Bug 1397958

Summary:	[RFE] Improve certificate management tooling
Product:	OpenShift Container Platform	Reporter:	Eric Rich <erich>
Component:	Installer	Assignee:	Andrew Butcher <abutcher>
Status:	CLOSED ERRATA	QA Contact:	Gaoyun Pei <gpei>
Severity:	urgent	Docs Contact:
Priority:	high
Version:	3.0.0	CC:	aos-bugs, ederevea, erich, javier.ramirez, jialiu, jkaur, jokerman, mfojtik, mmccomas, pdwyer, pep, sreber, szobair
Target Milestone:	---	Keywords:	Performance
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:	The certificate re-deploy playbooks have been updated to ensure all internal certificates have been updated and when possible the update is done in a rolling manner preventing downtime. Please see https://docs.openshift.com/container-platform/3.5/install_config/redeploying_certificates.html for the latest information on updating certificates.	Story Points:	---
Clone Of:	1275176	Environment:
Last Closed:	2017-04-12 18:48:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1275176, 1420666, 1420667, 1421037, 1423430, 1427067
Bug Blocks:	1267746

Description Eric Rich 2016-11-23 16:31:32 UTC

The certificate tooling that was provided by https://bugzilla.redhat.com/1275648 has some key design issues that need to be addressed. 

Key area's of focus are: 

1: Making the script more modular, so that "section" of the tooling can be run on just the parts you need, one piece at a time. 
2: Checks for "facts" need to be limited, so that one role that requires the collects facts can skip this step if facts were collected by another role (that was already run and has the information).

Comment 4 Dan McPherson 2017-02-03 18:21:45 UTC

*** Bug 1419141 has been marked as a duplicate of this bug. ***

Comment 5 Scott Dodson 2017-02-07 18:02:28 UTC

Certificate redeploy improvements have merged.

Comment 7 Gaoyun Pei 2017-03-14 10:32:29 UTC

Verify this bug with openshift-ansible-3.5.32-1.git.0.42cf266.el7.noarch.rpm

The new cert redeploy playbooks mainly have one playbook for redeploying OpenShift CA certificate and one playbook for redeploying OpenShift Certificates including etcd, master, node, router and registry.
The latter one could be run against individual component separately.


*OpenShift CA

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml

This playbook would generate a new CA certificate and distributing an updated bundle to all components including client kubeconfigs and node CA trust.


*OpenShift Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml

This playbook would redeploys etcd, master, node, router and registry certificates. This playbook does not redeploy the OpenShift CA certificate and uses the current CA certificate to sign new certificates.


*Etcd Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-etcd-certificates.yml

This playbook only redeploys etcd certificates including master client certificates for etcd.


*Master Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-master-certificates.yml

This playbook only redeploys master certificates.


*Node Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-node-certificates.yml

This playbook only redeploys node certificates.


*Registry and Router Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-registry-certificates.yml
#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-router-certificates.yml

These playbooks replace installer created certificates for the router and registry.


All playbooks have been verified for various ocp-3.5 clusters including ha master/non-ha master, ha etcd/embedded etcd, containerized/rpm env. The playbooks are working as expected and the env is working well after each playbook executing.

Comment 9 errata-xmlrpc 2017-04-12 18:48:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0903