Bug 1785745

Summary:	Expiring certs associated with kubelet-client/kubelet-server with generated CSR are not showing in easy-mode.yaml
Product:	OpenShift Container Platform	Reporter:	Tom Manor <tmanor>
Component:	Installer	Assignee:	Russell Teague <rteague>
Installer sub component:	openshift-ansible	QA Contact:	Johnny Liu <jialiu>
Status:	CLOSED DUPLICATE	Docs Contact:
Severity:	unspecified
Priority:	unspecified	CC:	scuppett
Version:	3.11.0
Target Milestone:	---
Target Release:	3.11.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-06 18:15:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tom Manor 2019-12-20 20:25:51 UTC

Description of problem:

After running /usr/share/ansible/openshift-ansible/playbooks/openshift-checks/certificate_expiry/easy-mode.yaml and reviewing output of certificate status, there was no listing of kubelet-client-current or kubelet-server-current certificates for any node in the cluster, even though CSRs were generated and awaiting approval.

*Requires Auto-Approver to be disabled in the cluster.


Version-Release number of selected component (if applicable):
OCP 3.11


How reproducible:
Reproducible


Steps to Reproduce:
1. Cluster with auto-approver disabled (openshift_master_bootstrap_auto_approve = false)
2. /etc/origin/node/certificates/kubelet-client-current or kubelet-server-current certificates should be velid
3. run /usr/share/ansible/openshift-ansible/playbooks/openshift-checks/certificate_expiry/easy-mode.yaml
4. Examine Report . identified certificates should be included in the report (whether valid, or after CSR is generated) and indicating date of expiration.

Actual results:
Report was run and no certificates were included from any node in the cluster from /etc/origin/node/certificates

Expected results:
Generated report should shows kubelet client/server certificates and their associated expiration date


Additional info:

Comment 1 Scott Dodson 2020-04-06 18:15:07 UTC


*** This bug has been marked as a duplicate of bug 1754081 ***