voltron/NodeMgmt
1
1
Fork 0
Code Issues Pull Requests Releases 1 Activity

update

Browse Source
This commit is contained in:
David Schroeder
2025-11-15 20:26:46 -06:00
parent f7391b49de
commit c33283530e
2 changed files with 71 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

149
inc/vCenter-SSL.ps1
View File

@@ -1,43 +1,32 @@
#!/usr/bin/env pwsh
# -----------------------------------------------------------------------------------
# vCenter + Posh-ACME Script (Fully Automated with Verbose Logging)
# vCenter + Posh-ACME Script (Fully Automated, Idempotent, Verbose Logging)
# -----------------------------------------------------------------------------------
. /opt/idssys/nodemgmt/conf/powerwall/settings.ps1
# ----------------------------
# Global variables for troubleshooting
# ----------------------------
$global:helpme = $null
$global:responseBody = $null
# ----------------------------
# Error handler
# ----------------------------
function Show-Failure {
param([System.Management.Automation.ErrorRecord]$ErrorRecord)
$global:responseBody = $ErrorRecord.Exception.Message
$global:helpme = $global:responseBody
Write-Host "----------------------------------------" -ForegroundColor Red
Write-Host "Status: A system exception was caught." -ForegroundColor Red
Write-Host $global:responseBody -ForegroundColor Red
Write-Host "The request/response body has been saved to `$global:helpme" -ForegroundColor Red
Write-Host "----------------------------------------" -ForegroundColor Red
exit 1
}
# ----------------------------
# Ensure PowerCLI module
# PowerCLI
# ----------------------------
if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI)) {
Install-Module -Name VMware.PowerCLI -Force -Scope AllUsers
}
Import-Module VMware.PowerCLI -ErrorAction Stop
# Ignore self-signed cert warnings
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false | Out-Null
# ----------------------------
@@ -58,12 +47,10 @@ try {
$vms = Get-VM
Write-Host "Retrieved VM list:" -ForegroundColor Cyan
$vms | ForEach-Object { Write-Host " - $($_.Name)" }
} catch {
Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow
}
} catch { Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow }
# ----------------------------
# Ensure Posh-ACME module
# Posh-ACME
# ----------------------------
if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
Install-Module -Name Posh-ACME -Force -Scope AllUsers
@@ -71,47 +58,48 @@ if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
Import-Module Posh-ACME -ErrorAction Stop
# ----------------------------
# ACME / PowerDNS certificate request
# Determine if ACME request is needed
# ----------------------------
# Convert API key to SecureString for PowerDNS plugin
if ($PDNSAPI -is [string]) {
$securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force
} else {
$securePDNSAPI = $PDNSAPI
}
$pArgs = @{
PowerDNSApiHost = $WDNSHOST
PowerDNSApiKey = $securePDNSAPI
PowerDNSUseTLS = $true
PowerDNSPort = 443
PowerDNSServerName = 'localhost'
}
$certName = "vcenter-cert"
$certSuccess = $false
$existingCert = Get-PAOrder -Domain $VCENTERHOST -ErrorAction SilentlyContinue | Sort-Object Created -Descending | Select-Object -First 1
try {
Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan
New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force -DnsSleep 15
$certSuccess = $true
} catch {
Write-Host "ACME certificate request failed: $($_.Exception.Message)" -ForegroundColor Yellow
$global:helpme = $_.Exception.Message
}
# ----------------------------
# Collect certificate paths dynamically
# ----------------------------
if ($certSuccess) {
# Get the most recent order
$paOrder = Get-PAOrder | Sort-Object Created -Descending | Select-Object -First 1
$certFolder = $paOrder.CertFolder
if ($existingCert -and ($existingCert.Cert.NotAfter -gt (Get-Date).AddDays(30))) {
Write-Host "Existing certificate valid >30 days (expires $($existingCert.Cert.NotAfter)), skipping ACME request." -ForegroundColor Green
$certFolder = $existingCert.CertFolder
$certPath = Join-Path $certFolder "cert.pem"
$keyPath = Join-Path $certFolder "privkey.pem"
$chainPath = Join-Path $certFolder "chain.pem"
$certSuccess = $true
} else {
if ($PDNSAPI -is [string]) { $securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force } else { $securePDNSAPI = $PDNSAPI }
$pArgs = @{
PowerDNSApiHost = $WDNSHOST
PowerDNSApiKey = $securePDNSAPI
PowerDNSUseTLS = $true
PowerDNSPort = 443
PowerDNSServerName = 'localhost'
}
try {
Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan
New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force -DnsSleep 15
$paOrder = Get-PAOrder | Sort-Object Created -Descending | Select-Object -First 1
$certFolder = $paOrder.CertFolder
$certPath = Join-Path $certFolder "cert.pem"
$keyPath = Join-Path $certFolder "privkey.pem"
$chainPath = Join-Path $certFolder "chain.pem"
$certSuccess = $true
} catch {
Write-Host "ACME request failed: $($_.Exception.Message)" -ForegroundColor Yellow
$global:helpme = $_.Exception.Message
}
}
# ----------------------------
# Validate certificate files
# ----------------------------
if ($certSuccess) {
foreach ($f in @($certPath, $keyPath, $chainPath)) {
if (-not (Test-Path $f)) {
Write-Host "Certificate file missing: $f" -ForegroundColor Yellow
@@ -121,48 +109,56 @@ if ($certSuccess) {
}
# ----------------------------
# Upload and apply certificate via REST (with verbose logging)
# Check if vCenter already has this cert
# ----------------------------
$updateNeeded = $true
if ($certSuccess) {
try {
$sessionHeaders = @{
'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId
}
$sessionHeaders = @{ 'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId }
$vcenterCertUri = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls"
$vCenterCert = Invoke-RestMethod -Uri $vcenterCertUri -Method Get -SkipCertificateCheck -Headers $sessionHeaders -ErrorAction Stop
$currentCertPem = $vCenterCert.certificate | Out-String
$newCertPem = Get-Content -Path $certPath -Raw
if ($currentCertPem -eq $newCertPem) {
Write-Host "vCenter already has the latest certificate applied. Skipping upload/apply." -ForegroundColor Green
$updateNeeded = $false
}
} catch {
Write-Host "Unable to verify current vCenter certificate, will attempt update." -ForegroundColor Yellow
}
}
# ----------------------------
# Upload & apply if needed
# ----------------------------
if ($certSuccess -and $updateNeeded) {
try {
$body = @{
cert = Get-Content -Path $certPath -Raw
key = Get-Content -Path $keyPath -Raw
chain = Get-Content -Path $chainPath -Raw
}
$jsonBody = $body | ConvertTo-Json -Compress
$uriUpload = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls"
Write-Host "Uploading TLS certificate to vCenter..." -ForegroundColor Cyan
Write-Host "URI: $uriUpload" -ForegroundColor DarkCyan
Write-Host "Headers: $(ConvertTo-Json $sessionHeaders -Compress)" -ForegroundColor DarkCyan
Write-Host "Body length: $($jsonBody.Length) characters" -ForegroundColor DarkCyan
$uploadResp = Invoke-RestMethod -Uri $uriUpload -Method Post -Body $jsonBody -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck -Verbose
Write-Host "Upload response: $(ConvertTo-Json $uploadResp -Compress)" -ForegroundColor Green
Invoke-RestMethod -Uri $vcenterCertUri -Method Post -Body ($body | ConvertTo-Json -Compress) -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck
Write-Host "Certificate uploaded successfully." -ForegroundColor Green
$uriApply = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls?action=apply"
Write-Host "Applying TLS certificate to vCenter..." -ForegroundColor Cyan
Write-Host "URI: $uriApply" -ForegroundColor DarkCyan
$applyResp = Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck -Verbose
Write-Host "Apply response: $(ConvertTo-Json $applyResp -Compress)" -ForegroundColor Green
Write-Host "Certificate uploaded and applied successfully." -ForegroundColor Green
Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck
Write-Host "Certificate applied successfully." -ForegroundColor Green
} catch {
Write-Host "Certificate upload/apply failed: $($_.Exception.Message)" -ForegroundColor Red
$global:helpme = $_.Exception.Message
}
} else {
Write-Host "Skipping certificate upload/apply due to previous errors." -ForegroundColor Yellow
} elseif ($certSuccess -and -not $updateNeeded) {
Write-Host "Certificate already current, no changes applied." -ForegroundColor Green
}
# ----------------------------
# Automatic vpxd restart via REST with retries
# Automatic vpxd restart via REST
# ----------------------------
$maxRetries = 20
$retryCount = 0
@@ -170,19 +166,17 @@ $restartSucceeded = $false
while ($retryCount -lt $maxRetries -and -not $restartSucceeded) {
try {
# Test if REST endpoint is available
$healthUri = "https://$VCENTERHOST/rest/appliance/health/system"
Write-Host "Checking vCenter REST health endpoint..." -ForegroundColor Cyan
$resp = Invoke-RestMethod -Uri $healthUri -Method Get -SkipCertificateCheck -ErrorAction Stop
Invoke-RestMethod -Uri $healthUri -Method Get -SkipCertificateCheck -ErrorAction Stop
# Restart vpxd service
$restartUri = "https://$VCENTERHOST/rest/appliance/system/services/vpxd?action=restart"
Write-Host "Requesting vpxd service restart via REST..." -ForegroundColor Cyan
Invoke-RestMethod -Uri $restartUri -Method Post -SkipCertificateCheck -ErrorAction Stop
Write-Host "vpxd service restart requested successfully." -ForegroundColor Green
$restartSucceeded = $true
} catch {
Write-Host "vpxd REST endpoint not ready yet, retrying in 15 seconds... (Attempt $($retryCount+1)/$maxRetries)" -ForegroundColor Yellow
Write-Host "vpxd REST endpoint not ready, retrying 15 seconds... (Attempt $($retryCount+1)/$maxRetries)" -ForegroundColor Yellow
Start-Sleep -Seconds 15
$retryCount++
}
@@ -194,8 +188,5 @@ if (-not $restartSucceeded) {
Write-Host "ssh root@$VCENTERHOST 'service-control --stop vpxd; service-control --start vpxd'" -ForegroundColor Red
}
# ----------------------------
# Completion message
# ----------------------------
Write-Host ""
Write-Host "Script completed. Check `$global:helpme for any error details." -ForegroundColor Green