dlbewley

#!/bin/bash
# https://guifreelife.com/blog/2021/08/13/RHACM-Recover-Created-Cluster-Credentials-and-Kubeconfig/
#
# If an OpenShift cluster was created by RHACM this script will extract the
# kubeconfig and the default kubeadmin credentials.
#
# Prereqs:
# - Authenticated to hub cluster
# - Managed cluster name is the sames as the hosting namespace on hub cluster

dlbewley

#!/bin/bash
oc extract cm/cluster-config-v1 -n kube-system --to=-

dlbewley

[0.000001, "o", "\u001b[H\u001b[J"]

dlbewley

#!/bin/sh
# once you have tracked a file, .gitignore will not have an effect on it, even if you
# ignore the enclosing directory.
# be sure to commit example secrets before adding this to .git/hooks/pre-commit

# Redirect output to stderr.
exec 1>&2

DENY_LIST="secrets|certs"

dlbewley

#!/bin/bash

# read values from 1Password, YMMV
CLUSTER="hub-lab-bewley-net"
VAULT="development"
ROX_CENTRAL_ENDPOINT="$(op read op://$VAULT/$CLUSTER/acs/endpoint)" # cluster
ROX_CENTRAL_ENDPOINT_PUB="$(op read op://$VAULT/$CLUSTER/acs/endpoint-pub)" # public
ROX_CA_CERT="$(op read op://$VAULT/$CLUSTER/acs/ca)"
ROX_API_TOKEN="$(op read op://$VAULT/$CLUSTER/acs/admin-token)"

dlbewley

#!/bin/bash

ROXCTL_IMAGE="registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8:3.71"

# Central CA cert:
#   oc extract secrets/service-ca -n stackrox --keys=ca.pem --to=-

# read values from 1Password YMMV
CLUSTER="hub-lab-bewley-net"
VAULT="development"

dlbewley

# if you don't want to just use --authfile or set REGISTRY_AUTH_FILE for whatever reason
# you may login to each registry in your pull secret thusly
# spoiler alert, here's how to extract usernames and passwords from your pull secret

PULL_SECRET_PATH=pull-secret.json

for R in $(jq -r '.auths|keys[]' $PULL_SECRET_PATH ); do
  echo "Logging into $R"
  U=$(jq -r ".auths.\"$R\".auth" $PULL_SECRET_PATH | base64 -d | awk -F: '{print $1}')
  P=$(jq -r ".auths.\"$R\".auth" $PULL_SECRET_PATH | base64 -d | awk -F: '{print $2}')

dlbewley

# split a file having multiple policies into multiple files
# each file is named policy-<policy_name> and contains 1 policy
yq e '.|split_doc' -s '.kind + "-" + .metadata.name | downcase' multi-policy.yaml

# create manifests dir for each policy
# place object definitions from each policy into corresponding manifest dir
for p in policy-*; do
  policy_name=$(yq '.metadata.name' $p);
  mkdir -p "manifests-$policy_name"
  yq '.spec.policy-templates[].objectDefinition[].object-templates[].objectDefinition | split_doc' \

dlbewley

#!/bin/sh
cat $KUBECONFIG \
    | yq e '.clusters[0].cluster."certificate-authority-data"' \
    | base64 -d > kubeconfig-ca-data.pem
    
split -p "-----BEGIN CERTIFICATE-----" kubeconfig-ca-data.pem cert-

for c in cert-??; do
    subject=`openssl x509 -in $c -noout  -subject | sed 's/^.*CN[[:space:]]*=[[:space:]]*\(.*\)/\1/'`
    echo $subject

dlbewley

#!/bin/bash
# Connect to the OVN northbound database pod.
# Optionally specify the node and or command
# https://guifreelife.com/blog/2024/11/19/Open-Virtual-Network-Inspection-on-OpenShift/

node=$1; shift; cmd=$*

if [[ -n "$node" ]]; then
    nbdbpod=$(oc get pod \
            -l app=ovnkube-node \