gen_expired_tls.sh

#!/bin/bash

WORK_DIR=`mktemp -d`

pushd $WORK_DIR > /dev/null 2>&1

# Generate CA certificate
openssl genrsa -out test-expired.key 2048 > /dev/null 2>&1
openssl req -x509 -new -nodes -key test-expired.key -days 1024 -subj '/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=OpenShift/CN=test-expired.com/emailAddress=none@test-expired.com/' -out test-expired.crt > /dev/null 2>&1

# Create a bogus expired master.server.crt
openssl genrsa -out master.server.key 2048 > /dev/null 2>&1
openssl req -new -key master.server.key -subj '/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=OpenShift/CN=master.test-expired.com/emailAddress=none@test-expired.com/' -out master.server.csr > /dev/null 2>&1
openssl x509 -req -in master.server.csr -CA test-expired.crt -CAkey test-expired.key -CAcreateserial -out master.server.crt -days -1 > /dev/null 2>&1

popd > /dev/null 2>&1

# Place the same bogus certificate within etcd, master and node
# directories s.t. each service will have one expired certificate.

cp -f $WORK_DIR/master.server.crt /etc/origin/master/master.server.crt
cp -f $WORK_DIR/master.server.key /etc/origin/master/master.server.key

cp -f $WORK_DIR/master.server.crt /etc/etcd/server.crt
cp -f $WORK_DIR/master.server.key /etc/etcd/server.key

cp -f $WORK_DIR/master.server.crt /etc/origin/node/server.crt
cp -f $WORK_DIR/master.server.key /etc/origin/node/server.key

rm -rf $WORK_DIR

output.log

PLAY [Check cert expirys] ***********************************************************************************************************************************************

TASK [openshift_certificate_expiry : Check cert expirys on host] ********************************************************************************************************
ok: [master3.abutcher.com]
ok: [master2.abutcher.com]
ok: [master1.abutcher.com]

TASK [openshift_certificate_expiry : Generate expiration report HTML] ***************************************************************************************************
skipping: [master1.abutcher.com]

TASK [openshift_certificate_expiry : Generate the result JSON string] ***************************************************************************************************
skipping: [master1.abutcher.com]

TASK [openshift_certificate_expiry : Generate results JSON file] ********************************************************************************************************
skipping: [master1.abutcher.com]

TASK [debug] ************************************************************************************************************************************************************
ok: [master1.abutcher.com] => {
    "changed": false
}

MSG:

EXPIRED ETCD CERTS

TASK [debug] ************************************************************************************************************************************************************
ok: [master1.abutcher.com] => {
    "changed": false
}

MSG:

EXPIRED MASTER CERTS

TASK [debug] ************************************************************************************************************************************************************
ok: [master1.abutcher.com] => {
    "changed": false
}

MSG:

EXPIRED NODE CERTS

PLAY RECAP **************************************************************************************************************************************************************
master1.abutcher.com       : ok=4    changed=0    unreachable=0    failed=0   
master2.abutcher.com       : ok=1    changed=0    unreachable=0    failed=0   
master3.abutcher.com       : ok=1    changed=0    unreachable=0    failed=0   

test.yml

---
- name: Check cert expirys
  hosts: nodes:masters:etcd
  become: yes
  gather_facts: no
  vars:
    openshift_certificate_expiry_show_all: yes
  roles:
    - role: openshift_certificate_expiry
  tasks:
  - debug: msg="EXPIRED ETCD CERTS"
    when: ('expired' in (hostvars
                         | oo_select_keys(groups['etcd'])
                         | oo_collect('check_results.check_results.etcd')
                         | oo_collect('health')))
    run_once: true
  - debug: msg="EXPIRED MASTER CERTS"
    when: ('expired' in hostvars
                        | oo_select_keys(groups['masters'])
                        | oo_collect('check_results.check_results.ocp_certs')
                        | oo_collect('health', {'path':'/etc/origin/master/master.server.crt'}))
          or
          ('expired' in hostvars
                        | oo_select_keys(groups['masters'])
                        | oo_collect('check_results.check_results.ocp_certs')
                        | oo_collect('health', {'path':'/etc/origin/master/ca-bundle.crt'}))
    run_once: true
  - debug: msg="EXPIRED NODE CERTS"
    when: ('expired' in hostvars
                            | oo_select_keys(groups['nodes'])
                            | oo_collect('check_results.check_results.ocp_certs')
                            | oo_collect('health', {'path':'/etc/origin/node/server.crt'}))
          or
          ('expired' in hostvars
                            | oo_select_keys(groups['nodes'])
                            | oo_collect('check_results.check_results.ocp_certs')
                            | oo_collect('health', {'path':'/etc/origin/node/ca.crt'}))
    run_once: true