57 lines
2.1 KiB
Python
57 lines
2.1 KiB
Python
import paramiko
|
|
import sys
|
|
import base64
|
|
|
|
sys.stdout.reconfigure(encoding='utf-8')
|
|
|
|
key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
|
|
|
|
# 1. Read cert and key from 140.44.4.71
|
|
c_npm = paramiko.SSHClient()
|
|
c_npm.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c_npm.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
|
|
|
|
stdin, stdout, stderr = c_npm.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app) cat /etc/letsencrypt/live/npm-8/fullchain.pem")
|
|
fullchain = stdout.read()
|
|
|
|
stdin, stdout, stderr = c_npm.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app) cat /etc/letsencrypt/live/npm-8/privkey.pem")
|
|
privkey = stdout.read()
|
|
c_npm.close()
|
|
|
|
if not fullchain or not privkey:
|
|
print("Error reading cert or key from NPM!")
|
|
sys.exit(1)
|
|
|
|
print(f"Read fullchain ({len(fullchain)} bytes) and privkey ({len(privkey)} bytes) successfully.")
|
|
|
|
# 2. Connect to 140.44.4.11 (Aerodrome master) and update secret
|
|
c_aero = paramiko.SSHClient()
|
|
c_aero.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c_aero.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)
|
|
|
|
b64_fullchain = base64.b64encode(fullchain).decode('ascii')
|
|
b64_privkey = base64.b64encode(privkey).decode('ascii')
|
|
|
|
cmd_write = f"""
|
|
echo '{b64_fullchain}' | base64 -d > /tmp/aerodrome_fullchain.pem
|
|
echo '{b64_privkey}' | base64 -d > /tmp/aerodrome_privkey.pem
|
|
k3s kubectl -n cattle-system create secret tls tls-rancher-ingress \
|
|
--cert=/tmp/aerodrome_fullchain.pem \
|
|
--key=/tmp/aerodrome_privkey.pem \
|
|
--dry-run=client -o yaml | k3s kubectl apply -f -
|
|
rm -f /tmp/aerodrome_fullchain.pem /tmp/aerodrome_privkey.pem
|
|
"""
|
|
|
|
stdin, stdout, stderr = c_aero.exec_command(cmd_write)
|
|
print("kubectl apply result:")
|
|
print(stdout.read().decode('utf-8'))
|
|
err = stderr.read().decode('utf-8')
|
|
if err: print("kubectl stderr:", err)
|
|
|
|
# Verify updated secret
|
|
stdin, stdout, stderr = c_aero.exec_command("k3s kubectl -n cattle-system get secret tls-rancher-ingress -o jsonpath='{.data.tls\\.crt}' | base64 -d | openssl x509 -noout -subject -dates -issuer")
|
|
print("\nNew secret details:")
|
|
print(stdout.read().decode('utf-8'))
|
|
|
|
c_aero.close()
|