default_library",
+        "//vendor/github.com/cloudflare/cfssl/signer/universal:go_default_library",
+        "//vendor/github.com/jmoiron/sqlx:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/sign/sign.go

@@ -0,0 +1,181 @@
+// Package sign implements the sign command.
+package sign
+
+import (
+	"encoding/json"
+	"errors"
+	"io/ioutil"
+
+	"github.com/cloudflare/cfssl/certdb/dbconf"
+	certsql "github.com/cloudflare/cfssl/certdb/sql"
+	"github.com/cloudflare/cfssl/cli"
+	"github.com/cloudflare/cfssl/config"
+	"github.com/cloudflare/cfssl/log"
+	"github.com/cloudflare/cfssl/signer"
+	"github.com/cloudflare/cfssl/signer/universal"
+
+	"github.com/jmoiron/sqlx"
+)
+
+// Usage text of 'cfssl sign'
+var signerUsageText = `cfssl sign -- signs a client cert with a host name by a given CA and CA key
+
+Usage of sign:
+        cfssl sign -ca cert -ca-key key [mutual-tls-cert cert] [mutual-tls-key key] [-config config] [-profile profile] [-hostname hostname] [-db-config db-config] CSR [SUBJECT]
+        cfssl sign -remote remote_host [mutual-tls-cert cert] [mutual-tls-key key] [-config config] [-profile profile] [-label label] [-hostname hostname] CSR [SUBJECT]
+
+Arguments:
+        CSR:        PEM file for certificate request, use '-' for reading PEM from stdin.
+
+Note: CSR can also be supplied via flag values; flag value will take precedence over the argument.
+
+SUBJECT is an optional file containing subject information to use for the certificate instead of the subject information in the CSR.
+
+Flags:
+`
+
+// Flags of 'cfssl sign'
+var signerFlags = []string{"hostname", "csr", "ca", "ca-key", "config", "profile", "label", "remote",
+	"mutual-tls-cert", "mutual-tls-key", "db-config"}
+
+// SignerFromConfigAndDB takes the Config and creates the appropriate
+// signer.Signer object with a specified db
+func SignerFromConfigAndDB(c cli.Config, db *sqlx.DB) (signer.Signer, error) {
+	// If there is a config, use its signing policy. Otherwise create a default policy.
+	var policy *config.Signing
+	if c.CFG != nil {
+		policy = c.CFG.Signing
+	} else {
+		policy = &config.Signing{
+			Profiles: map[string]*config.SigningProfile{},
+			Default:  config.DefaultConfig(),
+		}
+	}
+
+	// Make sure the policy reflects the new remote
+	if c.Remote != "" {
+		err := policy.OverrideRemotes(c.Remote)
+		if err != nil {
+			log.Infof("Invalid remote %v, reverting to configuration default", c.Remote)
+			return nil, err
+		}
+	}
+
+	if c.MutualTLSCertFile != "" && c.MutualTLSKeyFile != "" {
+		err := policy.SetClientCertKeyPairFromFile(c.MutualTLSCertFile, c.MutualTLSKeyFile)
+		if err != nil {
+			log.Infof("Invalid mutual-tls-cert: %s or mutual-tls-key: %s, defaulting to no client auth", c.MutualTLSCertFile, c.MutualTLSKeyFile)
+			return nil, err
+		}
+		log.Infof("Using client auth with mutual-tls-cert: %s and mutual-tls-key: %s", c.MutualTLSCertFile, c.MutualTLSKeyFile)
+	}
+
+	if c.TLSRemoteCAs != "" {
+		err := policy.SetRemoteCAsFromFile(c.TLSRemoteCAs)
+		if err != nil {
+			log.Infof("Invalid tls-remote-ca: %s, defaulting to system trust store", c.TLSRemoteCAs)
+			return nil, err
+		}
+		log.Infof("Using trusted CA from tls-remote-ca: %s", c.TLSRemoteCAs)
+	}
+
+	s, err := universal.NewSigner(cli.RootFromConfig(&c), policy)
+	if err != nil {
+		return nil, err
+	}
+
+	if db != nil {
+		dbAccessor := certsql.NewAccessor(db)
+		s.SetDBAccessor(dbAccessor)
+	}
+
+	return s, nil
+}
+
+// SignerFromConfig takes the Config and creates the appropriate
+// signer.Signer object
+func SignerFromConfig(c cli.Config) (s signer.Signer, err error) {
+	var db *sqlx.DB
+	if c.DBConfigFile != "" {
+		db, err = dbconf.DBFromConfig(c.DBConfigFile)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return SignerFromConfigAndDB(c, db)
+}
+
+// signerMain is the main CLI of signer functionality.
+// [TODO: zi] Decide whether to drop the argument list and only use flags to specify all the inputs.
+func signerMain(args []string, c cli.Config) (err error) {
+	if c.CSRFile == "" {
+		c.CSRFile, args, err = cli.PopFirstArgument(args)
+		if err != nil {
+			return
+		}
+	}
+
+	var subjectData *signer.Subject
+	if len(args) > 0 {
+		var subjectFile string
+		subjectFile, args, err = cli.PopFirstArgument(args)
+		if err != nil {
+			return
+		}
+		if len(args) > 0 {
+			return errors.New("too many arguments are provided, please check with usage")
+		}
+
+		var subjectJSON []byte
+		subjectJSON, err = ioutil.ReadFile(subjectFile)
+		if err != nil {
+			return
+		}
+
+		subjectData = new(signer.Subject)
+		err = json.Unmarshal(subjectJSON, subjectData)
+		if err != nil {
+			return
+		}
+	}
+
+	csr, err := cli.ReadStdin(c.CSRFile)
+	if err != nil {
+		return
+	}
+
+	// Remote can be forced on the command line or in the config
+	if c.Remote == "" && c.CFG == nil {
+		if c.CAFile == "" {
+			log.Error("need CA certificate (provide one with -ca)")
+			return
+		}
+
+		if c.CAKeyFile == "" {
+			log.Error("need CA key (provide one with -ca-key)")
+			return
+		}
+	}
+
+	s, err := SignerFromConfig(c)
+	if err != nil {
+		return
+	}
+
+	req := signer.SignRequest{
+		Hosts:   signer.SplitHosts(c.Hostname),
+		Request: string(csr),
+		Subject: subjectData,
+		Profile: c.Profile,
+		Label:   c.Label,
+	}
+	cert, err := s.Sign(req)
+	if err != nil {
+		return
+	}
+	cli.PrintCert(nil, csr, cert)
+	return
+}
+
+// Command assembles the definition of Command 'sign'
+var Command = &cli.Command{UsageText: signerUsageText, Flags: signerFlags, Main: signerMain}

vendor/github.com/cloudflare/cfssl/cli/version/BUILD

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "version.go",
+        "version_dev.go",
+    ],
+    importmap = "k8s.io/kubernetes/vendor/github.com/cloudflare/cfssl/cli/version",
+    importpath = "github.com/cloudflare/cfssl/cli/version",
+    visibility = ["//visibility:public"],
+    deps = ["//vendor/github.com/cloudflare/cfssl/cli:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/cloudflare/cfssl/cli/version/version.go

@@ -0,0 +1,42 @@
+// Package version implements the version command.
+package version
+
+import (
+	"fmt"
+	"runtime"
+
+	"github.com/cloudflare/cfssl/cli"
+)
+
+// Version stores the semantic versioning information for CFSSL.
+var version = struct {
+	Major    int
+	Minor    int
+	Patch    int
+	Revision string
+}{1, 3, 0, "release"}
+
+func versionString() string {
+	return fmt.Sprintf("%d.%d.%d", version.Major, version.Minor, version.Patch)
+}
+
+// Usage text for 'cfssl version'
+var versionUsageText = `cfssl version -- print out the version of CF SSL
+
+Usage of version:
+	cfssl version
+`
+
+// FormatVersion returns the formatted version string.
+func FormatVersion() string {
+	return fmt.Sprintf("Version: %s\nRevision: %s\nRuntime: %s\n", versionString(), version.Revision, runtime.Version())
+}
+
+// The main functionality of 'cfssl version' is to print out the version info.
+func versionMain(args []string, c cli.Config) (err error) {
+	fmt.Printf("%s", FormatVersion())
+	return nil
+}
+
+// Command assembles the definition of Command 'version'
+var Command = &cli.Command{UsageText: versionUsageText, Flags: nil, Main: versionMain}

vendor/github.com/cloudflare/cfssl/cli/version/version_dev.go

@@ -0,0 +1,7 @@
+// +build !release
+
+package version
+
+func init() {
+	version.Revision = "dev"
+}