openshift-github-actions/.github/workflows/configure-ssl-cert.yml at main · vivekr-splunk/openshift-github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
name: configure-ssl-cert-for-openshift-aws-route53

on:
  workflow_dispatch:
    inputs:
      region:
        description: 'AWS Region'
        required: true
      s3_storage:
        description: 'AWS S3 storage bucket name'
        required: true
      clusterConfigName:
        description: 'Cluster name (i.e. ocp-[run-number])'
        required: true
      baseDomain:
        description: 'Base domain to deploy the cluster (i.e. sandbox772.opentlc.com)'
        required: true

jobs:
  configure-ssl:
    runs-on: macos-latest
    env:
      temp_dir: "temp-${{ github.run_number }}"
    steps:
      - name: "Checkout ${{ github.ref }}"
        uses: actions/checkout@master
        with:
          ref: ${{ github.ref }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: "${{ github.event.inputs.region }}"

      - name: Install OpenShift CLI
        uses: redhat-actions/oc-installer@v1

      - name:  install certbot + aws-route53-extension
        shell: bash
        run: |
          brew install certbot
          pip3 install certbot-dns-route53

      - name: Run certbot against route53 to generate certs
        shell: bash
        env:
          domain_for_cert: "*.apps.${{ github.event.inputs.clusterConfigName }}.${{ github.event.inputs.baseDomain }}"
        run: |
          certbot certonly \
            --dns-route53 \
            --config-dir ./certbot-config \
            --logs-dir ./certbot/logs \
            --work-dir ./certbot/work \
            --agree-tos \
            --non-interactive \
            --email ${{ secrets.EMAIL }} \
            -d "${{ env.domain_for_cert }}"

      - name: Apply ssl cert against OpenShift
        shell: bash
        env:
          cert_name: "apps.${{ github.event.inputs.clusterConfigName }}.${{ github.event.inputs.baseDomain }}"
          fullchain_path: "${{github.workspace}}/certbot-config/live/${{ env.cert_name }}/fullchain.pem"
          privkey_path: "${{github.workspace}}/certbot-config/live/${{ env.cert_name }}/privkey.pem"
        run: |
          mkdir -p ./${{ env.temp_dir }}
          aws s3 sync s3://${{ github.event.inputs.s3_storage }}/${{ github.event.inputs.clusterConfigName }} ./${{ env.temp_dir }} --region "${{ github.event.inputs.region }}"
          export KUBECONFIG=./${{ env.temp_dir }}/auth/kubeconfig
          oc login -u ${{ secrets.OC_USER }} -p ${{ secrets.OC_PASSWORD }}
          fullchain_path="${{github.workspace}}/certbot-config/live/${{ env.cert_name }}/fullchain.pem"
          privkey_path="${{github.workspace}}/certbot-config/live/${{ env.cert_name }}/privkey.pem"
          oc create secret tls router-certs --cert=$fullchain_path --key=$privkey_path -n openshift-ingress
          oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" }}}'