#!/bin/bash

container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
container_name=$($container_cli ps --format="{{.Names}}" | grep memcached)

service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::memcached::certificate_specs.service_certificate)"
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::memcached::certificate_specs.service_key)"

# Copy the new cert and key from the mount-point to the real path
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_certificate" "$service_certificate"
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"

# Set appropriate permissions
$container_cli exec "$container_name" chown memcached:memcached "$service_certificate"
$container_cli exec "$container_name" chown memcached:memcached "$service_key"

# Send refresh_certs command to memcached
memcached_ip="$(hiera -c /etc/puppet/hiera.yaml memcached::listen.0 127.0.0.1)"
memcached_port="$(hiera -c /etc/puppet/hiera.yaml memcached::tcp_port 11211)"
echo refresh_certs | openssl s_client -connect $memcached_ip:$memcached_port

#!/bin/bash

container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
container_name=$($container_cli ps --format="{{.Names}}" | grep memcached)

service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::memcached::certificate_specs.service_certificate)"
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::memcached::certificate_specs.service_key)"

# Copy the new cert and key from the mount-point to the real path
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_certificate" "$service_certificate"
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"

# Set appropriate permissions
$container_cli exec "$container_name" chown memcached:memcached "$service_certificate"
$container_cli exec "$container_name" chown memcached:memcached "$service_key"

# Trigger a container restart to read the new certificates
$container_cli restart $container_name

--- 
+++ 
@@ -14,5 +14,7 @@
 $container_cli exec "$container_name" chown memcached:memcached "$service_certificate"
 $container_cli exec "$container_name" chown memcached:memcached "$service_key"
 
-# Trigger a container restart to read the new certificates
-$container_cli restart $container_name
+# Send refresh_certs command to memcached
+memcached_ip="$(hiera -c /etc/puppet/hiera.yaml memcached::listen.0 127.0.0.1)"
+memcached_port="$(hiera -c /etc/puppet/hiera.yaml memcached::tcp_port 11211)"
+echo refresh_certs | openssl s_client -connect $memcached_ip:$memcached_port
Fix memcached restart on cert renewal

Memcached does not need to be restarted in order to reload new certs,
a single refresh_certs command will do. This fix will preserve cached
items and avoid cache rebuild.

Change-Id: Ida5faaf4685b111b3b07b4499b24d4ba3b6ec459
Depends-On: I18bda6b9219ab42543f83c46be7763f98e4dfd0e
Signed-off-by: Moisés Guimarães de Medeiros <38931a700a64030c6e1883420cbba039aadcb37a@redhat.com>
