import paramiko
import sys

sys.stdout.reconfigure(encoding='utf-8')

key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)

def run(cmd):
    print(f"=== {cmd} ===")
    stdin, stdout, stderr = client.exec_command(cmd)
    out = stdout.read().decode('utf-8')
    err = stderr.read().decode('utf-8')
    if out: print(out)
    if err: print(f"ERR: {err}")

secrets = [
    ("cattle-system", "tls-rancher-ingress"),
    ("cattle-system", "tls-rancher"),
    ("cattle-system", "serving-cert"),
    ("default", "tls-authentik-cert"),
    ("monitoring", "zabbix-tls-cert"),
]

for ns, name in secrets:
    print(f"\n--- Checking {ns}/{name} ---")
    cmd = f"k3s kubectl -n {ns} get secret {name} -o jsonpath='{{.data.tls\\.crt}}' | base64 -d | openssl x509 -noout -subject -dates -issuer"
    run(cmd)

client.close()