Bug 1715454
| Summary: | After control plane expired cert recovery, not able to rsh or check pod logs | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Sunil Choudhary <schoudha> |
| Component: | Node | Assignee: | Seth Jennings <sjenning> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Sunil Choudhary <schoudha> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 4.1.0 | CC: | ahoffer, aos-bugs, gblomqui, jokerman, mmccomas, sponnaga, tnozicka |
| Target Milestone: | --- | Keywords: | OSE41z_next |
| Target Release: | 4.1.z | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | 4.1.2 | ||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-06 14:25:24 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1718956 | ||
|
Description
Sunil Choudhary
2019-05-30 12:13:53 UTC
I have asked the question about logs on kubelet recovery here: https://docs.google.com/document/d/1-R1uZ_I1ZtA9BXl_Ugl3iH4cSoLnqk18P0TSNpWhRjo/edit?disco=AAAACtldDT8 What I have done before was: oc get configmap kube-apiserver-to-kubelet-client-ca -n openshift-kube-apiserver-operator --template='{{ index .data "ca-bundle.crt" }}' > /etc/kubernetes/ca.crt # distribute it to other masters and nodes # restart kubelet on all masters and nodes with systemctl restart kubelet That fixed logs for me when I've tried it last time. Sending to pod team to confirm and update kubelet recovery docs if they agree. We use a 10y root-ca CA at /etc/kubernetes/ca.crt that does not rotate (a target for future work). But we do not need to be changing that file in DR. We need to figure out why root-ca is not on the signing chain for the cert the apiserver is using. Tomas, sending this back your way to look at the signing chain. Sorry for the ping pong on this BZ. Seth looked back over this and agreed that Tomas’ suggestion was correct. Moving back to Pod. Also, doc changes posted and being tested by QE. So moving to on_qa also. https://github.com/openshift/openshift-docs/pull/15090 I guess we should closed this bug as with updated doc already live at [1], this is no longer an issue. [1] https://docs.openshift.com/container-platform/4.1/disaster_recovery/scenario-3-expired-certs.html |