From 01a5ea0843bd25a422993ff267567609f67351a5 Mon Sep 17 00:00:00 2001 From: Rei Oliveira Date: Thu, 28 Mar 2024 14:28:34 -0300 Subject: [PATCH] First check Root CAs on kube-cert-rotation.sh As of now, the script only verifies the validity of leaf certificates and, if expired, will regenerate them based on K8s/etcd Root CAs. It doesn't account for the possibility of Root CAs being expired. It will generate leaf certificates based on Root CAs, even if said Root CAs are expired. This change fixes that behaviour by first checking validity of Root CAs and only allowing leaf certificate renewal if RCAs are valid. Test plan: PASS: Cause Root CAs to expire, run kube-cert-rotation.sh script and verify that it fails with an error saying Root CAs are expired and leaf certificates are not renewed. PASS: Ensure to have valid Root CAs, cause leaf certificates to expire, run kube-cert-rotation.sh and verify that the script executes normally and is able to renew the leaf certificates. Closes-Bug: 2059708 Signed-off-by: Rei Oliveira Change-Id: I98dfd8d1417754f3c723d8ddd52a856785ffc83b --- sysinv/sysinv/sysinv/scripts/kube-cert-rotation.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sysinv/sysinv/sysinv/scripts/kube-cert-rotation.sh b/sysinv/sysinv/sysinv/scripts/kube-cert-rotation.sh index 6c6c265d77..f941b4a091 100644 --- a/sysinv/sysinv/sysinv/scripts/kube-cert-rotation.sh +++ b/sysinv/sysinv/sysinv/scripts/kube-cert-rotation.sh @@ -177,6 +177,18 @@ RESTART_SYSINV=0 RESTART_CERT_MON=0 RESTART_ETCD=0 +# Fist check the validity of the Root CAs in /etc/kubernetes/pki/ca.crt and /etc/etcd/ca.crt +# If they are expired the process should not continue +for CA in /etc/kubernetes/pki/ca.crt /etc/etcd/ca.crt; +do + sudo cat ${CA} | openssl x509 -checkend 0 >/dev/null + RC=$? + if [ ${RC} -eq 1 ]; then + echo "${CA} Root CA is expired. Leaf certificates renewal will not be attempted." + ERR=1 + fi +done + # step 1, renew kubernetes certificates # Renew apiserver certificate if [ ${ERR} -eq 0 ]; then