Add cert rotate command for HA Service

components/automate-cli/cmd/chef-automate/certRotate.go

@@ -0,0 +1,160 @@
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+	"time"
+
+	"github.com/chef/automate/components/automate-cli/pkg/status"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var certFlags = struct {
+	privateCert string
+	publicCert  string
+}{}
+
+var sshFlag = struct {
+	automate   bool
+	chefserver bool
+}{}
+
+var certRotateCmd = &cobra.Command{
+	Use:   "cert-rotate",
+	Short: "Chef Automate rotate cert",
+	Long:  "Chef Automate CLI command to rotate certificates",
+	RunE:  certRotate,
+}
+
+func init() {
+	RootCmd.AddCommand(certRotateCmd)
+
+	certRotateCmd.PersistentFlags().BoolVar(&sshFlag.automate, "automate", false, "Automate Certificate Rotation")
+	certRotateCmd.PersistentFlags().BoolVar(&sshFlag.automate, "a2", false, "Automate Certificate Rotation")
+	certRotateCmd.PersistentFlags().BoolVar(&sshFlag.chefserver, "chefserver", false, "Chef Infra Server Certificate Rotation")
+	certRotateCmd.PersistentFlags().BoolVar(&sshFlag.chefserver, "cs", false, "Chef Infra Server Certificate Rotation")
+
+	certRotateCmd.PersistentFlags().StringVar(&certFlags.privateCert, "private-cert", "", "Private certificate")
+	certRotateCmd.PersistentFlags().StringVar(&certFlags.publicCert, "public-cert", "", "Public certificate")
+}
+
+func certRotate(cmd *cobra.Command, args []string) error {
+	privateCertPath := certFlags.privateCert
+	publicCertPath := certFlags.publicCert
+	fileName := "cert-rotate.toml"
+	timestamp := time.Now().Format("20060102150405")
+
+	if privateCertPath == "" || publicCertPath == "" {
+		return errors.New("Please provide public and private cert paths")
+	}
+	privateCert, err := ioutil.ReadFile(privateCertPath) // nosemgrep
+	if err != nil {
+		return status.Wrap(
+			err,
+			status.FileAccessError,
+			fmt.Sprintf("failed reading data from file: %s", err.Error()),
+		)
+	}
+
+	publicCert, err := ioutil.ReadFile(publicCertPath) // nosemgrep
+	if err != nil {
+		return status.Wrap(
+			err,
+			status.FileAccessError,
+			fmt.Sprintf("failed reading data from file: %s", err.Error()),
+		)
+	}
+
+	f, err := os.Create(fileName)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if isA2HARBFileExist() {
+
+		infra, err := getAutomateHAInfraDetails()
+		if err != nil {
+			return err
+		}
+		sshUser := infra.Outputs.SSHUser.Value
+		sskKeyFile := infra.Outputs.SSHKeyFile.Value
+		sshPort := infra.Outputs.SSHPort.Value
+
+		if sshFlag.automate {
+			config := fmt.Sprintf(`
+			[[load_balancer.v1.sys.frontend_tls]]
+				cert = """%v"""
+				key = """%v"""
+			[[global.v1.frontend_tls]]
+				cert = """%v"""
+				key = """%v"""
+		`, string(publicCert), string(privateCert), string(publicCert), string(privateCert))
+
+			_, err = f.Write([]byte(config))
+			if err != nil {
+				log.Fatal(err)
+			}
+			f.Close()
+			automateIps := infra.Outputs.AutomatePrivateIps.Value
+			if len(automateIps) == 0 {
+				return errors.New("No Automate Ips found")
+			}
+
+			const remoteService string = "automate"
+			scriptCommands := fmt.Sprintf(FRONTEND_COMMANDS, remoteService+timestamp, dateFormat)
+			for i := 0; i < len(automateIps); i++ {
+				err := copyFileToRemote(sskKeyFile, fileName, sshUser, automateIps[i], remoteService+timestamp)
+				if err != nil {
+					writer.Errorf("%v", err)
+					return err
+				}
+				output, err := ConnectAndExecuteCommandOnRemote(sshUser, sshPort, sskKeyFile, automateIps[i], scriptCommands)
+				if err != nil {
+					writer.Errorf("%v", err)
+					return err
+				}
+				writer.Printf(output)
+			}
+
+		} else if sshFlag.chefserver {
+			config := fmt.Sprintf(`
+			[[load_balancer.v1.sys.frontend_tls]]
+				cert = """%v"""
+				key = """%v"""
+			[[global.v1.frontend_tls]]
+				cert = """%v"""
+				key = """%v"""
+		`, string(publicCert), string(privateCert), string(publicCert), string(privateCert))
+
+			_, err = f.Write([]byte(config))
+			if err != nil {
+				log.Fatal(err)
+			}
+			f.Close()
+			chefserverIps := infra.Outputs.ChefServerPrivateIps.Value
+			if len(chefserverIps) == 0 {
+				return errors.New("No Chef Server Ips found")
+			}
+
+			const remoteService string = "chefserver"
+			scriptCommands := fmt.Sprintf(FRONTEND_COMMANDS, remoteService+timestamp, dateFormat)
+			for i := 0; i < len(chefserverIps); i++ {
+				err := copyFileToRemote(sskKeyFile, fileName, sshUser, chefserverIps[i], remoteService+timestamp)
+				if err != nil {
+					writer.Errorf("%v", err)
+					return err
+				}
+				output, err := ConnectAndExecuteCommandOnRemote(sshUser, sshPort, sskKeyFile, chefserverIps[i], scriptCommands)
+				if err != nil {
+					writer.Errorf("%v", err)
+					return err
+				}
+				writer.Printf(output)
+			}
+		}
+	}
+	return nil
+}

components/automate-cli/cmd/chef-automate/config.go

@@ -348,7 +348,7 @@ func runSetCommand(cmd *cobra.Command, args []string) error {
 
 func copyFileToRemote(sshKeyFile string, tomlFilePath string, sshUser string, hostIP string, destFileName string) error {
 	cmd := "scp"
-	exec_args := []string{"-o StrictHostKeyChecking=off", "-i", sshKeyFile, "-r", tomlFilePath, sshUser + "@" + hostIP + ":/tmp/" + destFileName}
+	exec_args := []string{"-o StrictHostKeyChecking=no", "-i", sshKeyFile, "-r", tomlFilePath, sshUser + "@" + hostIP + ":/tmp/" + destFileName}
 	if err := exec.Command(cmd, exec_args...).Run(); err != nil {
 		writer.Print("Failed to copy TOML file to remote\n")
 		return err

terraform/a2ha-terraform/modules/aws/outputs.tf

@@ -103,4 +103,6 @@ output "aws_cluster_id" {
 output "ssh_user" {
   value = var.aws_ssh_user
 }
-
+output "ssh_port" {
+  value = var.aws_ssh_port
+}

terraform/a2ha-terraform/modules/vsphere/outputs.tf

@@ -64,3 +64,6 @@ output "opensearch_public_ips" {
 output "ssh_user" {
   value = var.aws_ssh_user
 }
+output "ssh_port" {
+  value = var.aws_ssh_port
+}