How To Re-generate Certificates on LTS1 patch#13 if Hostagent Certificates are Expired

# docker run --name pf9deployExec -d  -v /opt/pf9/airctl:/airctl -v /opt/pf9/airctl/ansible-stack:/ansible-stack --network host pf9-deploy:latest sleep 1000000

# docker exec -it pf9deployExec bash

​

bash$ export PF9_ANSIBLE_DIR=/ansible-stack

bash$ export PF9DEPLOY_CONF_FILE=/airctl/conf/pf9deploy.ini

bash$ export DU_FQDN=<your DU_FQDN>

bash$ export SHORTNAME=<shortname>

bash$ export PF9DEPLOY_CRYPT_BACKEND=null

​

bash$ /app/deployutil.py check-certs --shortname $SHORTNAME --debug

#!/bin/bash

airctlConfig="/opt/pf9/airctl/conf/airctl-config.yaml"

duUser=$(awk '/^sshUser:/ {print $2}' $airctlConfig)

dhcpEndpoint=$(grep "^# dhcpEndIp:" $airctlConfig | cut -d " " -f 3- | sed 's/# //')

ipList="/home/$duUser/ipList.txt"

certPrefix="/home/$duUser/certPrefix.txt"

tmpSrcDirDU="/tmp/certs"

​

# Fetching nodeHostnames and storing them in a text file

HostNameLine=$(grep -n "^nodeHostnames:" $airctlConfig | cut -d: -f1)

sed -n "${HostNameLine},$ p" $airctlConfig | awk '/- /{print $2}' | while read -r hostname; do

  echo "$hostname" >> $ipList

done

sed -i '$ d' $ipList

​

ssh-keyscan $dhcpEndpoint >> ~/.ssh/known_hosts

​

# ssh into the DU VM

sshStatus=$(ssh $duUser@$dhcpEndpoint echo ok 2>&1)

if [ "$sshStatus" != ok ]; then

    echo "Unable to ssh into the DU VM. Make sure it is present in the ~/.ssh/known_hosts"

    exit 1

fi

​

# Fetching latest certificate directory from the DU VM

latestCertsDir=$(ssh $duUser@$dhcpEndpoint "ls -d /etc/pf9/certs/v* 2>/dev/null | sort -n | tail -1")

newCertPrefix=$(basename $latestCertsDir)

​

# Check if the directory exists

if [ -n "$latestCertsDir" ]; then

    echo "Latest certs directory: $latestCertsDir"

else

    echo "No cert directories found. Generate new certs before running this script"

    exit 1

fi

​

# Store temporary certificates on CDU for later transfer to hosts

mkdir -p $tmpSrcDirDU

scp -r $duUser@$dhcpEndpoint:$latestCertsDir $tmpSrcDirDU

​

# Iterating over one host at a time, updating the certs in the host and storing the older certs in /tmp/ directory in the host.

while read -r hostname; do

  echo "Copying certs to host: $hostname"

​

  echo "Adding hostname to ~/.ssh/known_hosts"

  ssh-keyscan $hostname >> ~/.ssh/known_hosts

  # Creating temorary directory to store new certificates from the CDU and backing up the old certificates on the host to /tmp/temp-date-XXXXXX directory  

  ssh -n $duUser@$hostname "if [ -d /home/$duUser/tempcerts ]; then sudo rm -rf /home/$duUser/tempcerts; fi"

  ssh -n $duUser@$hostname "mkdir -p /home/$duUser/tempcerts/ca /home/$duUser/tempcerts/hostagent"

  ssh -n $duUser@$hostname 'TMPDIR=$(mktemp -d "/tmp/temp-$(date +%Y-%m-%d_%H-%M-%S)-XXXXXX"); sudo cp -r /etc/pf9/certs/ $TMPDIR; sudo cp /etc/pf9/hostagent.conf $TMPDIR; sudo chmod 0440 $TMPDIR/certs/hostagent/cert.pem $TMPDIR/certs/hostagent/key.pem; sudo chown pf9:pf9group $TMPDIR/certs/hostagent/key.pem $TMPDIR/certs/hostagent/cert.pem $TMPDIR/certs/ca/cert.pem $TMPDIR/hostagent.conf'

  echo "old certificates and hostagent.conf have been backed to /tmp directory"

​

  scp $tmpSrcDirDU/$newCertPrefix/hostagent/cert.pem $duUser@$hostname:/home/$duUser/tempcerts/hostagent/cert.pem

  scp $tmpSrcDirDU/$newCertPrefix/hostagent/key.pem $duUser@$hostname:/home/$duUser/tempcerts/hostagent/key.pem

  scp $tmpSrcDirDU/$newCertPrefix/ca/cert.pem $duUser@$hostname:/home/$duUser/tempcerts/ca/cert.pem

​

  # Copy new certs to the /etc/pf9/certs directory from the temporary directory

  echo "Copying new certs to /etc/pf9/certs"

  ssh -n $duUser@$hostname "sudo chown pf9:pf9group /home/$duUser/tempcerts/hostagent/cert.pem /home/$duUser/tempcerts/hostagent/key.pem /home/$duUser/tempcerts/ca/cert.pem && sudo chmod 0440 /home/$duUser/tempcerts/hostagent/cert.pem /home/$duUser/tempcerts/hostagent/key.pem"

  ssh -n $duUser@$hostname "sudo cp /home/$duUser/tempcerts/ca/cert.pem /etc/pf9/certs/ca/cert.pem && sudo cp /home/$duUser/tempcerts/hostagent/key.pem /etc/pf9/certs/hostagent/key.pem && sudo cp /home/$duUser/tempcerts/hostagent/cert.pem /etc/pf9/certs/hostagent/cert.pem"

  echo "Successfully copied new certs to /etc/pf9/certs"

​

  # Update the cert_version in /etc/pf9/hostagent.conf to reflect the latest version

  echo "Updating cert version in /etc/pf9/hostagent.conf" 

  replaceVersionCmd="sudo sed -i '/^\[ssl\]$/,/^\[/ s/cert_version=.*/cert_version=${newCertPrefix}/' /etc/pf9/hostagent.conf"

  ssh -n $duUser@$hostname ''"$replaceVersionCmd"''

  echo "Successfully updated cert version in /etc/pf9/hostagent.conf"

​

  # Killing the sidekick pod and restarting pf9-comms, pf9-hostagent

  echo "Restarting pf9-comms and pf9-hostagent"

  ssh -n $duUser@$hostname "sidekickPid=\$(ps aux | grep \"sidekick\" | grep -v grep | awk '{print \$2}'); sudo kill \$sidekickPid"

  ssh -n $duUser@$hostname 'sudo systemctl restart pf9-comms'

  ssh -n $duUser@$hostname 'sudo systemctl restart pf9-hostagent'

  echo "Removing temporary certs directory"

  ssh -n $duUser@$hostname "sudo rm -rf /home/$duUser/tempcerts"

done < $ipList

​

# Removing temporary certs directory and ip list from the CDU

rm -rf $ipList $tmpSrcDirDU