Automate securing registry route

secure_registry_route.sh

#!/bin/bash

# per https://access.redhat.com/documentation/en/openshift-enterprise/3.2/paged/installation-and-configuration/chapter-2-installing#securing-the-registry
# Get route hostname, create self-signed certs, create cert secret, add to deployment, update env vars and patch the probes

ROUTE=$(oc get route docker-registry --template={{.spec.host}}) -n default
SERVICEIP=$(oc get service docker-registry --template={{.spec.clusterIP}})

oadm ca create-server-cert \
    --signer-cert=/etc/origin/master/ca.crt \
    --signer-key=/etc/origin/master/ca.key \
    --signer-serial=/etc/origin/master/ca.serial.txt \
    --hostnames="${ROUTE},docker-registry.default.svc.cluster.local,${SERVICEIP}" \
    --cert=/etc/secrets/registry.crt \
    --key=/etc/secrets/registry.key
oc secrets new registry-secret \
    /etc/secrets/registry.crt \
    /etc/secrets/registry.key
oc secrets add serviceaccounts/registry secrets/registry-secret
oc secrets add serviceaccounts/default secrets/registry-secret
oc volume dc/docker-registry --add --type=secret \
    --secret-name=registry-secret -m /etc/secrets
oc env dc/docker-registry \
    REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt \
    REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key
oc patch dc/docker-registry --api-version=v1 -p '{"spec": {"template": {"spec": {"containers":[{
    "name":"registry",
    "livenessProbe":  {"httpGet": {"scheme":"HTTPS"}}
  }]}}}}'
oc patch dc/docker-registry --api-version=v1 -p '{"spec": {"template": {"spec": {"containers":[{
    "name":"registry",
    "readinessProbe":  {"httpGet": {"scheme":"HTTPS"}}
  }]}}}}'

secure_registry_route_optimized.sh

#!/bin/bash

# Optimized (untested!): create route and certs first, then attach certs when registry is created

ROUTE=$(oc get route docker-registry --template={{.spec.host}}) -n default
SERVICEIP=$(oc get service docker-registry --template={{.spec.clusterIP}})
oadm ca create-server-cert -n default \
    --signer-cert=/etc/origin/master/ca.crt \
    --signer-key=/etc/origin/master/ca.key \
    --signer-serial=/etc/origin/master/ca.serial.txt \
    --hostnames="${ROUTE},docker-registry.default.svc.cluster.local,${SERVICEIP}" \
    --cert=/etc/secrets/registry.crt \
    --key=/etc/secrets/registry.key

oadm registry -n default \
    --tls-certificate=/etc/secrets/registry.crt \
    --tls-key=/etc/secrets/registry.key