OpenShift Code Snippets

List routes with Missing SSL Certificates

Current Project

Command

oc get route -o json \
    | jq -r '.items[]
              | (.metadata.annotations."kubernetes.io/tls-acme" == "false") as $acme_disabled
              | .spec
              | if
                    (.path//"" | startswith("/.well-known/acme-challenge/"))
                    or
                    (.tls | has("key"))
                then
                    empty
                else
                    if $acme_disabled then
                        .host + .path + " (acme disabled)"
                    else
                        .host + .path
                    end
                end
            '

Sample Output

example.net
docs.example.net (acme disabled)
www.example.net

Routes with an explicit kubernetes.io/tls-acme = "false" annotation are marked acme disabled.

All Projects

Command

for n in $(oc projects -q); do
    oc -n "$n" get route -o json \
        | jq -r '.items[]
                  | (.metadata.annotations."kubernetes.io/tls-acme" == "false") as $acme_disabled
                  | .spec
                  | if
                        (.path//"" | startswith("/.well-known/acme-challenge/"))
                        or
                        (.tls | has("key"))
                    then
                        empty
                    else
                        if $acme_disabled then
                            .host + .path + " (acme disabled)"
                        else
                            .host + .path
                        end
                    end
                ' \
        | awk -v prefix="$n" '$0=prefix": "$0'
done

Sample Output

toco-nice-spv: spvo.ch
toco-nice-spv: www.spvo.ch
toco-nice-svz: svz.tocco.ch (acme disabled)
toco-nice-tocco: manual.tocco.ch

Routes with an explicit kubernetes.io/tls-acme = "false" annotation are marked acme disabled.

List routes with ACME disabled or unset

List all routes with missing kubernetes.io/tls-acme as unset and routes with kubernetes.io/tls-acme = "false" as disabled.

Current Project

Command

oc get route -o json \
    | jq -r '.items[]
              | .spec.host as $host
              | (.spec.path//"") as $path
              | if $path|startswith("/.well-known/acme-challenge/") | not then
                   .metadata.annotations
                   | if has("kubernetes.io/tls-acme") then
                         if ."kubernetes.io/tls-acme" == "true" then
                             empty
                         elif ."kubernetes.io/tls-acme" == "false" then
                             $host + $path + ": disabled"
                         else
                             $host + $path + ": unknown"
                         end
                     else
                         $host + $path + ": unset"
                     end
                else
                    empty  # paths starts with "/.well-known/acme-challenge/"
                end
            '

Sample Output

backoffice.tocco.ch: unset
cockpit.tocco.ch: unset
extranet.tocco.ch: unset
manual.tocco.ch: disabled

All Projects

Command

for n in $(oc projects -q); do
    oc -n "$n" get route -o json \
        | jq -r '.items[]
                  | .spec.host as $host
                  | (.spec.path//"") as $path
                  | if $path|startswith("/.well-known/acme-challenge/") | not then
                       .metadata.annotations
                       | if has("kubernetes.io/tls-acme") then
                             if ."kubernetes.io/tls-acme" == "true" then
                                 empty
                             elif ."kubernetes.io/tls-acme" == "false" then
                                 $host + $path + ": disabled"
                             else
                                 $host + $path + ": unknown"
                             end
                         else
                             $host + $path + ": unset"
                         end
                    else
                        empty  # path starts with "/.well-known/acme-challenge/"
                    end
                ' \
        | awk -v prefix="$n" '$0=prefix": "$0'
done

Sample Output

toco-nice-tocco: cockpit.tocco.ch: unset
toco-nice-tocco: extranet.tocco.ch: unset
toco-nice-tocco: manual.tocco.ch: disabled
toco-nice-zewo: www.zewo.ch: unset
toco-nice-zewo: zewo.ch: unset