20953: Sets sensible coloring thresholds on cert expire dates.

If using Let's Encrypt certificates, the max lifetime is 3 months, so it'll
show green if the expiration is >2 months out, yellow if it's >1.

Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <lucas.dipentima@curii.com>

diff --git a/tools/salt-install/common.sh b/tools/salt-install/common.sh
index 5d9dba14cdf2bd9585b712c2c028ffbe09de84c9..360c2c7cc37d2cf8a75824807300cc67ac1af908 100644 (file)
--- a/tools/salt-install/common.sh
+++ b/tools/salt-install/common.sh
@@ -48,6 +48,14 @@ for node in "${!NODES[@]}"; do
   done
 done
 
+# Sets TLS certificate expiration thresholds
+TLS_EXPIRATION_YELLOW=5184000 # > 2 months
+TLS_EXPIRATION_GREEN=15552000 # > 6 months
+if [[ "${SSL_MODE}" == "lets-encrypt" ]]; then
+  TLS_EXPIRATION_YELLOW=2592000 # > 1 months
+  TLS_EXPIRATION_GREEN=5184000 # > 2 months
+fi
+
 # Auto-detects load-balancing mode
 if [ -z "${ROLE2NODES['balancer']:-}" ]; then
   ENABLE_BALANCER="no"

diff --git a/tools/salt-install/config_examples/multi_host/aws/dashboards/ssl-certificate-monitor.json b/tools/salt-install/config_examples/multi_host/aws/dashboards/ssl-certificate-monitor.json
index 92eb5391a77fa92d18982ccecb89e102d378e5cb..fc4f8c66797799ee43ecd6354a25ef5a0723425d 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/dashboards/ssl-certificate-monitor.json
+++ b/tools/salt-install/config_examples/multi_host/aws/dashboards/ssl-certificate-monitor.json
@@ -171,11 +171,11 @@
                       },
                       {
                         "color": "semi-dark-yellow",
-                        "value": 12096000
+                        "value": __TLS_EXPIRATION_YELLOW__
                       },
                       {
                         "color": "semi-dark-green",
-                        "value": 25920000
+                        "value": __TLS_EXPIRATION_GREEN__
                       }
                     ]
                   }

diff --git a/tools/salt-install/provision.sh b/tools/salt-install/provision.sh
index a93899a61a338fa10c54f361a4688f1acc4b6c8c..9b69bbffeca5af18772d00b4edb562c3f26a78a0 100755 (executable)
--- a/tools/salt-install/provision.sh
+++ b/tools/salt-install/provision.sh
@@ -722,7 +722,9 @@ else
         # "ArvadosPromDataSource" is the hardcoded UID for Prometheus' datasource
         # in Grafana.
         for f in $(ls "${GRAFANA_DASHBOARDS_DIR}"/*.json); do
-          sed 's#${DS_PROMETHEUS}#ArvadosPromDataSource#g' \
+          sed "s#__TLS_EXPIRATION_YELLOW__#${TLS_EXPIRATION_YELLOW}#g;
+               s#__TLS_EXPIRATION_GREEN__#${TLS_EXPIRATION_GREEN}#g;
+               s#\${DS_PROMETHEUS}#ArvadosPromDataSource#g" \
           "${f}" > "${GRAFANA_DASHBOARDS_DEST_DIR}"/$(basename "${f}")
         done