delete the hail root cert if it is already expired

build.yaml

@@ -198,6 +198,20 @@ steps:
     image:
       valueFrom: create_certs_image.image
     script: |
+
+      {% if not deploy %}
+      {% raw %}
+      kubectl get secret ssl-config-hail-root --template='{{index .data "hail-root-cert.pem"}}' \
+        | base64 --decode \
+        | openssl x509 -checkend 0 -noout -in -
+      {% endraw %}
+
+      if [ "$?" -ne 0 ]
+      then
+          kubectl delete secret -n {{ default_ns.name }} ssl-config-hail-root
+      fi
+      {% endif %}
+
       openssl req -new -x509 -subj /CN=hail-root -nodes -newkey rsa:4096 -keyout hail-root-key.pem -out hail-root-cert.pem
       until kubectl get secret -n {{ default_ns.name }} ssl-config-hail-root
       do