code: def create_key_and_cert(p):
      name = p["name"]
      domains = p["domains"]
      unmanaged = p.get("unmanaged", False)
      if unmanaged and namespace != "default":
          return {}
      key_file = f"{name}-key.pem"
      csr_file = f"{name}-csr.csr"
      cert_file = f"{name}-cert.pem"
      key_store_file = f"{name}-key-store.p12"
      names = [
          domain_name
          for domain in domains
          for domain_name in [
              domain,
              f"{domain}.{namespace}",
              f"{domain}.{namespace}.svc.cluster.local",
          ]
      ]
  
      echo_check_call(["openssl", "genrsa", "-out", key_file, "4096"])
      echo_check_call(
          [
              "openssl",
              "req",
              "-new",
              "-subj",
              f"/CN={names[0]}",
              "-key",
              key_file,
              "-out",
              csr_file,
          ]
      )
      extfile = tempfile.NamedTemporaryFile(mode="w", delete=False)
      # this whole extfile nonsense is because OpenSSL has known, unfixed bugs
      # in the x509 command. These really ought to be in the CSR.
      # https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS
      # https://security.stackexchange.com/questions/150078/missing-x509-extensions-with-an-openssl-generated-certificate
      extfile.write(
          f'subjectAltName = {",".join("DNS:" + n for n in names)}\n'
      )
      extfile.close()
      echo_check_call(["cat", extfile.name])
      echo_check_call(
          [
              "openssl",
              "x509",
              "-req",
              "-in",
              csr_file,
              "-CA",
              root_cert_file,
              "-CAkey",
              root_key_file,
              "-extfile",
              extfile.name,
              "-CAcreateserial",
              "-out",
              cert_file,
              "-days",
              "365",
              "-sha256",
          ]
      )
      echo_check_call(
          [
              "openssl",
              "pkcs12",
              "-export",
              "-inkey",
              key_file,
              "-in",
              cert_file,
              "-name",
              f"{name}-key-store",
              "-out",
              key_store_file,
              "-passout",
              "pass:dummypw",
          ]
      )
      return {
          "key": key_file,
          "cert": cert_file,
          "key_store": key_store_file,
      }
  
file_path: hail/tls/create_certs.py
imports: import argparse
  import json
  import shutil
  import subprocess
  import tempfile
  import yaml
label_desc: Use image node_id 2 for calling a global function with example usage: create_key_and_cert(p) and returns: dict, dict