Package: google-ssl
Google Cloud Function SSL Rotator ToolThis tool allows you to use Google cloud function to rotate a regional SSL cert for a regional Google target https proxy.Note: This tool only supports regional google ssl certs and regional google target https proxies.OverviewYou'll upload cert files to the configured GCS bucket, and it'll use the cert files to create a google ssl create and update the target https proxy. For clarity, here are the steps:Upload your SSL cert files to your GCS Bucket, IE: cert1.key and cert1.crtThe Cloud function listens to the upload event.Function creates a self-managed Google SSL Certificate with the same name as the uploaded file. IE: cert1Function updates the target https proxy with the new cert.NotesTheGOOGLE_PROJECTenv variable must be set for this script to work.The Google Cloud Function is written in Python and uses purely the Google Cloud SDK. It does not usegcloud. This allows it to run on a Google Cloud Function.The tool comes with thegoogle-ssl deploycommand to deploy the function to Google Cloud functions. It creates the necessary resources, like an IAM service account with required permissions. While the Google Cloud Function itself does not require gcloud, some parts of the deploy command do rely on thegcloudcli. Note: There was an attempt to use the pure Google Cloud SDK, but it proved unsatisfactory. The SDK does not document deployment well, and the interface was too complex at the time.The tool also provides the ability to test locally. This helps speed up debugging, development, and testing.The tool provides a message explaining what it will do with a "Are you sure?" prompt. To bypass the message and prompt, use the `-y' option.StructureHere's a suggested GCS bucket structure.gcs://$BUCKET/certs/$DOMAIN/Here's an example with files uploaded.gcs://my-bucket/certs/example.com/proxies.txt
gcs://my-bucket/certs/example.com/cert-name-1.key
gcs://my-bucket/certs/example.com/cert-name-1.crtConsiderations:The cert name will be the name of the google ssl certification record that shows up withgcloud compute ssl-certificates list. Google ssl certificates need to be unique per Google project.The.keyand.crtfiles andproxies.txtmust exist before the script will create the google ssl certificate and continue on. Otherwise the script exits early with a message in the logs.Only a.keyand.crtfiles will trigger a target https proxy update.proxies.txtThere needs to be aproxies.txtfile in the same GCS folder. Theproxies.txtlists target https proxies to be updated. This is because the only useful information passed to the cloud function in the receivedcloud_eventobject is the bucket name and filename path. So aproxies.txtcontains a list of target proxie. If theproxies.txtdoes not exist, the script logs a message.This file should be a list of target https proxies separated by newlines. Here's agcloudcommand to help you grab a list to work with. You should remove most entries and only keep the proxies you want to update.gcloud compute target-https-proxies list --format json | jq -r '.[].name'Development SetupFor development, it is recommended to use Python virtualenv to set up the requirements. Here's a cheatsheet.virtualenv -p python3 .venv
source .venv/bin/activateInstallInstall the google-ssl tool.pip install --editable .This installs thegoogle-sslcommand.Note: Thepip install --editable .creates a shim that points to your local folder of the tool. This means any code edits you make are reflected without having to reinstall unless you move the folder. TLDR: You only have to install once.Alternatively, if you have poetry installed. You can runpoetry installSee poetry site for detailed install docs:https://python-poetry.org/docs/#installationCLI Help IntroCLI help:google-ssl
google-ssl --help
google-ssl deploy --help
google-ssl rotate --helpYou can also call the tool directly with python without installing the shim.python google_ssl/cli.py
python google_ssl/cli.py --help
python google_ssl/cli.py deploy --help
python google_ssl/cli.py rotate --helpThe shim makes the interface more user friendly, though and can be run from any location, not just the google-ssl project folder.DeployDeploy the code to google cloud functions.google-ssl deploy --bucket my-bucketThis simply usesgcloud functions deployto package up the code and deploy it to Google Cloud functions. The google function name is calledgoogle-ssl-rotatorby default. It can be set with theGS_FUNCTION_NAMEenv var.Local TestingThis can be useful before deploying code to Google Cloud Functions.Copy aproxies.txtfile with a list of target https proxies you want to be updated and the SSL cert files you want to be used to create the Self-managed Google SSL Cert. ReplaceCERT_NAMEwith your own value. The cert name needs to be unique across the entire Google project.CERT_NAME=cert-name-1
gsutil cp proxies.txt gs://my-bucket/certs/example.com/proxies.txt
gsutil cp $CERT_NAME.key gs://my-bucket/certs/example.com/$CERT_NAME.key
gsutil cp $CERT_NAME.crt gs://my-bucket/certs/example.com/$CERT_NAME.crtThe files must exist on the GCS bucket before running the next command:rotate.Therotatecommand "triggers" the ssl cert update logic and downloads the cert files from the GCS bucket. It performs thesamelogic that the google cloud function performs. You're just manually triggering it for rapid testing and development.google-ssl rotate --bucket my-bucket --name certs/example.com/name.keyThe nice thing about local testing is that you see the logs immediately in the same terminal.You can also provide a--proxiesoption to specify which target https proxies to update. In this case, theproxies.txtis not downloaded and used. Example:google-ssl rotate --bucket my-bucket --name certs/example.com/name.key --proxies demo-target-https-proxy-devRemote Testing: Cloud FunctionYou can build a test payload using the Google Cloud Function consoleTestingtab. Replace thenameandbucketwith some test values that exist in the GCS bucket.{"name":"certs/dev.example.com/test1.key","bucket":"certs-bucket-dev","contentType":"application/json","metageneration":"1","timeCreated":"2020-04-23T07:38:57.230Z","updated":"2020-04-23T07:38:57.230Z"}It will display acurlcommand you can use in the Cloud Shell to test. It will return an "OK" http body response. Check theLogstab to verify that it worked.Last but not least, use gcloud to check that the google ssl cert was created and target https proxy was updated. Here's a cheatsheet with useful example commands:gcloud compute ssl-certificates list
# useful to confirm certs are regional
gcloud compute ssl-certificates list --format json | jq '.[].selfLink'
gcloud compute ssl-certificates describe test1 --region us-central1
gcloud compute target-https-proxies describe demo-target-https-proxy-dev --region us-central1 | yq '.sslCertificates'The tool also shows a hint/tip with similar check commands upon completion.