snc: generate ca cert for snc if not provided by user

cmd/mapt/cmd/aws/services/openshift-snc.go

@@ -21,8 +21,6 @@ const (
 	ocpVersionDesc     = "version for Openshift. If not set it will pick latest available version"
 	pullSecretFile     = "pull-secret-file"
 	pullSecretFileDesc = "file path of image pull secret (download from https://console.redhat.com/openshift/create/local)"
-	caCertFile         = "ca-cert-file"
-	caCertFileDesc     = "file path for Certified Authority to sign for certs on cluster, as requisite the CA subj CN should contain /CN=admin-kubeconfig-signer-custom. If no ca.crt is given mapt will create one"
 )
 
 func GetOpenshiftSNCCmd() *cobra.Command {
@@ -73,7 +71,6 @@ func createSNC() *cobra.Command {
 					Version:        viper.GetString(ocpVersion),
 					Arch:           viper.GetString(params.LinuxArch),
 					PullSecretFile: viper.GetString(pullSecretFile),
-					CaCertFile:     viper.GetString(caCertFile),
 					Spot:           viper.IsSet(awsParams.Spot),
 					Timeout:        viper.GetString(params.Timeout)}); err != nil {
 				logging.Error(err)
@@ -86,7 +83,6 @@ func createSNC() *cobra.Command {
 	flagSet.StringP(ocpVersion, "", "", ocpVersionDesc)
 	flagSet.StringP(params.LinuxArch, "", params.LinuxArchDefault, params.LinuxArchDesc)
 	flagSet.StringP(pullSecretFile, "", "", pullSecretFileDesc)
-	flagSet.StringP(caCertFile, "", "", caCertFileDesc)
 	flagSet.Bool(awsParams.Spot, false, awsParams.SpotDesc)
 	flagSet.IntP(params.SpotPriceIncreaseRate, "", params.SpotPriceIncreaseRateDefault, params.SpotPriceIncreaseRateDesc)
 	flagSet.StringP(params.Timeout, "", "", params.TimeoutDesc)

pkg/provider/aws/action/openshift-snc/cloud-config

@@ -8,9 +8,6 @@ runcmd:
   - export PS=$(aws ssm get-parameter --name "{{ .SSMPullSecretName }}" --with-decryption --query "Parameter.Value" --output text)
   - echo ${PS} > /opt/crc/pull-secret
   - chmod 0644 /opt/crc/pull-secret
-  - export CA64=$(aws ssm get-parameter --name "{{ .SSMCaCertName }}" --with-decryption --query "Parameter.Value" --output text)
-  - echo ${CA64} > /opt/crc/custom-ca.crt
-  - chmod 0644 /opt/crc/custom-ca.crt
   - export KP=$(aws ssm get-parameter --name "{{ .SSMKubeAdminPasswordName }}" --with-decryption --query "Parameter.Value" --output text)
   - echo ${KP} > /opt/crc/pass_kubeadmin
   - chmod 0644 /opt/crc/pass_kubeadmin
@@ -32,5 +29,5 @@ write_files:
       CRC_CLOUD=1
       CRC_NETWORK_MODE_USER=0
   owner: root:root
-  path: /etc/systemd/system/crc-env
-  permissions: '0644'
+  path: /etc/sysconfig/crc-env
+  permissions: '0644'

pkg/provider/aws/action/openshift-snc/cloudconfig.go

@@ -15,7 +15,6 @@ type dataValues struct {
 	PublicIP string
 	// Secret information will be moved through ssm
 	SSMPullSecretName        string
-	SSMCaCertName            string
 	SSMKubeAdminPasswordName string
 	SSMDeveloperPasswordName string
 }

pkg/provider/aws/action/openshift-snc/constants.go

@@ -25,15 +25,15 @@ var (
 	outputKubeAdminPass  = "aosKubeAdminPasss"
 	outputDeveloperPass  = "aosDeveloperPass"
 
-	commandReadiness = "while [ ! -f /tmp/.crc-cluster-ready ]; do sleep 5; done"
+	commandReadiness    = "while [ ! -f /tmp/.crc-cluster-ready ]; do sleep 5; done"
+	commandCaServiceRan = "while [ $(sudo systemctl is-active ocp-cluster-ca.service) != inactive ]; do sleep 5; done"
 
 	// portHTTP  = 80
 	portHTTPS = 443
 	portAPI   = 6443
 
 	// SSM
 	ocpPullSecretID = "ocppullsecretid"
-	cacertID        = "cacertid"
 	kapass          = "kapass"
 	devpass         = "devpass"
 )

pkg/provider/aws/action/openshift-snc/openshift-snc.go

@@ -1,7 +1,6 @@
 package openshiftsnc
 
 import (
-	"encoding/base64"
 	"fmt"
 	"os"
 	"strings"
@@ -40,7 +39,6 @@ type OpenshiftSNCArgs struct {
 	Version         string
 	Arch            string
 	PullSecretFile  string
-	CaCertFile      string
 	Spot            bool
 	Timeout         string
 }
@@ -51,7 +49,6 @@ type openshiftSNCRequest struct {
 	arch           *string
 	timeout        *string
 	pullSecretFile *string
-	caCertFile     *string
 	allocationData *allocation.AllocationData
 }
 
@@ -78,7 +75,6 @@ func Create(ctx *maptContext.ContextArgs, args *OpenshiftSNCArgs) error {
 		version:        &args.Version,
 		arch:           &args.Arch,
 		pullSecretFile: &args.PullSecretFile,
-		caCertFile:     &args.CaCertFile,
 		timeout:        &args.Timeout}
 	r.allocationData, err = util.IfWithError(args.Spot,
 		func() (*allocation.AllocationData, error) {
@@ -104,11 +100,11 @@ func Create(ctx *maptContext.ContextArgs, args *OpenshiftSNCArgs) error {
 func Destroy(ctx *maptContext.ContextArgs) (err error) {
 	logging.Debug("Run openshift destroy")
 	// Create mapt Context
-	if err := maptContext.Init(ctx, aws.Provider()); err != nil {
+	if err = maptContext.Init(ctx, aws.Provider()); err != nil {
 		return err
 	}
 	// Destroy fedora related resources
-	if err := aws.DestroyStack(
+	if err = aws.DestroyStack(
 		aws.DestroyStackRequest{
 			Stackname: stackName,
 		}); err != nil {
@@ -344,17 +340,6 @@ func (r *openshiftSNCRequest) userData(ctx *pulumi.Context,
 		return nil, nil, nil, nil, err
 	}
 	dependecies = append(dependecies, psParam)
-	// Manage ca crt
-	ca, err := os.ReadFile(*r.caCertFile)
-	if err != nil {
-		return nil, nil, nil, nil, err
-	}
-	caB64 := base64.StdEncoding.EncodeToString([]byte(ca))
-	caName, caParam, err := ssm.AddSSM(ctx, r.prefix, &cacertID, &caB64)
-	if err != nil {
-		return nil, nil, nil, nil, err
-	}
-	dependecies = append(dependecies, caParam)
 	// KubeAdmin pass
 	kaPassword, err := security.CreatePassword(ctx,
 		resourcesUtil.GetResourceName(
@@ -386,7 +371,6 @@ func (r *openshiftSNCRequest) userData(ctx *pulumi.Context,
 				PubKey:                   args[0].(string),
 				PublicIP:                 args[1].(string),
 				SSMPullSecretName:        *psName,
-				SSMCaCertName:            *caName,
 				SSMKubeAdminPasswordName: *kaPassName,
 				SSMDeveloperPasswordName: *devPassName})
 			return *ccB64, err
@@ -410,11 +394,18 @@ func kubeconfig(ctx *pulumi.Context,
 	if err != nil {
 		return pulumi.StringOutput{}, err
 	}
+	// Check ocp-cluster-ca.service succeeds
+	ocpCaRotatedCmd, err := c.RunCommand(ctx, commandCaServiceRan, fmt.Sprintf("%s-ocp-ca-rotated", *prefix), awsOCPSNCID,
+		mk, amiUserDefault, nil, []pulumi.Resource{ocpReadyCmd})
+	if err != nil {
+		return pulumi.StringOutput{}, err
+	}
+
 	// Get content for /opt/kubeconfig
 	getKCCmd := ("cat /opt/kubeconfig")
 	getKC, err := c.RunCommand(ctx, getKCCmd,
 		fmt.Sprintf("%s-kubeconfig", *prefix), awsOCPSNCID, mk, amiUserDefault,
-		nil, []pulumi.Resource{ocpReadyCmd})
+		nil, []pulumi.Resource{ocpCaRotatedCmd})
 	if err != nil {
 		return pulumi.StringOutput{}, err
 	}

pkg/provider/azure/data/images.go

@@ -67,7 +67,7 @@ func SkuG2Support(location string, publisher string, offer string, sku string) (
 		return "", err
 	}
 	imagesClient := clientFactory.NewVirtualMachineImagesClient()
-	if ! verify_g2(imagesClient, location, publisher, offer, sku) {
+	if !verify_g2(imagesClient, location, publisher, offer, sku) {
 		finalSKU, err := get_g2_sku(imagesClient, location, publisher, offer, sku)
 		if err == nil && finalSKU != "" {
 			if verify_g2(imagesClient, location, publisher, offer, finalSKU) {
@@ -77,27 +77,27 @@ func SkuG2Support(location string, publisher string, offer string, sku string) (
 		}
 	} else {
 		return sku, nil
-	} 
+	}
 	return "", fmt.Errorf("the SKU %s is not support for G2", sku)
 }
 
 func verify_g2(imagesClient *armcompute.VirtualMachineImagesClient, location string, publisher string, offer string, sku string) bool {
 	// List available image versions
-	resp, err := imagesClient.List(context.Background(),location, publisher, offer, sku, nil)
+	resp, err := imagesClient.List(context.Background(), location, publisher, offer, sku, nil)
 	if err != nil {
 		return false
-	} 
+	}
 
 	image := resp.VirtualMachineImageResourceArray[0]
 	version := *image.Name
-	resps, _ := imagesClient.Get(context.Background(),location, publisher, offer, sku, version, nil)
+	resps, _ := imagesClient.Get(context.Background(), location, publisher, offer, sku, version, nil)
 	info := resps.VirtualMachineImage
 	generation := *info.Properties.HyperVGeneration
 	return generation == "V2"
 }
 
 func get_g2_sku(imagesClient *armcompute.VirtualMachineImagesClient, location string, publisher string, offer string, originSKU string) (string, error) {
-	resp, err := imagesClient.ListSKUs(context.Background(),location, publisher, offer, nil)
+	resp, err := imagesClient.ListSKUs(context.Background(), location, publisher, offer, nil)
 	if err != nil {
 		return "", err
 	}
@@ -107,4 +107,4 @@ func get_g2_sku(imagesClient *armcompute.VirtualMachineImagesClient, location st
 		}
 	}
 	return "", nil
-}
+}