Ensure we only read the first cert. Output name and test access.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

Author: garloff

04-cloud-secret.sh

@@ -20,9 +20,11 @@ kubectl create namespace "$CS_NAMESPACE" || true
 # - The cloud should be called openstack
 # - We will detect a cacert in there and pass it to the helper chart
 if ! test -r "$CLOUDS_YAML"; then echo "clouds.yaml $CLOUDS_YAML not readable"; exit 2; fi
-CA=$(grep -A12 "^  *$OS_CLOUD: *$" $CLOUDS_YAML | grep 'cacert:' | sed 's/^ *cacert: //')
+CA=$(grep -A12 "^  *$OS_CLOUD: *$" $CLOUDS_YAML | grep 'cacert:' | head -n1 | sed 's/^ *cacert: //')
 OS_CACERT=${OS_CACERT:-$CA}
 if test -n "$OS_CACERT"; then
+	echo "Found CA cert file configured to be $OS_CACERT"
+	if test ! -r "$OS_CACERT"; then echo "... but could not access it. FATAL."; exit 3; fi
 	# Call the helm helper chart now
 	helm upgrade -i openstack-secrets -n "$CS_NAMESPACE" --create-namespace https://github.com/SovereignCloudStack/openstack-csp-helper/releases/latest/download/openstack-csp-helper.tgz -f $CLOUDS_YAML --set cacert="$(cat $OS_CACERT)"
 else