rotate-default-ingress-certificate.sh

#!/bin/bash
#
# use this script to force the certiifcate renew for the default ingress certificate of a hcp.
#
function convert() {
  echo $(date -d "$1" "+%s")
}
function dlog() {
  echo $(date -u +"%Y-%m-%d-%I:%M:%S") $1
}

function show() {
  dlog "cluster id: $cid"
}

while getopts 'i:fs:h' opt; do
  case "$opt" in
    s)
      arg="$OPTARG"
      seed=${OPTARG}
      echo "Processing option 's'"
      # echo "$seed"
      ;;

    f)
      echo "Processing option 'f'"
      force="true"
      ;;

    i)
      arg="$OPTARG"
      cid=${OPTARG}
      show
      ;;
   
    ?|h)
      echo "Usage: $(basename $0) [-i clusterid] [-f] [-s seed]"
      exit 1
      ;;
  esac
done
shift "$(($OPTIND -1))"


if [ -z $cid ]; then
  exit 1
fi

NS=openshift-acm-policies

for certificate in $(oc get certificate -n $NS -o name | grep $cid)
do
  dlog $certificate

  _before=$(oc get $certificate -n $NS -ojson | jq -r ".status.notBefore")
  _renew=$(oc get $certificate -n $NS -ojson | jq -r ".status.renewalTime")
  _current_duration=$(oc get $certificate -n $NS -ojson | jq -r ".spec.duration")
  _current_renewBefore=$(oc get $certificate -n $NS -ojson | jq -r ".spec.renewBefore")
  _delta=$(expr $(convert $_renew) - $(convert $_before))
  
  _new_duration=$((_delta/3600))
  _new_renewBefore=$((_new_duration - 168)) # force renew 2 hours

  dlog " current duration    : $_current_duration"
  dlog " current renewBefore : $_current_renewBefore"
  dlog " status notBefore    : $_before"
  dlog " status renewBefore  : $_renew"
  dlog " delta               : $_delta"
  dlog " duration            : $_new_duration"
  dlog " new renewBefore     : $_new_renewBefore"


if [ ! -z $force ]; then

  dnsName0=$(oc get certificate.cert-manager.io/$cid -n $NS -ojson | jq -r ".spec.dnsNames[]"  | grep "*.apps")
  dnsName1=$(oc get certificate.cert-manager.io/$cid -n $NS -ojson | jq -r ".spec.dnsNames[]"  | grep "*.apps" | sed 's,*.apps.rosa.,,g')
  
  if [ -z $seed ]; then
    # default extra domain to api.*
    seed=api
  fi

  api=$seed.$dnsName1
  dlog "✅ $dnsName0 $api"
  _new_dnsNames='["'$dnsName0'","'$api'"]'

  oc patch $certificate -n $NS --patch '
- op: replace
  path: /spec/renewBefore
  value: '$_new_renewBefore'h
- op: replace
  path: /spec/duration
  value: '$_new_duration'h
- op: replace
  path: /spec/dnsNames
  value: '$_new_dnsNames'
' --type=json

else

  oc patch $certificate -n $NS --patch '
- op: replace
  path: /spec/renewBefore
  value: '$_new_renewBefore'h
- op: replace
  path: /spec/duration
  value: '$_new_duration'h
' --type=json

  dlog "✅ patch $certificate $NS $_new_duration"
fi
done