check_certificate: Support certificate only configuration

slapos/promise/plugin/check_certificate.py

@@ -16,7 +16,7 @@ class RunPromise(GenericPromise):
     """
 
     certificate_file = self.getConfig('certificate')
-    key_file = self.getConfig('key')
+    key_file = self.getConfig('key', None)
 
     try:
       certificate_expiration_days = int(
@@ -36,6 +36,14 @@ class RunPromise(GenericPromise):
           certificate_file, e))
       return
 
+    if certificate.not_valid_after - datetime.timedelta(
+       days=certificate_expiration_days) < datetime.datetime.utcnow():
+      self.logger.error(
+       'ERROR Certificate %r will expire in less than %s days' % (
+         certificate_file, certificate_expiration_days))
+      return
+
+    if key_file is not None:
       try:
         with open(key_file, 'r') as fh:
           key = serialization.load_pem_private_key(
@@ -52,12 +60,9 @@ class RunPromise(GenericPromise):
             certificate_file, key_file))
         return
 
-    if certificate.not_valid_after - datetime.timedelta(
-       days=certificate_expiration_days) < datetime.datetime.utcnow():
-      self.logger.error(
-       'ERROR Certificate %r will expire in less than %s days' % (
-         certificate_file, certificate_expiration_days))
-      return
-
+    if key_file:
       self.logger.info(
         'OK Certificate %r and key %r are ok' % (certificate_file, key_file))
+    else:
+      self.logger.info(
+        'OK Certificate %r is ok, no key provided' % (certificate_file,))

slapos/test/promise/plugin/test_check_certificate.py

@@ -146,6 +146,19 @@ class TestCheckCertificate(TestPromisePluginMixin):
         self.certificate_path, self.key_path)
     )
 
+  def test_no_key_provided(self):
+    self.createKeyCertificate()
+    self.writePromise({
+      'certificate': self.certificate_path,
+    })
+    self.configureLauncher()
+    self.launcher.run()
+    self.assertPassedMessage(
+      self.getPromiseResult(self.promise_name),
+      "OK Certificate '%s' is ok, no key provided" % (
+        self.certificate_path,)
+    )
+
   def test_no_key(self):
     self.createKeyCertificate()
     nokey_path = os.path.join(self.tempdir, 'nokey.pem')
@@ -206,6 +219,20 @@ class TestCheckCertificate(TestPromisePluginMixin):
         self.certificate_path,)
     )
 
+  def test_expires_no_key(self):
+    self.createKeyCertificate(days=5)
+    self.writePromise({
+      'certificate': self.certificate_path,
+    })
+    self.configureLauncher()
+    with self.assertRaises(PromiseError):
+      self.launcher.run()
+    self.assertFailedMessage(
+      self.getPromiseResult(self.promise_name),
+      "ERROR Certificate '%s' will expire in less than 15 days" % (
+        self.certificate_path,)
+    )
+
   def test_expires_custom(self):
     self.createKeyCertificate(days=19)
     self.writePromise({
@@ -222,6 +249,21 @@ class TestCheckCertificate(TestPromisePluginMixin):
         self.certificate_path,)
     )
 
+  def test_expires_custom_no_key(self):
+    self.createKeyCertificate(days=19)
+    self.writePromise({
+      'certificate': self.certificate_path,
+      'certificate-expiration-days': '20'
+    })
+    self.configureLauncher()
+    with self.assertRaises(PromiseError):
+      self.launcher.run()
+    self.assertFailedMessage(
+      self.getPromiseResult(self.promise_name),
+      "ERROR Certificate '%s' will expire in less than 20 days" % (
+        self.certificate_path,)
+    )
+
   def test_expires_bad_value(self):
     self.createKeyCertificate(days=14)
     self.writePromise({
@@ -237,6 +279,20 @@ class TestCheckCertificate(TestPromisePluginMixin):
       "ERROR certificate-expiration-days is wrong: 'bad'"
     )
 
+  def test_expires_bad_value_no_key(self):
+    self.createKeyCertificate(days=14)
+    self.writePromise({
+      'certificate': self.certificate_path,
+      'certificate-expiration-days': 'bad'
+    })
+    self.configureLauncher()
+    with self.assertRaises(PromiseError):
+      self.launcher.run()
+    self.assertFailedMessage(
+      self.getPromiseResult(self.promise_name),
+      "ERROR certificate-expiration-days is wrong: 'bad'"
+    )
+
 
 class TestCheckCertificateSameFile(TestCheckCertificate):
   same_file = True