Skip to content

Commit ac23026

Browse files
MoteHueMoteHue
committed
Add support for checking Octavia cert expiration
Adds a flag ``kolla-ansible octavia-certificates --check-expiry <days>`` to the ``octavia-certificates`` command to check if the certificates will expire within a given number of days. Change-Id: I869b8afd85fe282d823ecf3593aa22f94a61b2a0
1 parent c23492e commit ac23026

File tree

8 files changed

+108
-36
lines changed

8 files changed

+108
-36
lines changed

‎ansible/roles/octavia-certificates/defaults/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,6 @@ octavia_certs_client_req_organizational_unit: "{{ octavia_certs_organizational_u
4343
# NOTE(yoctozepto): This should ideally be per controller, i.e. controller
4444
# generates its key&CSR and this CA signs it.
4545
octavia_certs_client_req_common_name: client.example.org
46+
47+
# Used with command `kolla-ansible octavia-certificates --check-expiry <days>`.
48+
octavia_certs_check_expiry: "no"

‎ansible/roles/octavia-certificates/tasks/check_expiry.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
- name: Gather information on certificates
3+
community.crypto.x509_certificate_info:
4+
path: "{{ node_custom_config }}/octavia/{{ item }}"
5+
valid_at:
6+
point_1: "+{{ octavia_certs_expiry_limit | int }}d"
7+
register: cert_info
8+
delegate_to: localhost
9+
with_items:
10+
- "server_ca.cert.pem"
11+
- "client_ca.cert.pem"
12+
- "client.cert-and-key.pem"
13+
14+
- name: Check whether certificates are valid within {{ octavia_certs_expiry_limit }} days
15+
assert:
16+
that:
17+
- item.valid_at.point_1
18+
fail_msg: "{{ item.item }} will expire within {{ octavia_certs_expiry_limit }} days, on {{ item.not_after }}"
19+
success_msg: "{{ item.item }} will not expire within {{ octavia_certs_expiry_limit }} days. It expires on {{ item.not_after }}"
20+
quiet: True
21+
loop: "{{ cert_info.results }}"
22+
loop_control:
23+
label: "{{ item.item }}"
24+
delegate_to: localhost

‎ansible/roles/octavia-certificates/tasks/main.yml‎

Lines changed: 42 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -7,38 +7,45 @@
77
# Kolla Ansible prepares and controls the Client CA certificate and key.
88
# Client CA is used to generate certificates for Octavia controllers.
99

10-
- name: Ensure server_ca and client_ca directories exist
11-
file:
12-
path: "{{ octavia_certs_work_dir }}/{{ item }}"
13-
state: "directory"
14-
mode: 0770
15-
loop:
16-
- server_ca
17-
- client_ca
18-
19-
- name: Copy openssl.cnf
20-
copy:
21-
src: "{{ octavia_certs_openssl_cnf_path }}"
22-
dest: "{{ octavia_certs_work_dir }}/openssl.cnf"
23-
24-
- import_tasks: server_ca.yml
25-
26-
- import_tasks: client_ca.yml
27-
28-
- import_tasks: client_cert.yml
29-
30-
- name: Ensure {{ node_custom_config }}/octavia directory exists
31-
file:
32-
path: "{{ node_custom_config }}/octavia"
33-
state: "directory"
34-
mode: 0770
35-
36-
- name: Copy the to-be-deployed keys and certs to {{ node_custom_config }}/octavia
37-
copy:
38-
src: "{{ octavia_certs_work_dir }}/{{ item.src }}"
39-
dest: "{{ node_custom_config }}/octavia/{{ item.dest }}"
40-
with_items:
41-
- { src: "server_ca/server_ca.cert.pem", dest: "server_ca.cert.pem" }
42-
- { src: "server_ca/server_ca.key.pem", dest: "server_ca.key.pem" }
43-
- { src: "client_ca/client_ca.cert.pem", dest: "client_ca.cert.pem" }
44-
- { src: "client_ca/client.cert-and-key.pem", dest: "client.cert-and-key.pem" }
10+
- name: Check if any certificates are going to expire
11+
include_tasks: check_expiry.yml
12+
when: octavia_certs_check_expiry | bool
13+
14+
- block:
15+
- name: Ensure server_ca and client_ca directories exist
16+
file:
17+
path: "{{ octavia_certs_work_dir }}/{{ item }}"
18+
state: "directory"
19+
mode: 0770
20+
loop:
21+
- server_ca
22+
- client_ca
23+
24+
- name: Copy openssl.cnf
25+
copy:
26+
src: "{{ octavia_certs_openssl_cnf_path }}"
27+
dest: "{{ octavia_certs_work_dir }}/openssl.cnf"
28+
29+
- import_tasks: server_ca.yml
30+
31+
- import_tasks: client_ca.yml
32+
33+
- import_tasks: client_cert.yml
34+
35+
- name: Ensure {{ node_custom_config }}/octavia directory exists
36+
file:
37+
path: "{{ node_custom_config }}/octavia"
38+
state: "directory"
39+
mode: 0770
40+
41+
- name: Copy the to-be-deployed keys and certs to {{ node_custom_config }}/octavia
42+
copy:
43+
src: "{{ octavia_certs_work_dir }}/{{ item.src }}"
44+
dest: "{{ node_custom_config }}/octavia/{{ item.dest }}"
45+
with_items:
46+
- { src: "server_ca/server_ca.cert.pem", dest: "server_ca.cert.pem" }
47+
- { src: "server_ca/server_ca.key.pem", dest: "server_ca.key.pem" }
48+
- { src: "client_ca/client_ca.cert.pem", dest: "client_ca.cert.pem" }
49+
- { src: "client_ca/client.cert-and-key.pem", dest: "client.cert-and-key.pem" }
50+
51+
when: not octavia_certs_check_expiry | bool

‎doc/source/reference/networking/octavia.rst‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,16 @@ used to encrypt the CA key:
7575
7676
.. _octavia-network:
7777

78+
Monitoring certificate expiry
79+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
80+
81+
You can use the following command to check if any of the certificates will
82+
expire within a given number of days:
83+
84+
.. code-block:: console
85+
86+
kolla-ansible octavia-certificates --check-expiry <days>
87+
7888
Networking
7989
----------
8090

‎releasenotes/notes/octavia-check-certificate-expiry-9a80a68cf31cbba4.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
features:
3+
- |
4+
The flag ``--check-expiry`` has been added to the ``octavia-certificates``
5+
command. ``kolla-ansible octavia-certificates --check-expiry <days>`` will
6+
check if the Octavia certificates are set to expire within a given number
7+
of days.

‎tests/run.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,8 @@
518518
executable: /bin/bash
519519
chdir: "{{ kolla_ansible_src_dir }}"
520520
when: scenario == "octavia"
521+
environment:
522+
KOLLA_ANSIBLE_VENV_PATH: "{{ kolla_ansible_venv_path }}"
521523

522524
- name: Run test-masakari.sh script
523525
script:

‎tests/test-octavia.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ set -o errexit
88
# Enable unbuffered output for Ansible in Jenkins.
99
export PYTHONUNBUFFERED=1
1010

11+
function check_certificate_expiry {
12+
RAW_INVENTORY=/etc/kolla/inventory
13+
source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
14+
kolla-ansible octavia-certificates --check-expiry 7
15+
deactivate
16+
}
1117

1218
function register_amphora_image {
1319
amphora_url=https://tarballs.opendev.org/openstack/octavia/test-images/test-only-amphora-x64-haproxy-ubuntu-focal.qcow2
@@ -79,6 +85,9 @@ function test_octavia {
7985
}
8086

8187
function test_octavia_logged {
88+
# Check if any certs expire within a week.
89+
check_certificate_expiry
90+
8291
. /etc/kolla/admin-openrc.sh
8392
. ~/openstackclient-venv/bin/activate
8493
test_octavia

‎tools/kolla-ansible‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ Commands:
198198
stop Stop Kolla containers
199199
certificates Generate self-signed certificate for TLS *For Development Only*
200200
octavia-certificates Generate certificates for octavia deployment
201+
--check-expiry <days> to check if certificates expire within that many days
201202
upgrade Upgrades existing OpenStack Environment
202203
upgrade-bifrost Upgrades an existing bifrost container
203204
genconfig Generate configuration files for enabled OpenStack services
@@ -265,7 +266,7 @@ function version {
265266
check_environment_coherence
266267

267268
SHORT_OPTS="hi:p:t:k:e:CD:v"
268-
LONG_OPTS="help,version,inventory:,playbook:,skip-tags:,tags:,key:,extra:,check,diff,verbose,configdir:,passwords:,limit:,forks:,vault-id:,ask-vault-pass,vault-password-file:,yes-i-really-really-mean-it,include-images,include-dev:,full,incremental"
269+
LONG_OPTS="help,version,inventory:,playbook:,skip-tags:,tags:,key:,extra:,check,diff,verbose,configdir:,passwords:,limit:,forks:,vault-id:,ask-vault-pass,vault-password-file:,yes-i-really-really-mean-it,include-images,include-dev:,full,incremental,check-expiry:"
269270

270271
RAW_ARGS="$*"
271272
ARGS=$(getopt -o "${SHORT_OPTS}" -l "${LONG_OPTS}" --name "$0" -- "$@") || { usage >&2; exit 2; }
@@ -283,6 +284,7 @@ DANGER_CONFIRM=
283284
INCLUDE_IMAGES=
284285
INCLUDE_DEV=
285286
BACKUP_TYPE="full"
287+
OCTAVIA_CERTS_EXPIRY=
286288
# Serial is not recommended and disabled by default. Users can enable it by
287289
# configuring ANSIBLE_SERIAL variable.
288290
ANSIBLE_SERIAL=${ANSIBLE_SERIAL:-0}
@@ -400,6 +402,11 @@ while [ "$#" -gt 0 ]; do
400402
shift 1
401403
;;
402404

405+
(--check-expiry)
406+
OCTAVIA_CERTS_EXPIRY="$2"
407+
shift 2
408+
;;
409+
403410
(--version)
404411
version
405412
exit 0
@@ -534,6 +541,9 @@ EOF
534541
(octavia-certificates)
535542
ACTION="Generate octavia Certificates"
536543
PLAYBOOK="${BASEDIR}/ansible/octavia-certificates.yml"
544+
if [[ ! -z "${OCTAVIA_CERTS_EXPIRY}" ]]; then
545+
EXTRA_OPTS="$EXTRA_OPTS -e octavia_certs_check_expiry=yes -e octavia_certs_expiry_limit=${OCTAVIA_CERTS_EXPIRY}"
546+
fi
537547
;;
538548
(genconfig)
539549
ACTION="Generate configuration files for enabled OpenStack services"

0 commit comments

Comments
 (0)