From f617cc5d8f452cf84109c34005adef05184a417f Mon Sep 17 00:00:00 2001
From: Rei Oliveira <Reinildes.JoseMateusOliveira@windriver.com>
Date: Wed, 31 Jan 2024 17:59:07 -0300
Subject: [PATCH] Fail fast improvement to show-certs

When k8s certificates are expired, this script can take more than 1
minute to return. During debugging, I noticed that the most time
consuming step is PrintCertInfo-for-OIDC-Certificates, which queries
for kubernetes secret many times. PrintCertInfo-fromGenericSecret,
below it, also makes a few calls with kubectl.

This commit adds a variable to capture the return of 'kubeadm certs
check-expiration' command and then only calls
PrintCertInfo-for-OIDC-Certificates if the RC is successful.

This reduces the overall execution time from about 1 minute to around
10 seconds.

Test Plan:
PASS: Run show-certs in c0 and c1 and verify it finishes successfully
      and the output before and after this change is the same
PASS: Cause k8s certificates for expire. run show-certs in c0 and c1 and
      verify it finishes successfully in less than 10s. Verify that the
      output before and after this change is the same.

Story: 2010815
Task: 49485
Change-Id: I9f3eaec3a543fdea278e04c2f1895685bc333505
Signed-off-by: Rei Oliveira <Reinildes.JoseMateusOliveira@windriver.com>
---
 utilities/platform-util/scripts/show-certs.sh | 35 +++++++++++--------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/utilities/platform-util/scripts/show-certs.sh b/utilities/platform-util/scripts/show-certs.sh
index 8a16254d..f14c517d 100755
--- a/utilities/platform-util/scripts/show-certs.sh
+++ b/utilities/platform-util/scripts/show-certs.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2021-2023 Wind River Systems, Inc.
+# Copyright (c) 2021-2024 Wind River Systems, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -398,13 +398,26 @@ PrintCertInfo-fromFile "DC-AdminEp-Server" "/etc/ssl/private/admin-ep-cert.pem"
 PrintCertInfo-fromFile "openstack" "/etc/ssl/private/openstack/cert.pem" "${RED}Manual${RESET}"
 PrintCertInfo-fromFile "openstack CA" "/etc/ssl/private/openstack/ca-cert.pem" "${RED}Manual${RESET}"
 
-# OIDC
-PrintCertInfo-for-OIDC-Certificates
+# works with stable and experimental certs subcommand
+kubeadm certs -h &> /dev/null
+if [ $? -eq 0 ]; then
+    CERTS_CMD='certs'
+else
+    CERTS_CMD='alpha certs'
+fi
 
-# analytics certificates
-PrintCertInfo-fromGenericSecret "Internal Analytics CA Certificate" "monitor" "mon-elastic-services-secrets" "ca.crt"
-PrintCertInfo-fromGenericSecret "External Analytics CA Certificate" "monitor" "mon-elastic-services-secrets" "ext-ca.crt"
-PrintCertInfo-fromGenericSecret "External Kibana Certificate" "monitor" "mon-elastic-services-secrets" "kibana.crt"
+K8S_CERTS_OUTPUT=$(kubeadm $CERTS_CMD check-expiration 2> /dev/null)
+K8S_CERTS_RC=$?
+
+if [ $K8S_CERTS_RC -eq 0 ]; then
+    # OIDC
+    PrintCertInfo-for-OIDC-Certificates
+
+    # analytics certificates
+    PrintCertInfo-fromGenericSecret "Internal Analytics CA Certificate" "monitor" "mon-elastic-services-secrets" "ca.crt"
+    PrintCertInfo-fromGenericSecret "External Analytics CA Certificate" "monitor" "mon-elastic-services-secrets" "ext-ca.crt"
+    PrintCertInfo-fromGenericSecret "External Kibana Certificate" "monitor" "mon-elastic-services-secrets" "kibana.crt"
+fi
 
 # Kubernetes Certificates
 echo
@@ -414,13 +427,7 @@ echo "Note: 'CERTIFICATES'            are Renewal: ${GREEN}Automatic${RESET}"
 echo "Note: 'CERTIFICATE AUTHORITIES' are Renewal: ${RED}Manual${RESET}"
 echo
 
-# works with stable and experimenal certs subcommand
-kubeadm certs -h &> /dev/null
-if [ $? -eq 0 ]; then
-    kubeadm certs check-expiration
-else
-    kubeadm alpha certs check-expiration
-fi
+echo "$K8S_CERTS_OUTPUT"
 
 # ETCD certificates
 # ETCD certificates are automatically renewed by kube_root_ca_rotation cron job