Restore Certificates Manually for On-Prem Deployments [Internal Only]

# systemctl stop pf9-hostagent pf9-nodeletd

# /opt/pf9/nodelet/nodeletd phases stop

# /opt/pf9/nodelet/nodeletd phases start

# systemctl start pf9-hostagent

#!/usr/bin/env bash

CONFIG_DIR=${CONFIG_DIR:-/etc/pf9}

source $CONFIG_DIR/kube.env

if [ -e "$CONFIG_DIR/kube_override.env" ]; then

    source $CONFIG_DIR/kube_override.env

fi

KUBE_DIR=$CONFIG_DIR/kube.d

cert_dir=$KUBE_DIR/certs

nodelet_running=`systemctl is-active pf9-nodeletd`

if [ "$nodelet_running" == "active" ]; then

    echo "pf9-nodeletd is running. Please stop the service before running this script."

    echo "systemctl stop pf9-hostagent pf9-nodeletd"

    exit 1

fi

if [ -d $cert_dir ]; then

    echo "Actual cert dir: $cert_dir already present. Exiting!"

    exit 1

fiv

cert_dir_name=`ls -ltr $KUBE_DIR | grep 'certs.teardown' | head -1 | awk -F ' ' '{print $NF}' | xargs`

if [ "x$cert_dir_name" == "x" ]; then

    echo "No certificate backup directories found"

    exit 1

fi

backup_cert_dir=$KUBE_DIR/$cert_dir_name

# kubelet certs get created on both worker and master

kubelet_ca_cert=$backup_cert_dir/kubelet/server/ca.crt

backup_done_file=$backup_cert_dir/.done

if ! [ -f $backup_done_file ]; then

    echo "Unable to determine if latest backup of certs were generated correctly"

    exit 1

fi

exit_code=$(grep -q "CLUSTER_ROLE ${ROLE}" $backup_done_file; echo $?)

if ! [ $exit_code -eq 0 ]; then

    echo "Unable to validate if certs were generated for current role"

    exit 1

fi

exit_code=$(grep -q "CLUSTER_ID ${CLUSTER_ID}" $backup_done_file; echo $?)

if ! [ $exit_code -eq 0 ]; then

    echo "Unable to validate if certs were generated for current cluster"

    exit 1

fi

if ! [ -f $kubelet_ca_cert ]; then

    echo "Kubelet ca cert file missing"

    exit 1

fi

# check if cert end date is at least greater than now

cert_date=`openssl x509 -noout -enddate -in $kubelet_ca_cert | awk -F '=' '{print $2}'`

epoch_cert_date=`date -d "$cert_date" +%s`

epoch_curr_date=`date +%s`

if [ $epoch_cert_date -lt $epoch_curr_date ]; then

    echo "Cert end date is less than current date"

    exit 1

fi

echo "Validations complete."

echo "Latest certificate to restore from: $backup_cert_dir"

echo "Backed up certs expiring on: $cert_date"

echo "Proceed with restore (y/n) [default: n]?"

read choice

if [ "x$choice" != "xy" ]; then

    echo "Exiting on user input."

    exit 1

fi

cp -pr $backup_cert_dir $cert_dir

echo "Certificates restored successfully!"