#!/bin/bash # Copyright 2025, VMware by Broadcom Corporation, All rights reserved. #set -e GreenLetter() { echo -e "\033[32m $1 \033[0m" } RedLetter() { echo -e "\033[31m $1 \033[0m" } YellowLetter() { echo -e "\033[33m $1 \033[0m" } TCAVER=${TCAVERSION:-"2.3"} mc_name="" wc_name="" mc_kubeconfig_path="" wc_kubeconfig_path="" declare -A CLUSTERS_ARRAY retry_count=12 # 2 temporary file used to create overlay secret will be deleted after the script exitd nc_cert_overlay_file="nc_cert_overlay_file.yaml" nc_webhook_overlay_file="nc_webhook_overlay_file.yaml" temporary_files=() parse_parameters() { local options options=$(getopt -o "m:w:q" --long "mc_name:,wc_name:query" -- "$@") if [[ $? -ne 0 ]]; then echo "Error parsing options." >&2 return 1 fi eval set -- "$options" while true; do case "$1" in -q|--query) list_clusters exit 0 ;; -m|--mc_name) mc_name="$2"; shift 2 ;; -w|--wc_name) wc_name="$2"; shift 2 ;; --) shift; break ;; *) echo "Invalid option: $1" >&2; return 1 ;; esac done return 0 } # Function for usage function usage() { echo "Usage: $0 -i -m -w " echo "Options:" echo " -q, --query List current management and workload clusters under this TCA-CP" echo " -m, --mc_name MC name value, mc_name is required" echo " -w, --wc_name WC name value, if wc_name is not provided, will go through all workload clusters under the management cluster" exit 1 } prepare_kubeconfig() { wc_name=$1 if ! GetWcKubeconfig "$mc_kubeconfig_path" "$wc_name"; then echo "" RedLetter "Failed to get kubeconfig for workload cluster $wc_name" return 1 fi export KUBECONFIG=$wc_kubeconfig_path kubectl get nodes -o wide >/dev/null if [ $? -ne 0 ]; then echo "" RedLetter "Failed to get nodes for workload cluster $wc_name" cmd="kubectl get nodes -o wide" echo $cmd eval "$cmd" return 1 fi } # store mc kubeconfig to $mc_kubeconfig_path get_v1_wc_list (){ local mc_name=$1 if [[ "$TCAVER" != "2.3" ]]; then return 0 fi local kbs_pod_ip="127.0.0.1" local mc_id=$(curl -s "http://${kbs_pod_ip}:8888/api/v1/managementclusters" | jq -r ".[] | select(.clusterName == \"${mc_name}\") | .id") if [ $? -ne 0 ]; then echo "Failed to get management cluster ID" return 1 fi if [ -z "${mc_id}" ]; then RedLetter "mc_id is null, Please check if ${mc_name} is a valid management cluster name" return 1 fi v1_wc_list=$(curl -s "http://${kbs_pod_ip}:8888/api/v1/workloadclusters"| jq -r "[.[] | select(.tkgMgmtClusterId == \"${mc_id}\") | .clusterName ]| join(\",\")") if [ $? -ne 0 ]; then RedLetter "Failed to get v1 wc cluster mc ${mc_name}" return 1 fi YellowLetter "==== Detected V1 workload clusters for ${mc_name}: $v1_wc_list" return 0 } # store mc kubeconfig to $mc_kubeconfig_path GetMcKubeconfig (){ local mc_name=$1 local local_mc_kubeconfig_path="/tmp/${mc_name}-kubeconfig" temporary_files+=("$local_mc_kubeconfig_path") local kbs_pod_ip="127.0.0.1" if [[ "$TCAVER" != "2.3" ]]; then kbs_pod_ip=$(kubectl get pods -n tca-cp-cn -l app=k8s-bootstrapper -o json | jq -r '.items[0].status.podIP') fi local mc_id=$(curl -s "http://${kbs_pod_ip}:8888/api/v1/managementclusters" | jq -r ".[] | select(.clusterName == \"${mc_name}\") | .id") if [ $? -ne 0 ]; then echo "Failed to get management cluster ID" return 1 fi if [ -z "${mc_id}" ]; then RedLetter "mc_id is null, Please check if ${mc_name} is a valid management cluster name" return 1 fi echo "Get mc id ${mc_id}" local mc_kubeconfig=$(curl -s "http://${kbs_pod_ip}:8888/api/v1/managementcluster/${mc_id}/kubeconfig") if [ $? -ne 0 ]; then RedLetter "Failed to get kubeconfig for mc ${mc_name}" return 1 fi echo "${mc_kubeconfig}" > "${local_mc_kubeconfig_path}" mc_kubeconfig_path="${local_mc_kubeconfig_path}" return 0 } GetWcKubeconfig() { local local_mc_kubeconfig_path=$1 local wc_name=$2 local local_wc_kubeconfig_path="/tmp/${wc_name}-kubeconfig" temporary_files+=("$local_wc_kubeconfig_path") KUBECONFIG=${local_mc_kubeconfig_path} kubectl get secret -n ${wc_name} ${wc_name}-kubeconfig >/dev/null 2>&1 if [ $? -ne 0 ]; then RedLetter "Failed to get kubeconfig for workload cluster ${wc_name}" exit 1 fi local wc_kubeconfig=$(KUBECONFIG=${local_mc_kubeconfig_path} kubectl get secret -n ${wc_name} ${wc_name}-kubeconfig -o jsonpath="{.data.value}" 2>/dev/null | base64 -d > ${local_wc_kubeconfig_path}) #echo "Stored wc kubeconfig to ${local_wc_kubeconfig_path}" wc_kubeconfig_path="${local_wc_kubeconfig_path}" return 0 } prepare_vm_overlay_file() { cat >$vm_cert_overlay_file <$vm_webhook_overlay_file <$vm_webhook_default_overlay_file <$nc_cert_overlay_file <$nc_webhook_overlay_file <$empty_nc_cr <&1) if [ $? -eq 0 ]; then echo "Applied an empty nodeconfig cr succesfully." KUBECONFIG=${kube_path} kubectl delete -f $empty_nc_cr --wait=false >/dev/null 2>&1 || true KUBECONFIG=${kube_path} kubectl patch NodeConfig test-vm-empty -n tca-system --type=json -p='[{"op": "remove", "path": "/metadata/finalizers"}]' >/dev/null 2>&1 || true return 0 fi let a++ done RedLetter "Fail to create a nodeconfig CR for testing." echo $out return 1 } check_apply_nodepolicy_cr() { kube_path=$1 empty_np_cr="empty_nodepolicy_cr.yaml" temporary_files+=("$empty_np_cr") cat >$empty_np_cr <&1) if [ $? -eq 0 ]; then echo "Applied an empty nodepolicy cr succesfully." KUBECONFIG=${kube_path} kubectl delete -f $empty_np_cr --wait=false >/dev/null 2>&1 || true KUBECONFIG=${kube_path} kubectl patch NodePolicy test-np-empty -n tca-system --type=json -p='[{"op": "remove", "path": "/metadata/finalizers"}]' >/dev/null 2>&1 || true return 0 fi let a++ done RedLetter "Fail to create a nodeconfig CR for testing." echo $out return 1 } post_check_vm() { kube_path=$1 if check_webhook_expire_date ${kube_path} "ValidatingWebhookConfiguration" "vmconfig-validator"; then echo "Vmconfig ValidatingWebhookConfiguration cert is updated" else RedLetter "Patch vmconfig ValidatingWebhookConfiguration cert failed" return 1 fi if check_webhook_expire_date ${kube_path} "MutatingWebhookConfiguration" "vmconfig-defaulter"; then echo "Vmconfig MutatingWebhookConfiguration cert is updated" else RedLetter "Patch vmconfig MutatingWebhookConfiguration cert failed" return 1 fi if check_apply_nodepolicy_cr ${kube_path}; then GreenLetter "Verified new cert take effect with applying and deleting an empty nodepolicy CR successfully" return 0 else RedLetter "Apply an empty nodepolicy CR failed. Please check with edit one nodepolicy CR manully" return 1 fi } is_date_before() { local not_after_str="$1" local date_str="${not_after_str#notAfter=}" local target_ts target_ts=$(date -d "$date_str" +%s 2>/dev/null) local cutoff_ts cutoff_ts=$(date -d "2027-01-01 00:00:00" +%s) if [ -z "$target_ts" ] || [ -z "$cutoff_ts" ]; then echo "Invalid date" return 1 fi if [ "$target_ts" -lt "$cutoff_ts" ]; then #echo "before 2027" return 1 else #echo "after 2027" return 0 fi } check_cert_update_needed(){ kube_path=$1 component=$2 cluster_name=$3 expired_date=$(KUBECONFIG=${kube_path} kubectl get ValidatingWebhookConfiguration ${component} -o jsonpath='{.webhooks[0].clientConfig.caBundle}' | base64 -d | openssl x509 -noout -dates | grep notAfter) echo "current cert for ${component} in $cluster_name is $expired_date" if is_date_before "$expired_date"; then #echo "no need update" return 0 else #echo "need update" return 1 fi } post_check_nc() { kube_path=$1 if check_webhook_expire_date ${kube_path} "ValidatingWebhookConfiguration" "nodeconfig-validator"; then GreenLetter "Nodeconfig cert is updated" else cmd="kubectl get ValidatingWebhookConfiguration nodeconfig-validator -o jsonpath='{.webhooks[0].clientConfig.caBundle}' | base64 -d | openssl x509 -noout -dates" RedLetter "Check expired date failed. Please check with $cmd manully" eval "KUBECONFIG=${kube_path} $cmd" return 1 fi if check_apply_nodeconfig_cr ${kube_path}; then GreenLetter "Verified with applying and deleting an empty nodeconfig cr successfully" return 0 else RedLetter "Apply an empty nodeconfig CR still failed. Please check with edit one nodeconfig CR manully" return 1 fi } cleanup_tmp_file(){ for file in "${temporary_files[@]}"; do rm -rf $file done } patch_vmconfig(){ kube_path=$1 local cluster_name=$2 if [[ "$TCAVER" != "2.3" ]]; then return 0 fi if check_cert_update_needed $kube_path "vmconfig-validator" $cluster_name; then GreenLetter "No need update vmconfig cert, will skip cluster $cluster_name" return 0 fi echo "Current vmconfig webhook cert date is" KUBECONFIG=${kube_path} kubectl get ValidatingWebhookConfiguration vmconfig-validator -o jsonpath='{.webhooks[0].clientConfig.caBundle}' | base64 -d | openssl x509 -noout -dates echo "Will extend vmconfig cert to 2030" vm_cert_overlay_secret_name="vmconfig-overlay-cert" vm_webhook_overlay_secret_name="vmconfig-overlay-webhook" vm_webhook_overlay_secret_default_name="vmconfig-overlay-webhook-default" vm_cert_overlay_file="vm_cert_overlay_file.yaml" vm_webhook_overlay_file="vm_webhook_overlay_file.yaml" vm_webhook_default_overlay_file="vm_webhook_default_overlay_file.yaml" temporary_files+=("$vm_cert_overlay_file") temporary_files+=("$vm_webhook_overlay_file") temporary_files+=("$vm_webhook_default_overlay_file") prepare_vm_overlay_file create_secret_for_overlay $kube_path $vm_cert_overlay_secret_name $vm_cert_overlay_file create_secret_for_overlay $kube_path $vm_webhook_overlay_secret_name $vm_webhook_overlay_file create_secret_for_overlay $kube_path $vm_webhook_overlay_secret_default_name $vm_webhook_default_overlay_file patch_pkgi $kube_path "vmconfig-operator" "1" $vm_cert_overlay_secret_name patch_pkgi $kube_path "vmconfig-operator" "2" $vm_webhook_overlay_secret_name patch_pkgi $kube_path "vmconfig-operator" "3" $vm_webhook_overlay_secret_default_name unpause_pkgi $kube_path "vmconfig-operator" wait_kapp_reconcile ${kube_path} "vmconfig-operator" if ! post_check_vm $kube_path; then pkgi_name="vmconfig-operator" RedLetter "Post check for vmconfig-operator cert extend failed, will revert it." echo "Will remove annotation for vmconfig pkgi" KUBECONFIG=${kube_path} kubectl patch pkgi $pkgi_name -n tca-system --type=merge -p '{"metadata":{"annotations":null}}' echo "Will pause vmconfig pkgi to trigger kapp controller reconcile" KUBECONFIG=${kube_path} kubectl patch pkgi $pkgi_name -n tca-system -p '{"spec":{"paused":true}}' --type=merge sleep 5 echo "Will unpause vmconfig pkgi to make old cert take effect" KUBECONFIG=${kube_path} kubectl patch pkgi $pkgi_name -n tca-system -p '{"spec":{"paused":false}}' --type=merge sleep 5 echo "Will delete vmconfig-operator pod to make it take old cert" KUBECONFIG=${kube_path} kubectl get pod -A | grep vmconfig | awk '{print $2}' | xargs KUBECONFIG=${kube_path} kubectl delete pod -n tca-system RedLetter "Please rerun the script to retry" exit 1 fi } patch_one_cluster(){ kube_path=$1 local cluster_name=$2 if check_cert_update_needed $kube_path "nodeconfig-validator" $cluster_name; then GreenLetter "No need update nodeconfig cert, will skip cluster $cluster_name" return 0 fi echo "" GreenLetter "###### Will patch nodeconfig for cluster $cluster_name ######" # 2 secret for overlay wil be created in target cluster nc_cert_overlay_secret_name="nodeconfig-overlay-cert" nc_webhook_overlay_secret_name="nodeconfig-overlay-webhook" create_secret_for_overlay $kube_path $nc_cert_overlay_secret_name $nc_cert_overlay_file create_secret_for_overlay $kube_path $nc_webhook_overlay_secret_name $nc_webhook_overlay_file # patch secret tca-system/nodeconfig-certs and ValidatingWebhookConfiguration default/nodeconfig-validator patch_pkgi $kube_path "nodeconfig-operator" "1" $nc_cert_overlay_secret_name patch_pkgi $kube_path "nodeconfig-operator" "2" $nc_webhook_overlay_secret_name unpause_pkgi $kube_path "nodeconfig-operator" wait_kapp_reconcile ${kube_path} "nodeconfig-operator" if ! post_check_nc $kube_path; then RedLetter "Post check for cluster $cluster_name failed" echo "" else GreenLetter "###### Update nodeconfig cert for cluster $cluster_name successfully ######" echo "" fi } patch_v1_cluster(){ kube_path=$1 cluster_name=$2 if ! check_cert_update_needed $kube_path "nodeconfig-validator" $cluster_name; then echo "No need update nodeconfig cert, will skip cluster $cluster_name" return 0 fi KUBECONFIG=${kube_path} kubectl get ValidatingWebhookConfiguration nodeconfig-validator -o yaml >webhook.yaml sed -i 's/\(caBundle:\).*/\1 LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURvRENDQW9pZ0F3SUJBZ0lVTXplWmU5MFArejlNd2R5amJXNnU1TGRGcmg4d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2FERUxNQWtHQTFVRUJoTUNWVk14RHpBTkJnTlZCQWdUQms5eVpXZHZiakVSTUE4R0ExVUVCeE1JVUc5eQpkR3hoYm1ReEV6QVJCZ05WQkFvVENrdDFZbVZ5Ym1WMFpYTXhDekFKQmdOVkJBc1RBa05CTVJNd0VRWURWUVFECkV3cExkV0psY201bGRHVnpNQjRYRFRJMU1EVXdPVEE0TVRnd01Gb1hEVE13TURVd09EQTRNVGd3TUZvd2FERUwKTUFrR0ExVUVCaE1DVlZNeER6QU5CZ05WQkFnVEJrOXlaV2R2YmpFUk1BOEdBMVVFQnhNSVVHOXlkR3hoYm1ReApFekFSQmdOVkJBb1RDa3QxWW1WeWJtVjBaWE14Q3pBSkJnTlZCQXNUQWtOQk1STXdFUVlEVlFRREV3cExkV0psCmNtNWxkR1Z6TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF6U3dtcDMrUVVCR24KTVU5R1dxelhtTlErbEZaYStmd1FBc2ZIczlpRE9DQ1N0cFEycVNyanFXRGhpWElmMTAwNFBHSkpJYk9hOFlpRApIaDdEWUg1TXBxSm9oVHhYWndqRzJmMFR5Q1BJVzVpTmo3ZlA1RWNrY0Q4dFJKMkF2bkE5RjdQOUg1SHJnV0lYCldYN2EvY0N3NlVmdERPaHdPVFlHVkdUYng0YkZud1pyTXk2UnNJN3NLb2JET0JFSExGQUZab0tyNGc4dnp5eXYKVUZudTEzYmpSSnh1OHVvNGxqWlpyUHkyUSsrbkE3NjlJdzJobEFtdExzUVVUbU9lY3dhM3VlMlY1M1FlSExoZQpsMUJFSXZRTU0yZ1U4UENSaytabGl0SlMrSFlkRVppQUJhQkVqdWtZMmF0a0cyNExQeUJzay8wQXlMTTdweTNHCjFrWXhkbVVWQ3dJREFRQUJvMEl3UURBT0JnTlZIUThCQWY4RUJBTUNBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIKL3pBZEJnTlZIUTRFRmdRVWFkbXJlSlhZRm90OVRIY0NYQTU5VTU2YVRzQXdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQUJPVURFOUdza1ZQMHVWTi94N1F2ZHBLR3VVc1ZSYVBIOWxEREIyakNyTkpDVFdzRDNhMTJ0d1I0WGVZClhOeHUyVEZuTHVaTVJRYndHWUJCZU0vRWhLaDRHdi9vVEQ2MjVseE9tbHlWcjZMbUpHQm1aQ0tFNGpySlFmTnYKUU9HVnp4NjIrR1M5ZkVxdmpJOG5IblhWdDFRZDd4OGlENkR1NXBzc1RFcTBPZTFYUnQ0Y3pLRXJUT2UyL3pRcgpmRHNVdHVzUS85MDhWWHhkZ0N2VHQ4Q01UR1p5OXo3VmRtbUJORlFscEVOeGRHTjNKKytldkE0c200YkUyeG5aCjZsdnFGaS8xWVlFdG9FbW80MEhhVEFsRUdsa1J3SGo4TFFlU1BBYkJxNUtYbmlHS3RDekV5ZDNDalp1QVU2YUwKWDNvd0RxQ0MrRVh6aG1xTVg5Z3ZMbjh5Sk5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==/g' webhook.yaml KUBECONFIG=${kube_path} kubectl apply -f webhook.yaml rm -rf webhook.yaml KUBECONFIG=${kube_path} kubectl get secret -n tca-system nodeconfig-certs -o yaml >nc_cert.yaml sed -i 's/\(tls.crt:\).*/\1 LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVGVENDQXYyZ0F3SUJBZ0lVZnk2RzI5Wmdxc1JrNmY1NTdieFF5aVVjRlVzd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2FERUxNQWtHQTFVRUJoTUNWVk14RHpBTkJnTlZCQWdUQms5eVpXZHZiakVSTUE4R0ExVUVCeE1JVUc5eQpkR3hoYm1ReEV6QVJCZ05WQkFvVENrdDFZbVZ5Ym1WMFpYTXhDekFKQmdOVkJBc1RBa05CTVJNd0VRWURWUVFECkV3cExkV0psY201bGRHVnpNQjRYRFRJMU1EVXdPVEE0TVRnd01Gb1hEVE0xTURVd056QTRNVGd3TUZvd2J6RUwKTUFrR0ExVUVCaE1DVlZNeER6QU5CZ05WQkFnVEJrOXlaV2R2YmpFUk1BOEdBMVVFQnhNSVVHOXlkR3hoYm1ReApFekFSQmdOVkJBb1RDa3QxWW1WeWJtVjBaWE14RXpBUkJnTlZCQXNUQ2t0MVltVnlibVYwWlhNeEVqQVFCZ05WCkJBTVRDV0ZrYldsemMybHZiakNDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFOWUsKNUZPM1ptMkhFNG16N2ZZcU1NR3VGSFl2QVNSN242b0NUc2JhQ2YwZGRTNy9Wei9rWnd5bFM0aVpJeWZqOVV0YQpFOXNpRkFPVndNdnhUYjJmT29CTVU4UUQ5bjBpTUVmb3NOSTM2N3ZsSEFLZ1lJNUR1bGFPODkwWURnQ0thRkhrCjYxZmlRdG9nSTRGajZEZ21zcXkwc3VJOWNRZDZrc3Jla3NwMjFNVUxpRkFoWUJtWHBVODdMTm1ZNjBJL0Y2Zk0KUXYrR3BpUU4vVHdsZmFtMnE4YWllWGhaUGU1MnlDN29EZHRQZk05cGpvOEdzYVdTVFF3YmM2WFlDWFhsYUNQNApOcTd4SHNMdEdwcG5BdXJLOGwzZVJJZW1HSGN2U1crRTk3N0NOUVBMeDBjNTVGOGZUdkE5bTg3RE5pTkZSbWcvCjV6RkhLczZyWm52c21DdWhKcmtDQXdFQUFhT0JyekNCckRBT0JnTlZIUThCQWY4RUJBTUNCYUF3SFFZRFZSMGwKQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBd0hRWURWUjBPQkJZRQpGTnRSbUdtcFBCOFExYVF5MmxndE1hblZoTkV5TUI4R0ExVWRJd1FZTUJhQUZHblpxM2lWMkJhTGZVeDNBbHdPCmZWT2VtazdBTUMwR0ExVWRFUVFtTUNTQ0ltNXZaR1ZqYjI1bWFXZDJZV3hwWkdGMGIzSXVkR05oTFhONWMzUmwKYlM1emRtTXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQkhmbTYzL0V4MG1oN1FFU1VUTkFuU2tDZ3dNeXAzSwoxTEsvVmp0ekVlT3AzUzQzaHYrOEh5NWgveXpNdGMwQ2lDYTMrblZTSW5RR3hESnprT2doVWtMa1hqUzJpRjNFCmlzTTQ3Ynd3MXMzSk5RMFQ5V0o0ZE5oYjlQdWtLeEg4Qk5adnVzWGRBTTM5MGtLOFhGY2UzRXptVDZwTFdRczQKMFZ5bENpVnpHUjFucDRFaCt3YldOQk53TTBoTGI1RFczRTAxaXBTRVdmdmsrNWhCR3liak1BeUg2RkhNcHlBLwp3SFNQejlrVXZSMFJzamw0aWlzVFJZMm5FV2IwNHVMQVJ4eUdXK2NqZU4xQXlDZ1NZTmMvRHQvTWdJcjVoRGo1CitiR1BDVGZndlQ2aHE1SW43S3IwR1FWb0h1Y2poUlV6ZDhLdlEvS0VzZmFZR01sODNOMGptTjA9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K/g' nc_cert.yaml sed -i 's/\(tls.key:\).*/\1 LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMWdya1U3ZG1iWWNUaWJQdDlpb3d3YTRVZGk4QkpIdWZxZ0pPeHRvSi9SMTFMdjlYClArUm5ES1ZMaUprakorUDFTMW9UMnlJVUE1WEF5L0ZOdlo4NmdFeFR4QVAyZlNJd1IraXcwamZydStVY0FxQmcKamtPNlZvN3ozUmdPQUlwb1VlVHJWK0pDMmlBamdXUG9PQ2F5ckxTeTRqMXhCM3FTeXQ2U3luYlV4UXVJVUNGZwpHWmVsVHpzczJaanJRajhYcDh4Qy80YW1KQTM5UENWOXFiYXJ4cUo1ZUZrOTduYklMdWdOMjA5OHoybU9qd2F4CnBaSk5EQnR6cGRnSmRlVm9JL2cycnZFZXd1MGFtbWNDNnNyeVhkNUVoNllZZHk5SmI0VDN2c0kxQTh2SFJ6bmsKWHg5TzhEMmJ6c00ySTBWR2FEL25NVWNxenF0bWUreVlLNkVtdVFJREFRQUJBb0lCQUZqbGp5MGg1NzJuc3pxbQo2emNwRUxUd0t2bG16aytydElWMGplbFMxNEV6d2Q2eUdEZW1FaEtUZUVxVVo2Q0NzZmNJdzJSb3crMDFQaXkxCjNMYmJzZjFsTmdrY0tEeVNmWUR3S0xnMmw0YWpRajNwQkJFeUdlc25WaXRHZVZKS0tjZVJqeGtpRk9mcEh6WDMKRzVSdXBoakt0OXowN2NQUWFiVXVPY016RlcxOGVQc2lqaS9BblgybmRNa1Y1aVU1cHVMNWFNU1VTTUg0RjlpZwp5QWxQVHk0L3FXZlF2L25YSVZyczB3aWtFN05LR1NQdHFMZWlRYmp4a3YyRWRwWHFUY0trMklVSFpzTE1qbFZ3ClRtNEtNY29iU2JLQktiR2w4REk5Yk9KZjdYUmlKcFE0cmNObXRmaDhVaGFuR2lMZ1pDcmJGWWtiWk5YMXY4c0EKWWREb3FSMENnWUVBOXNWdW9RQ1Jqb05LUTlvSWwyTERteDc0RkROVm1TYmEwZ2d2SHVNTjg2NG5vaENiLy9XNwpaODFDWFR0bytxbVR6ek83QklzSDhvdE5tNXZublRHT1V4R0FQK2RuWmFMenRFOVYzSzFqYWFHdURoZHphRnNrCnk4eGR5am0vR2htV0szeFJ0WjRybjJoR2J0d0lxVHdORFJOMlBLNDNmc1ovQURocllvNEhKbThDZ1lFQTNnd2UKT2R4aGhpazQ1eHkycEdpVEM2RHVlMjVuQ3ZTRk1YWEdKeWNmK080R3VtZVBIdmR1MnA3SGdJTTk0NHRuVHNIagpyVWVWQ05PWVlFRGU0WnBFWG5pRXlCOFhlSWN6NFR6c3lrWEp1ZGloQUdoS0g3SE5xTkNjcGNSUi9QVFhTeXJ6ClRMb3h5MGkwRlRwL2VuVzJlQzhOUDRSRUNBQ0RHVkFQRzNuUjJWY0NnWUI4OXhaQzZpckw1S2lqRzdMbUZ0bS8Kb0RzNDM1WWxiSXU3ZVBHRHpxK3VDeTkrM3JKaE9HdWk4VXIrTTZ2QjVFWTUwNVNOaEdxTjVRVjBHOHQ2eXpHcgoxMXorLzR4WTUrQktHekw4QWNJcUovb2dvTGVNelRzaENXa2xrNEMzRXVYOU40T1pXWFAxMGJSNVIyd0xaNkdrClVZcTZ4KzdLZ0hLb0JlbzdpbmtNZVFLQmdRREJnbG9OSHN3MitWSEh4N1E4RDQ2bWdiZVVCaUR5NFNuNmNxTWYKbCs4N0oyVGhxa0tHUUNoeGloSmZJd0VhZm5DbnFEMWMwNWRFTy9MOVgwdGQzTzFjVHplWWw5QUNrQUZjZDVYOApxVmttQjI0NFJxcmllRGU4dVNEckxlNHR2c3FwaldLL0tUMGY1ZHBhN2NJTzNPc0tUaWNEaGFjc09oWUdSMGtECkx1VDh2UUtCZ1FEQ1RmSGVaREM2OGV0RCtwRk1zUWZ1VlhMMjg1dnJReE5qMndXaTVNK09jZmVjYmR3VFdZSjQKRGdFNnlGMXNsZGU2WmpEUFdWNTVQOERZSjhkbmFsMTRUZmdtRHhnakx3eVRSUFg4ODFiS1Vmbk9oVThveVBwMgpzbTNrV0MzWFNKNWViaktRNk0zdXM3aUNxM05QUDVQL1ZSUE4yV2xjRU9hMWhncUExZ1F4Umc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=/g' nc_cert.yaml KUBECONFIG=${kube_path} kubectl apply -f nc_cert.yaml rm -rf nc_cert.yaml sleep 10 if ! post_check_nc $kube_path; then RedLetter "Post check for cluster $cluster_name failed" echo "" else GreenLetter "###### Update nodeconfig cert for cluster $cluster_name successfully ######" echo "" fi } list_clusters() { local mcspoke_pod_ip="127.0.0.1" if [[ "$TCAVER" != "2.3" ]]; then mcspoke_pod_ip=$(kubectl get pods -n tca-cp-cn -l app=k8s-bootstrapper -o json | jq -r '.items[0].status.podIP') fi echo "Start to get management cluster list under this TCA-CP" local mgmt_clusters=$(curl -s "http://${mcspoke_pod_ip}:8888/api/v1/managementclusters") if [ $? -ne 0 ] || [ -z "${mgmt_clusters}" ]; then RedLetter "Fail to get management cluster list. Please check whether tca-cp-cn/k8s-bootstrapper service is working well." return 1 fi while read item; do data=(`echo $item`) if [ ${#data[@]} -eq 2 ]; then name=${data[0]} echo "start to get workload cluster list under management cluster $name" get_v1_wc_list $name GetMcKubeconfig ${name} if [ $? -ne 0 ]; then RedLetter "${ERROR_MSG}" else cmd="KUBECONFIG=${mc_kubeconfig_path} kubectl get tkc -A -o json | jq -r '.items[] | select (.metadata.name != \"${name}\") | .metadata.name'" #echo $cmd wc_clusters=$(eval "$cmd") if [ $? -ne 0 ] || [ -z "${wc_clusters}" ]; then YellowLetter "No workload clusters found for management cluster ${name}" CLUSTERS_ARRAY[$name]="[]" else CLUSTERS_ARRAY[$name]="${wc_clusters}" fi fi fi done <<< $(echo ${mgmt_clusters} | jq -r '.[] | "\(.clusterName) \(.id)"') if [ ${#CLUSTERS_ARRAY[@]} -gt 0 ]; then echo "Get below management clusters and workload clusters under this TCA-CP" printf "%-64s" "Management Cluster" printf "%-80s\n" "Workload Clusters" printf -v spaces '%*s' 30 ''; printf '%s\n' ${spaces// /---} for cluster in ${!CLUSTERS_ARRAY[@]} do printf "%-64s" $cluster printf "%-80s\n" "${CLUSTERS_ARRAY[$cluster]}" done fi } ################## main() ################## # Call the function to parse parameters passed to the script if ! parse_parameters "$@"; then usage fi trap cleanup_tmp_file EXIT # Example usage of the parsed options echo "MC Name: $mc_name" echo "WC Name: $wc_name" echo "" if [ -z "$mc_name" ]; then echo "Error: No mc name provided" usage fi if ! GetMcKubeconfig "$mc_name"; then RedLetter "Failed to get MC kubeconfig" exit 1 fi prepare_overlay_file if [ -z "$wc_name" ]; then cmd="KUBECONFIG=${mc_kubeconfig_path} kubectl get cluster -A | grep -v '^NAME' | grep -v "tkg-system" | cut -d ' ' -f 1 | xargs | tr ' ' ','" wc_name_list=$(eval "$cmd") echo "" GreenLetter "###### Detected workload clusters $wc_name_list ######" echo "" # patch mc patch_vmconfig $mc_kubeconfig_path $mc_name patch_one_cluster $mc_kubeconfig_path $mc_name # patch both v1 and v2 wc IFS=',' for item in $wc_name_list; do prepare_kubeconfig $item out=$(KUBECONFIG=$mc_kubeconfig_path kubectl get tcakubernetesclusters $item -n $item 2>&1) if [[ "$out" == *"not found"* || "$out" == *"No resources found"* ]]; then YellowLetter "No tcakubernetesclusters named as $item found. Will try it as v1 cluster" # echo "will patch v1 cluster $item" patch_v1_cluster $wc_kubeconfig_path $item else # echo "will patch v2 cluster $item" patch_one_cluster $wc_kubeconfig_path $item fi done else prepare_kubeconfig $wc_name # for TCA2.3, need consider if v1 cluster exists KUBECONFIG=$mc_kubeconfig_path kubectl get tcakubernetesclusters $wc_name -n $wc_name 2>&1 if [ $? -ne 0 ]; then YellowLetter "No tcakubernetesclusters named as $wc_name found. Will try it as v1 cluster" patch_v1_cluster $wc_kubeconfig_path $wc_name else patch_one_cluster $wc_kubeconfig_path $wc_name fi fi