okd/roles/openshift_metrics/tasks/setup_certificate.yaml

---
- name: generate {{ component }} keys
  command: >
    {{ openshift.common.admin_binary }} ca create-server-cert
    --config={{ mktemp.stdout }}/admin.kubeconfig
    --key='{{ openshift_metrics_certs_dir }}/{{ component }}.key'
    --cert='{{ openshift_metrics_certs_dir }}/{{ component }}.crt'
    --hostnames='{{ hostnames }}'
    --signer-cert='{{ openshift_metrics_certs_dir }}/ca.crt'
    --signer-key='{{ openshift_metrics_certs_dir }}/ca.key'
    --signer-serial='{{ openshift_metrics_certs_dir }}/ca.serial.txt'
  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.key'|exists

- name: generate {{ component }} certificate
  shell: >
    cat
    '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.key'
    '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.crt'
    > '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.pem'
  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'|exists

- name: generate random password for the {{ component }} keystore
  shell: >
    tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c15
    > '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-keystore.pwd'
  when: >
    not '{{ openshift_metrics_certs_dir }}/{{ component }}-keystore.pwd'|exists

- name: create the {{ component }} pkcs12 from the pem file
  command: >
    openssl pkcs12 -export
    -in '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'
    -out '{{ openshift_metrics_certs_dir }}/{{ component }}.pkcs12'
    -name '{{ component }}' -noiter -nomaciter
    -password
    'file:{{ openshift_metrics_certs_dir }}/{{ component }}-keystore.pwd'
  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pkcs12'|exists

- name: create the {{ component }} keystore from the pkcs12 file
  shell: >
    p=$(< {{ openshift_metrics_certs_dir }}/{{ component }}-keystore.pwd)
    &&
    keytool -v -importkeystore
    -srckeystore '{{ openshift_metrics_certs_dir | quote }}/{{ component | quote }}.pkcs12'
    -srcstoretype PKCS12
    -destkeystore '{{ openshift_metrics_certs_dir | quote }}/{{ component | quote}}.keystore'
    -deststoretype JKS
    -deststorepass "$p"
    -srcstorepass "$p"
  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.keystore'|exists

- name: generate random password for the {{ component }} truststore
  shell: >
    tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c15
    > '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-truststore.pwd'
  when: >
    not
    '{{ openshift_metrics_certs_dir | quote }}/{{ component| quote  }}-truststore.pwd'|exists