Harden Kubernetes lab CA profile [skip ci]

tools/lab/govoplan_lab/lifecycle.py

@@ -857,6 +857,7 @@ def _ensure_certificates(config: LabConfig, runner: CommandRunner) -> None:
     ca_valid = (
         ca_key.is_file()
         and ca_cert.is_file()
+        and _ca_key_usage_is_valid(runner, ca_cert)
         and runner.run(
             [
                 "openssl",
@@ -900,6 +901,10 @@ def _ensure_certificates(config: LabConfig, runner: CommandRunner) -> None:
                 str(ca_key),
                 "-subj",
                 f"/CN={config.name} private lab CA",
+                "-addext",
+                "basicConstraints=critical,CA:TRUE",
+                "-addext",
+                "keyUsage=critical,keyCertSign,cRLSign",
                 "-out",
                 str(ca_cert),
             ],
@@ -988,6 +993,28 @@ def _ensure_certificates(config: LabConfig, runner: CommandRunner) -> None:
     write_private(config.state_directory / "hosts", render_hosts(config))
 
 
+def _ca_key_usage_is_valid(runner: CommandRunner, certificate: Path) -> bool:
+    result = runner.run(
+        [
+            "openssl",
+            "x509",
+            "-in",
+            str(certificate),
+            "-noout",
+            "-ext",
+            "keyUsage",
+        ],
+        capture=True,
+        check=False,
+    )
+    output = result.stdout.decode("utf-8", errors="replace")
+    return (
+        result.returncode == 0
+        and "Certificate Sign" in output
+        and "CRL Sign" in output
+    )
+
+
 def _deploy_state_services(
     config: LabConfig,
     runner: CommandRunner,