From 3ddc1e4ed33a47196c65f50b7ff2adcc2b887f2f Mon Sep 17 00:00:00 2001
From: Judd Maltin <judd@newgoliath.com>
Date: Thu, 23 Jan 2025 13:29:44 -0500
Subject: [PATCH 1/2] add utils-script to set up passthrough routes to central

---
 .../README.md                                 | 23 +++++++++++++++++++
 .../acs-route-passthrough-tls-certs.sh        | 17 ++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 util-scripts/rhacs-route-passthrough-tls-certs/README.md
 create mode 100644 util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh

diff --git a/util-scripts/rhacs-route-passthrough-tls-certs/README.md b/util-scripts/rhacs-route-passthrough-tls-certs/README.md
new file mode 100644
index 0000000..d5fab6d
--- /dev/null
+++ b/util-scripts/rhacs-route-passthrough-tls-certs/README.md
@@ -0,0 +1,23 @@
+# Set up ACS Passthrough TLS Routes with Central's CA
+
+Get rid of the cert errors when accessing the Central web UI by
+adding the Central certs to Central's Route
+
+This is a one liner.
+
+Must be logged in to OpenShift as cluster-admin.
+
+**Required Environment Vars:**
+* logged into OpenShift as cluster-admin.
+
+**Required Tools:**
+* `bash`
+* `oc` logged into the OpenShift Cluster with ACS already installed.
+* `sed`
+
+**Output:**
+* No output
+
+**Usage:**
+`./acs-route-passthrough-tls-certs.sh`
+
diff --git a/util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh b/util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh
new file mode 100644
index 0000000..9c49a7a
--- /dev/null
+++ b/util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh
@@ -0,0 +1,17 @@
+!#/bin/bash
+
+# on openshift, set up acs passthrough routes with Central's CA
+
+oc apply -f - <<EOF
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: central
+  namespace: {{ .Values.stackrox_namespace }}
+spec:
+  tls:
+    destinationCACertificate: |
+$(oc extract secret/central-tls -n {{ .Values.stackrox_namespace }} --keys ca.pem --to=- | sed 's/^/      /' )
+EOF
+
+

From 7c500caccfd5a99401bab83500b4600c4031d419 Mon Sep 17 00:00:00 2001
From: Judd Maltin <judd@newgoliath.com>
Date: Thu, 23 Jan 2025 17:29:01 -0500
Subject: [PATCH 2/2] actually not passthrough, rather reencrypt

---
 .../README.md                                                  | 0
 .../acs-route-reencrypt-tls-certs.sh}                          | 3 ++-
 2 files changed, 2 insertions(+), 1 deletion(-)
 rename util-scripts/{rhacs-route-passthrough-tls-certs => rhacs-route-reencrypt-tls-certs}/README.md (100%)
 rename util-scripts/{rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh => rhacs-route-reencrypt-tls-certs/acs-route-reencrypt-tls-certs.sh} (77%)

diff --git a/util-scripts/rhacs-route-passthrough-tls-certs/README.md b/util-scripts/rhacs-route-reencrypt-tls-certs/README.md
similarity index 100%
rename from util-scripts/rhacs-route-passthrough-tls-certs/README.md
rename to util-scripts/rhacs-route-reencrypt-tls-certs/README.md
diff --git a/util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh b/util-scripts/rhacs-route-reencrypt-tls-certs/acs-route-reencrypt-tls-certs.sh
similarity index 77%
rename from util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh
rename to util-scripts/rhacs-route-reencrypt-tls-certs/acs-route-reencrypt-tls-certs.sh
index 9c49a7a..7f213f4 100644
--- a/util-scripts/rhacs-route-passthrough-tls-certs/acs-route-passthrough-tls-certs.sh
+++ b/util-scripts/rhacs-route-reencrypt-tls-certs/acs-route-reencrypt-tls-certs.sh
@@ -1,6 +1,6 @@
 !#/bin/bash
 
-# on openshift, set up acs passthrough routes with Central's CA
+# on openshift, set up acs reencrypt routes with Central's CA
 
 oc apply -f - <<EOF
 apiVersion: route.openshift.io/v1
@@ -10,6 +10,7 @@ metadata:
   namespace: {{ .Values.stackrox_namespace }}
 spec:
   tls:
+    termination: reencrypt
     destinationCACertificate: |
 $(oc extract secret/central-tls -n {{ .Values.stackrox_namespace }} --keys ca.pem --to=- | sed 's/^/      /' )
 EOF